We got an issue in penetration testing, that fully qualified Host Name ec2-IpAddress.example.amazonaws.com is being exposed, Can anyone help to fix this issue.
You need to disable DNS host names on your VPC subnet.
If your VPC is enabled to support DNS hostnames, each instance that
receives a public IP address or an Elastic IP address is also given a
public DNS hostname. We resolve a public DNS hostname to the public IP
address of the instance outside the instance network, and to the
private IP address of the instance from within the instance network.
For more information, see Using DNS with Your VPC.
See https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html#vpc-public-ipv4-addresses
Related
Traditionally, the purpose of a DNS server is to translate human-friendly hostnames into IP addresses. More importantly, it allows for the updating of a service's location (IP address) on the network while retaining the same hostname.
In EC2 however, the public DNS hostname is linked to its public IP address. For example, if the IP address of an instance is 1.2.3.4, its DNS name would be ec2-1-2-3-4.compute-1.amazonaws.com.
As the DNS name is syntactically linked to its IP, it wouldn't serve as a memorable URL nor allow the IP to change independently of its DNS name.
What could be the reason AWS provides the DNS name? What purpose does the DNS name serve in the context of EC2? What can I accomplish with the public DNS hostname that I can't with the public IPv4 address?
One advantage to using the public hostname instead of the private IP is actually the magic translation to IP address.
If you're inside of AWS and you use the public hostname it will resolve to the private IP, whereas if you're outside of AWS it will resolve to the public IP. Some users will create a CNAME for a specific host that resolves to the public hostname of the EC2. Then when one of their applications connect to this hostname it will route to the private IP, which will avoid all public transit.
Each instance that receives a public IP address is also given an external DNS hostname; for example, ec2-203-0-113-25.compute-1.amazonaws.com. We resolve an external DNS hostname to the public IP address of the instance from outside its VPC, and to the private IPv4 address of the instance from inside its VPC
Outside of this feature it is a regular domain record that is supplied to provide a user with either IP or domain name.
I have an instance running on AWS. I have stopped it and then restarted it after few hours. Now I am unable to access my website by a domain name but it is accessible by its ip
Looking for a solution so that I am able to access it with domain name also.
As this is your personal domain, the likely scenario is that when your instance rebooted the IP address changed.
You can validate this by comparing the public IP address in the AWS Console to the IP address entered in your DNS configuration for your domain.
This is expected behaviour for the standard public IP address for EC2 hosts, if you want to resolve this you will need to create an elastic IP address and associate it to the instance you have.
Once this has been associated update your DNS record to use the new public IP that has been assigned (the EIP). This will then allow you to reboot your instance without the risk of losing your IP. In addition be aware that based on the TTL of your domain you will need to wait for the DNS to propagate.
I registered a domain name with AWS Route 53 as mydomain.com. Is there anyway that I can assign e.g. ns1.mydomain.com as a public hostname to an EC2 which does NOT have a Elasti IP?
Thanks
You can assign the domain name to any IP address of an instance. However be aware of the following limitations:
If a domain name is assigned to a private IP, it will not be connectable without network access to that IP
If the domain is assigned to a non-elastic public IP if the instance stops and starts you would lose the public IP so would need to update the DNS resolution.
If you have a public facing application, but want to keep network traffic that directly connects to the instance private you should look at using an ELB in front of the application to provide a security boundary between the internet and your application.
Utilize a load balancer in front of the instance and assign the public hostname to the load balancer.
Use S3 webpage redirect and assign the hostname to the S3 URI.
If the problems is that you don't have any elastic IP's left, you can request for more. This should be resolved within about 15 minutes.
Forgive me if this question is off-topic for this community; I couldn't find a more appropriate one and StackOverflow has always come through when I need it!
I am trying to set up a bastion host with Amazon EC2. I want the only way to connect to any of my instances to be an SSH from this bastion instance. The public subnet containing the bastion uses CIDR block 10.0.128.0/17, and the subnet containing my other instances uses CIDR block 10.0.0.0/17. I have network ACL and security group rules permitting SSH egress from the bastion to the other subnet, and permitting SSH ingress to the other subnet from the bastion. Everything should work. Unfortunately, my bastion is trying to communicate with the other instances using their public IPs, which of course is not in the 10.0.0.0/17 block, and therefore the traffic is being blocked. How can I ensure that my bastion uses private IP addresses while communicating with other instances in the private subnet? This seems like it should be the default behavior for local traffic in a VPC but apparently its not!
EDIT:
I left out some key info. The "private" instance giving me trouble is actually public; it is a Wordpress web server with public IP 52.14.20.167 (please don't spam it lol) and a custom www DNS name. However, while I want my bastion to be able to SSH into it using that DNS name, I still want all SSH traffic be local so that my security groups and network ACLs can be very restrictive. According to this AWS doc:
We resolve a public DNS hostname to the public IPv4 address of the
instance outside the network of the instance, and to the private IPv4
address of the instance from within the network of the instance.
However, I think this rule only applies to the AWS-provided (IP-like) public DNS names. My custom DNS always resolves to the public IP, not the private one, as seen in the flow log from my bastion's subnet below. 10.0.128.6 is the bastion and 52.14.20.167 is the web server. Idk what the 190. and 14. addresses are. So my more educated question is, how can I have custom DNS names resolve to private IPs for a bastion host and second instance in the same VPC?
10.0.128.6 52.14.20.167 56008 22 6 7 420 1485465879 1485465996 REJECT OK
190.173.143.165 10.0.128.6 27754 22 6 1 40 1485466241 1485466296 REJECT OK
10.0.128.6 52.14.20.167 56012 22 6 7 420 1485466903 1485467016 REJECT OK
190.13.10.206 10.0.128.6 28583 22 6 1 40 1485467140 1485467197 REJECT OK
10.0.128.6 52.14.20.167 56014 22 6 7 420 1485467437 1485467557 REJECT OK
14.158.51.244 10.0.128.6 55532 22 6 1 44 1485467500 1485467557 REJECT OK
After some question/answer back and forth with the OP, we determined that one of the root causes for the issue was the use of custom DNS names.
The user would access the bastion host, and from there would resolve the custom DNS name to a public IP address for the EC2 instance in question. This is why the traffic, from the bastion host, was not using the EC2 instances' private IP addresses. The key to using an EC2 instance's private IP address is to resolve the AWS-assigned public DNS hostname of that instance from within AWS. As the OP noted from the AWS docs, that AWS-assigned public DNS hostname will resolve to a public IP address from outside of AWS, but will resolve to a private IP address from inside of AWS. Thus the key was to get the user using that AWS-assigned public DNS hostname.
One way in which to keep the use of the custom DNS hostname, and still resolve to the private IP address of the EC2 instances from the bastion host is to make the custom DNS name be a CNAME record (rather than an A record), which points to the AWS-assigned public DNS name. Yes, this requires updating that DNS record whenever a new/different EC2 instance appears, but such an update would be required anyway, for an A record to point to the new public IP address. By using a CNAME, things should work as desired.
Hope this helps!
You need to use CNAME records instead of A records when you setup DNS for your ec2 instance. Assume that you have a www site with url my-site.com. If you put DNS records my-site.com A your_public_ip example my-site.com A 52.14.20.167
your traffic will go outside the aws VPC if you try to reach that url from any server from inside your VPC.
To avoid this you need to change that record to
my-site.com CNAME your_EC2_instance_AWS_DNS_address
Example:
my-site.com CNAME ec2-XX-YY-ZZZ-17.eu-west-1.compute.amazonaws.com
With this if you access your www service outside AWS you will get your public ip resolved, and inside the AWS VPC you will get the private address of your service and traffic will stay inside AWS VPC.
I have standard AWS EC2 instance. It has standard URL that was created by AWS automatically on EC2 creation:
ec2-xx-xx-xxx-xx.ap-southeast-2.compute.amazonaws.com
I want to change host name for arbitrary value and it is not a public domain. And I want to access EC2 from Internet with that custom host name:
Instead: ec2-xx-xx-xxx-xx.ap-southeast-2.compute.amazonaws.com
I want at least: foo.ap-southeast-2.compute.amazonaws.com
Or even better: foo.compute.amazonaws.com
Is it possible in AWS?
I want to change host name for arbitrary value and it is not a public
domain. And I want to access EC2 from Internet with that custom host
name ... EG foo.ap-southeast-2.compute.amazonaws.com
Is it possible in AWS?
No, it is not. The external DNS hostname is the authoritative DNS name for that instance. That "ec2-xx-xxx-xxx-xx" part is the IP # assigned for that instance. That hostname stays with that IP number/instance as long as it is assigned to it.
Each instance that receives a public IP address is also given an
external DNS hostname; for example,
ec2-203-0-113-25.compute-1.amazonaws.com. We resolve an external DNS
hostname to the public IP address of the instance outside the network
of the instance, and to the private IP address of the instance from
within the network of the instance.
Using DNS, of course you can alias that DNS hostname to any host in a custom domain. But you cannot modify the AWS given external DNS hostname.
See Public IP Addresses and External DNS Hostnames