There is a topic in EC2 documentation Changing the System Hostname. Why does one need to change it? Just for fun? Just to have some nice shell prompt?
// change this
ubuntu#ip-123-12-1-231 ~ $
// to this?
ubuntu#my-beautiful-hostname ~ $
I'm learning how AWS DNS work, where my EC2's DNS lives that resolves a default Public DNS name to Public IP address of my instance
Public DNS: ec2-xx-xx-xxx-xx.ap-southeast-2.compute.amazonaws.com
Public IP: xx-xx-xxx-xx
And how can I host multiple apps with real domain names (example1.com, example2.com, so on) in one EC2 instance, how to modify and manage DNS. And actually I don't know what to read about it in docs, and read everything related to hostnames and DNS, and found this topic Changing the System Hostname and don't understand why would one want to change a hostname and if it can be valuable info for me.
UPD:
And now a real a practical question for those specimens who like closing questions quietly.
Where does a DNS live in EC2 instance? How is Public DNS mapped to Public IP? Where is that record in my EC2 Ubuntu instance? Is Route53 involved in it?
Where does a DNS live in EC2 instance?
It doesn't, DNS resolution use by the server is set in /etc/resolv.conf and /etc/nsswitch.conf. The hostname domain name for that server is set (Redhat derived systems) in /etc/sysconfig/network
How is Public DNS mapped to Public IP?
With a DNS record
Where is that record in my EC2 Ubuntu instance?
In the DNS for the domain that you have attached it to
Is Route53 involved in it?
Only if you are using Route53 for DNS
EC2 DNS location (source):
In EC2-Classic, the Amazon DNS server is located at 172.16.0.23.
In EC2-VPC, the Amazon DNS server is located at the base of your VPC network range plus two.
For more information, see Amazon DNS Server in the Amazon VPC User Guide
Well i had the same issue as you did and someone replied me this
It isn't a huge deal if you are just running a single server, mostly
to help you identify a server with local networking. Some things like
mail servers will use your hostname unless you specify otherwise.
This is an example of somewhere I saw that done
My original query
why do some people set hostname and some dont? whats the use?
hostnamectl set-hostname
Related
At our company we have three AWS accounts, the main one, used as "root" account for IAM and hosting an OpenVPN Access Server. The other two accounts are pro and stg. Each one has its own VPC, with different IP ranges, and we have a VPC peering between the root and pro accounts, and other one between root and stg. IP routing is already setup and everything is under control from this side.
(I'm sorry I can't upload images yet, so here you have the link)
VPN+VPC-Peering
The problem comes with DNS resolution. The setup is this one:
I've installed BIND9 in the OpenVPN server, to allow DNS forwarding for private hosted domains, using a configuration like this one in named.conf.local
zone "stg-my-internal-domain.com" IN {
type forward;
forward only;
forwarders { 10.229.1.100;10.229.2.100; };
};
zone "pro-my-internal-domain.com" IN {
type forward;
forward only;
forwarders { 10.228.1.100;10.228.2.100; };
};
And also two Route53 inbound resolvers (a simple BIND server running on each VPC also works) running in 10.229.1.100 and 10.229.2.100 for stg and 10.228.1.100 10.228.2.100 for pro account
VPN clients have OpenVPN profiles that use the Access Server as DNS resolver.
From my client, I can resolve both my-service-1.pro-my-internal-domain.com and my-service-2.stg-my-internal-domain.com perfectly, but the problem comes when I want to resolve internal domain names like the ones that AWS generates inside each VPC with my-service-2.eu-west-1.compute.internal
I know that this is an anti-pattern and I should always use the private domain as much as I can, but for some cases like EMR clusters, YARN and Hadoop managers use links that reference to the internal AWS names, making the resolution impossible.
So my question is: Is there any way to configure DNS to delegate resolution to a secondary address if primary fails?
I could set up a forwarder for the eu-west-1.compute.internal zone using all the accounts resolvers, but
DNS specification says that the secondary nameserver will only be used if the first one is unreachable, so as far as it answers an empty or "unknown" response, it's still a valid response and the second one will not be queried.
Any help is really appreciated!
Why not just change the internal host name to a public dns name? Those services are using the hostname assigned to them of course. You can change it.
See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-hostname.html
You may (or may not) need to assign fixed private ips to each. In any case publish this private IP in a public DNS zone. You should then be able to resolve these names properly. Note you can also have a script run on each instance on startup, to update the hostname and dns record.
For a good discussion on private ip addresses in public DNS, see https://serverfault.com/questions/4458/private-ip-address-in-public-dns
For reference, here is the best answer there:
Some people will say no public DNS records should ever disclose private IP addresses....with the thinking being that you are giving potential attackers a leg up on some information that might be required to exploit private systems. Personally, I think that obfuscation is a poor form of security, especially when we are talking about IP addresses because in general they are easy to guess anyway, so I don't see this as a realistic security compromise. The bigger consideration here is making sure your public users don't pickup this DNS record as part of the normal public services of your hosted application. ie: External DNS lookups somehow start resolving to an address they can't get to. Aside from that, I see no fundamental reason why putting private address A records into the public space is a problem....especially when you have no alternate DNS server to host them on. If you do decide to put this record into the public DNS space, you might consider creating a separate zone on the same server to hold all the "private" records. This will make it clearer that they are intended to be private....however for just one A record, I probably wouldn't bother.
AWS only supports DNS resolution of these internal ipv4 DNS hostnames if your VPN is in the same region as your EMR cluster (or any other compute resource). I have reached out to their Support and they have confirmed this.
For example, I have an AWS Client VPN endpoint setup in Frankfurt and an EMR cluster in Ireland. I am pushing to my host the private DNS server of the VPC (and all other related config is enabled in both VPCs) so that I can resolve private Route53 DNS zone records.
While I am connected to the VPN,
I can't resolve this:
$ dig +short ip-10-11-x-x.eu-west-1.compute.internal
$
But I can resolve the following, which is an instance that's in the same region as the VPN endpoint:
$ dig +short ip-10-10-x-y.eu-central-1.compute.internal
10.10.x.y
How to solve this:
Either move your EMR clusters in the same region as your VPN is, or the other way around.
But the simplest solution might be to just use a Chrome plugin (here's an example) that automatically redirects ip-x-y-z... URLS to x.y.z IPs.
Does Google Cloud provide public hostnames for their Compute instances?
AWS seems to generate public hostnames for their EC2 instances:
A public (external) DNS hostname takes the form ec2-public-ipv4-address.compute-1.amazonaws.com for the us-east-1 region, and ec2-public-ipv4-address.region.compute.amazonaws.com for other regions. We resolve a public DNS hostname to the public IPv4 address of the instance outside the network of the instance...
Similar question:
This seems like a similar question but (1) setting up a DNS seems like an overkill, (2) seems like I'll need to do some sort of thing outside of Google Cloud anyway or it isn't public (not sure), and (3) it could be outdated (2014).
No, GCE doesn't offer hostnames for an instance. It does assign external IP addresses for each instance. Associating a DNS record with your instance is the only method to generate a hostname.
GCE does have built in private hostnames, inside the same network. For example two instances in the same VPC can ping each other by name
Instance 'test-instance': start server on :8080
Instance 'second-instance': curl test-instance:8080
// Response 'Hello World'
No. Source: FridayPush's answer (thanks! from his profile, seems worthy of trust for Google-Cloud things :-)).
The reason I wrote a separate answer is to make it clear that you can't have a public hostname totally through Google Cloud. You can either have an internal hostname totally through Google Cloud, or you'll need to do something outside of Google Cloud (e.g., own a domain name) to have a public hostname.
GCE instances don't currently have a public DNS name for their external IP address. But there is now a gcloud compute config-ssh (docs) command that's a pretty good substitute.
This will insert Host blocks into your ~/.ssh/config file that contain the IP address and configuration for the host key.
Although this only helps with SSH (and SSH-based applications like Mosh and git+ssh), it does have a few advantages over DNS:
There is no caching/propagation delay as you might have with DNS
It pre-populates the right host key, and the host key is checked the right way even if the ephemeral IP address changes.
Example:
$ gcloud compute config-ssh
...
$ ssh myhost.us-west1-b.surly-koala-232
If your GCP instance has an external IP, ephemeral or static, then that IP address has public DNS entry that you can easily get with a reverse DNS lookup.
Example:
# get your external IP
$ curl icanhazip.com
34.88.81.150
# do a reverse DNS lookup
$ dig +short -x 34.88.81.150
150.81.88.34.bc.googleusercontent.com.
A one-liner to get that public DNS entry:
# (sed removes the trailing dot)
$ dig +short -x $(curl -s icanhazip.com) | sed "s/.$//"
150.81.88.34.bc.googleusercontent.com
We are trying to configure a VPC, which has a private subnet and a public subnet. In the private subnet there is an RDS which is not publicly accessible. We have test it and seems that works fine! The issue though its that when I ping the RDS endpoint from my computer it returns the Private IP of the RDS (its not returns any packets though).
We do not want to shows the Private IP.
Any help would be appreciated!
I went ahead and popped open a chat with our AWS support team to pick their brain. Basically, this boils down to how they host their DNS mappings for RDS endpoints; they're created in a public hosted zone by default (not modifiable). Hence, you can resolve your RDS endpoint over the internet (because the mapping is hosted publicly), but can't actually route any data to it.
If this is an issue, to get around it you can ... jump through some hoops:
An alternative will be to create a private hosted zone with a record
that points to the rds endpoint. (for example a private hosted zone
"xxxx.com" that has an alias record pointing to rds endpoint), in which case you will reach out to your rds instance
using xxxxx.com
However, this doesn't actually disable the original AWS created endpoint from returning the private IP, it just allows you to configure an endpoint that doesn't.
For what it's worth, revealing your private IP is pretty harmless; several thousand devices likely share your exact private IP. The only way this information would be concerning for you is if an attacker was actually in your network - and at that point... they could just do a lookup on the DNS from there to get the IP.
First question: why do you want to do this? Your 10.1.2.3 or 172.31.2.3 or whatever is a non-routable address. It really doesn't matter whether people know it if they can't get into your VPC.
As for actually preventing it, you can't: Amazon makes the endpoint available via DNS (you can use nslookup to find it). You could always try filing a support ticket, but I wouldn't expect any results.
Also, FYI the second component of the endpoint is related to your account. So in your image you redacted non-important information but left the (potentially) important information present.
In case it's not clear, the problem is in how Amazon resolves DNS requests, not in how the networks are connected. Here's an example of an nslookup call for one of our database instances that's running on a private subnet. This is from my PC, not connected to the VPC via VPN or any other means:
> nslookup REDACTED.REDACTED.us-east-1.rds.amazonaws.com
Server: 127.0.1.1
Address: 127.0.1.1#53
Non-authoritative answer:
Name: REDACTED.REDACTED.us-east-1.rds.amazonaws.com
Address: 10.1.56.119
I've (hopefully) successfully set up Cpanel on AWS with clustering following the instructions: https://blog.cpanel.com/part-1-how-i-built-a-cpanel-hosting-environment-on-amazon-aws/
I've been using CPanel/WHM on a dedicated server for a few years before I set up this new Cpanel installation on AWS. My issues comes from how new accounts are set up differently on a dedicated server vs the AWS way.
My first issue:
When I created a new account on my dedicated WHM, I was provided IP Addresses from the server farm that I assigned to newly created accounts. Once assigned, I can access the site with either the IP or the domain name. Now with this new AWS way, there's no info in the tutorials about how I obtain new IP Addresses. I tried adding a new local IP like 10.0.0.30 (because it says it's in NAT mode and use local IP) and assigning this as a dedicated IP to the newly created accounts but I don't understand how anybody can access the site through that IP since its a local IP. So how do I access the domain through custom IP and domain like I did before? I must be missing something fundamental.
My second issue:
On my dedicated WHM after I created a new account, I would typically go to DNS Functions -> Edit DNS Zone and edit the zone to customize my nameserver as so:
mynewdomain.com
ns1.mynewdomain.com
ns2.mynewdomain.com
anothersite.com
ns1.anothersite.com
ns2.anothersite.com
thirdsite.com
ns1.thirdsite.com
ns2.thirdsite.com
and then in my register I would add these custom nameservers into the register and point them to the dedicated IPs of each domain. But with the AWS way, the only way I was able to set this up was to use the new cluster nameservers as the nameserver for ALL accounts in this new WHM installation.
Like this:
mynewdomain.com
ns1.awsnameserver.com
ns2.awsnameserver.com
anothersite.com
ns1.awsnameserver.com
ns2.awsnameserver.com
thirdsite.com
ns1.awsnameserver.com
ns2.awsnameserver.com
Is this the correct / the only way I can set up accounts now through this set up?
Is there a way to have custom nameservers names like I did in dedicated WHM?
In my case, I have a DNS server outside of Amazon so I'm not sure it would answer your question but it might lead you somewhere.
First to figure out what your public IP is you can:
Go to the AWS console and look at the instance detail of your server.
Look for the "endpoint". This points to your public address so you can do a PING or NSLOOKUP to find out what your IP is.
However, AWS does not recommend you hard-coding the public address as it could change. So what I did instead was to create a CNAME in my DNS that points to that "endpoint".
I hope that helps.
I have an Amazon EC2 instance. Lets say my public DNS is
ec2-54-200-54-33.us-west-2.compute.amazonaws.com
I am using this instance to help develop a new website, and I want to map the host
dev01.company.com
to this instance. How do I do that? I think there are at most 2 steps, including mapping the host with the registrar, and possibly something in Amazon. What are the steps I would need to do to accomplish this? How do I take all the details of my instance and map the hosts as metioned above?
1) Assign an Elastic IP to your EC2 instance (you can do that through the AWS Management Console).
2) Add an "A" record for "dev01" pointing to that IP, using the tool provided by your domain registrar.
Amazon recommends using a CNAME record instead
dev01.company.com CNAME ec2-54-200-54-33.us-west-2.compute.amazonaws.com
You will also need to open up whatever ports you need accessible to the security group of the EC2 instance (ie TCP 80 open to 0.0.0.0/0 > this will open to everyone)