I edit a SAAS for small businesses. A lot of them don't have a state of the art network configuration, and it creates issues with Cognito.
When trying to login, their web browser makes a POST https://cognito-idp.eu-west-1.amazonaws.com/. Their DNS resolves cognito-idp.eu-west-1.amazonaws.com to an IPv6 (2a05:d018:478:XXXX:443). But their router does not support IPv6 and the request times out.
A workaround we found is to turn off Internet Protocol Version 6 on their Windows desktops - but it is really edgy.
Do we have any way from the webapp to force the resolution of cognito-idp.eu-west-1.amazonaws.com to an IPv4 ?
Related
For network gurus out there, I'll like to ask some questions regarding some unique setup where the server will be sending a request to a client on localhost on a certain port.
I have a cloudy understanding of some network fundamentals that I hope you'll be able to help me out.
Kindly check the image below:
Basically, there's a static website hosted in AWS s3 and at some point this website will send a request to https://localhost:8001.
I was expecting that it will connect to the nginx container listening on port 8001 in my local machine, but it results in 504 gateway error.
My questions are:
Is it possible for a remote server to directly send data to a client at a particular port by addressing it as localhost?
How is it possible for the static website to communicate to my local docker container?
Thanks in advance.
In the setup you show, in the context of a Web site, localhost isn't in your picture at all. It's the desktop machine running the end user's Web browser.
More generally, you show several boxes in your diagram – "local machine", "Docker VM", "individual container", "server in Amazon's data center" – and within each of these boxes, if they make an outbound request to localhost, it reaches back to itself.
You have two basic options here:
(1) Set up a separate (Route 53) DNS name for your back-end service, and use that https://backend.example.com/... host name in your front-end application.
(2) Set up an HTTP reverse proxy that forwards /, /assets, ... to S3, and /api to the back-end service. In your front-end application use only the HTTP path with no host name at all.
The second option is more work to set up, but once you've set it up, it's much easier to develop code for. Webpack has a similar "proxy the backend" option for day-to-day development. This setup means the front-end application itself doesn't care where it's running, and you don't need to rebuild the application if the URL changes (or an individual developer needs to run it on their local system).
Running an ASP.Net Core application based on IdentityServer 4 on an AWS cluster,
after 14-21 days all outgoing HTTPS requests take 5min or more to finish.
After an investigation found that the WinHTTP Web Proxy Auto-Discovery Service dies with the following error: The endpoint mapper database entry could not be created. not sure if this is the issue or a side effect of something else that breaks lower in the OS.
Environment:
ELB with with an autoscaling group with two instances behind it, issue occurs on both
Windows Server 2019
Notes:
It is a custom AMI but the only difference with the instances that do not experience this is the product is running on it.
Happens on both .Net core 2.2 and 3.1 based versions of the application
Happens on both versions based on IdentityServer4 v2 and v3
The app is deployed self contained
The app uses Kestrel without a reverse proxy in front of it
Tried:
Enabled schannel: no errors in the schannel logs set on trace
No other notable errors in any of the EventViewer logs
Restarting the instance fixes the problem
When running curl.exe -v to an HTTPS site on the machine the request gets stuck on schannel: checking server certificate revocation
The clocks on the instances are OK
Restarting the app process does not resolve the issue
Disabling the HTTPClient in the code using the WinHTTP Web Proxy Auto-Discovery Service service still breaks the service.
For those running into this.
The root of this issue is the WinHTTP autoproxy (wpad) service which is used to autoconfigure proxy settings, WinHTTP 5.1 implements the Web Proxy Auto-Discovery (WPAD) protocol also known as autoproxy, and it must support DHCP. Now this is where the problem occurs, the AWS DHCP does not support DHCP option 252 (used by WPAD) which in turn causes the issue.
The resolution is to disable the WinHTTP service as it is turned on by default in Windows.
I am seeing this exact same problem on a bare-bones AWS Lightsail instance of Server 2019. I am simply using IIS as a reverse proxy with the URL Rewrite module.
Here are some details about my environment/scenario in case it helps narrow down some common factors.
I have zero .Net applications running on this box, it is simply a reverse proxy.
I have 2 web applications, and 2 websites setup in IIS, each is a reverse proxy for a different back-end API.
The websites in IIS on the reverse proxy use the same CA issued wildcard certificate as the back-end API's.
The back-end API's are also hosted in IIS (Server 2012 R2).
The back-end API's run in a PCI compliant environment so IIS Crypto has been used to tighten up encryption protocols/algo's. I have not used IIS Crypto on the reverse proxy yet, so as I type this I'm starting to wonder if there's an SSL aspect to this.
I've been thinking of the concept of an ad blocker that runs at the OS level, rather than as a browser extension. I know that I can place x.com in Windows' %windows%\system32\drivers\etc\hosts file and point it to the IP of y.com, and on y.com I can serve up content that says, "This ad blocked by Example Ad Blocker". However, the domain list I have is quite large -- like literally a thousand domains and growing, and so this wouldn't work well in file lookups. Does Windows permit some way to programmatically, like Qt/C++, add a DNS reroute rule in a more speedy way?
There's a risk of doing domain intercepts and DLL hooks using APIs because AV products and/or Microsoft would have to whitelist you and certify you so that your activity doesn't look like a virus. And the odds of them doing that are not only low (unless you're a multimillion dollar company), but they want to protect their ad marketing too.
The best option is to make a browser extension for each of the browsers. You can even check the source code of the AdBlock Chrome extension to see how it works. The trouble with that in 2017, however, is that there's no common browser extension platform just yet. It's getting much closer, but it's still not standardized yet. The new standard uses the Chrome standard. Opera, Firefox, Edge, and of course Chrome support this new standard to some degree, but it's kind of unsmooth still. And for anyone outside of that, such as IE11 or earlier, they're not going to have your Chrome-style browser extension and you'll have to go the seriously hard route to make one just for those earlier browsers or ask the customer to upgrade when your adware product installs.
If you want something that doesn't require a browser extension, then the option you want is to add another DNS server connection in the user's DNS client settings. I don't know how to do this yet via C#, Qt/C++, or C++. However, you can shell out from those languages and use the "netsh" command to create those DNS connections. Probably a good strategy would be to find the user's default gateway IP. Then, make the DNS priority like so:
your DNS server that redirects x.com to y.com so that you can do ad blocking from y.com via a web server
the user's default gateway IP
Google's DNS (8.8.8.8) in case the default gateway IP has changed for the user
So, it would be something like these 4 netsh commands:
netsh delete dnsserver "Wireless Network Connection" all
netsh interface ip add dns name="Wireless Network Connection" addr=1.1.1.1 index=1
netsh interface ip add dns name="Wireless Network Connection" addr=192.168.254.254 index=2
netsh interface ip add dns name="Wireless Network Connection" addr=8.8.8.8 index=3
Change "Wireless Network Connection" to "Local Area Connection" if they are using a cable for their computer instead of wireless. (Few do that these days.)
Change 1.1.1.1 to the IP address of your special DNS server.
Change 192.168.254.254 to the IP address of their default gateway.
The third rule (8.8.8.8) tells the computer to use Google's DNS if all else fails. This is important because they could disconnect their laptop at home and go to a café or something, and we need their DNS stuff to still work.
Now, once you get the DNS client settings right, you need a cheap Linux cloud host to serve up the DNS server and web server. You might even need more than one in case one goes down for maintenance, and possibly on a different cloud zone or even cloud hosting provider.
For the DNS product, if you have Linux skills, you can install and configure dnsmasq pretty easily to get a cheap and easy to manage DNS server on Linux. Or, if you search your Linux repositories, you can find other DNS servers, some more robust than others, some harder to use than others.
For the web product, you can install NGINX or Apache on each of the two DNS servers. Then, you can make a configuration where any domain connection can come to it and it will load a web page for that domain. The web page can say something like, "Ad Blocked By X Ad Blocker" or whatever you want in very small font (small enough to fill the ad spot).
Once this is all in place, you'll have to reboot the Win PC client and also clear their browser cache and history so that DNS will route through the new arrangement.
The end result is that when people on that Windows PC surf the web and load an ad, their OS will make a DNS request to translate domain name to IP address. The first DNS server they'll reach will be your private DNS server. It can then say that x.com ad domain (as an example) is the IP address of your private DNS server. That private web server will then be contacted and it will display the ad block message. For all other requests not served up by your DNS servers, they'll go to their default gateway. If that's not serving up DNS as needed, then they'll failsafe to the Google DNS on 8.8.8.8. So, web browsing will work fine, minus ads.
As for a bad domain list, there's a community-maintained bad domains list here on Github.
The trouble with the private DNS server that you host is that you're now having to pay a bandwidth bill for gobs of connections to it. That's probably undesirable unless you've got a proper way to monetize that. A better strategy would be to NOT use a private DNS server on the web and use a local DNS server and a local web server. You'd have to code both of those or use some third-party product for that. The trouble there, however, is that you may have some commercial licensing problems with that, or increased costs, and it won't work for some web developers who already use a web server on their workstation.
Therefore, as you can see from the added costs, hassle, and workstation configuration nuance troubles, the best strategy would be to use the browser extension for ad blocking.
However, even at that, how are you going to differentiate your product from the free ad blockers out there that are doing a sensational job already?
I have a website and until some time ago it was administrated by a friend of mine; recently our relationships have been reduced, so I took the entire control of the website.
I'm not really expert with some aspects in the management of a web site. Actually I would make some back-end edits and I should connect with the server of the website.
I have the host IP, a username and a password. I tried to connect using Filezilla but I receive an error message: 530 Login incorrect.
So, I contacted the domain provider, I was convinced that the domain provider was the same of the hosting provider, but they told me that it was not true and that the hosting for the website is provided by "someone else" (it could be an other hosting provider or a private web-server, for example).
I don't know what to do.
How can I connect to the server of my website? What am I missing?
p.s.: sorry for my bad english
I think you might be pointing filezilla at port 80. Try pointing at the ftp port (21 probably.) If this doesn't work it could be that the hosting uses a non standard port.
If in doubt get some support from the hosting company. Only they know how they are set up. If the use something like cpanel you can access files through that. They may be reluctant to help if you can't prove the site is yours. Usually by using the email address you set up when you bought the hosting.
And no, the domain provider does not have to be the same as the hosting provider. My domains are hosted at godaddy and I have odd bits of hosting all over the place ;)
Im working on some JSON-based web service that is supposed to work with Android application.
I would like to encrypt data transport between client (android) and server (virtual server in datacenter).
I don't have to make sure that my server is my server, just data encryption.
I have no idea how to use HTTPS.
Do I just put my PHP files in private_html and use https://example.com url?
To use HTTPS, you don't have to do anything in the coding of your web service - it's all in your hosting. Here the are steps you can follow. The specific instructions differ in your hosting (IIS, Apache, AWS/Azure, etc), but you can google specifics on how to accomplish any of these steps for whatever host and application framework you decide.
Buy an SSL certificate (there are many different vendors, but expect between $75-$200 for the certificate) based on the vendor, reputation, and level of security you need.
Generate a certificate signing request (CSR) from the server you'll be hosting.
Upload the CSR to the SSL vendor who will validate and provide the certificate for your use.
Import the SSL certificate into your application server, and configure the site to use the certificate. For instance, if you're hosting Microsoft IIS, you'd import the SSL certificate and then add HTTPS bindings on 443 to the specific website hosting your web service.
Another point of security. Since you are deploying SSL, you don't have to do any application level encryption (assuming you are not putting sensitive information in query strings - use POST if you think you need to). You probably would want to implement some security to restrict access to your web service so only your app can access it. Best practice is some level of OAuth, but at a minimum some type of pre-shared key in the header of the request is a lot better than nothing.
Here are some additional sites for more information:
https://www.digicert.com/ssl-certificate-installation.htm
https://support.godaddy.com/help/category/742/ssl-certificates-installing-ssl-certificates?prog_id=GoDaddy
If you don't want to pay for a certificate, you can use certificate signet by your own CA and add the root certificates into your application using HTTPClient and keystores
Here there's some guides
http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/
http://developer.android.com/reference/org/apache/http/client/HttpClient.html
KeyStore, HttpClient, and HTTPS: Can someone explain this code to me?
http://blog.antoine.li/2010/10/22/android-trusting-ssl-certificates/
You can limit users to use JUST and only HTTPS in apache, IIS or whatever do you use. If your client connects to your server, his communications will be likely to encrypted, because he is already using HTTPS. And for responsing in HTTPS you virtually cannot send HTTPS responses, as far as I know, unless that other side isn't also a website (for example, if you have your website, you could send such a response e.g. to Google). You should be okay to send data like http status codes (OK, NotModified, PageNotFound, ...), or if you want something more, or if it is a requirement, then there you still have JSON and you could encode it as well, with some encoding algorithms, or use binary JSON format.
Check if your hosting company provides a free public shared https address. Most of them do.
If you want to understand how to do it right, follow this thread
Warning: Don't stick with the solution below for production.
If you plan o use an https endpoint without a certificate you have to make sure to disable peer verification, check this answer