tsungtwu

Virtual Hosts on nginx (CSC309)

When hosting our web applications, we often have one public IP address (i.e., an IP address visible to the outside world) using which we want to host multiple web apps. For example, one may wants to host three different web apps respectively for example1.com, example2.com, and example1.com/images on the same machine using a single IP address.

How can we do that? Well, the good news is Internet browsers

tsungtwu

Provider	Singleton	Instantiable	Configurable
Constant	Yes	No	No
Value	Yes	No	No
Service	Yes	No	No
Factory	Yes	Yes	No
Decorator	Yes	No?	No
Provider	Yes	Yes	Yes

Constant

tsungtwu

---
- hosts: all
  tasks:
  - name:    Install prerequisites
    apt:     name={{item}} update_cache=yes
    with_items:
     - apt-transport-https
     - ca-certificates
     - curl
     - software-properties-common

tsungtwu

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

• Revision 1.1, February 2016, applies to all YARA version 3.3+

Global Rules

Global rules are evaluated first. Only if they are satisfied non-global rules are evaluated. This may be useful if all samples exhibit the same characteristics. Use them combined with the "private" statement to suppress a match notification on the global rules.

tsungtwu

# docker build -t ubuntu1604py36
FROM ubuntu:16.04

RUN apt-get update
RUN apt-get install -y software-properties-common vim
RUN add-apt-repository ppa:jonathonf/python-3.6
RUN apt-get update

RUN apt-get install -y build-essential python3.6 python3.6-dev python3-pip python3.6-venv
RUN apt-get install -y git

tsungtwu

# coding:utf-8

from elasticsearch import Elasticsearch
import json

# Define config
host = "127.0.0.1"
port = 9200
timeout = 1000
index = "index"

tsungtwu

• What do Etcd, Consul, and Zookeeper do?
  • Service Registration:
    • Host, port number, and sometimes authentication credentials, protocols, versions numbers, and/or environment details.
  • Service Discovery:
    • Ability for client application to query the central registry to learn of service location.
  • Consistent and durable general-purpose K/V store across distributed system.
    • Some solutions support this better than others.
    • Based on Paxos or some derivative (i.e. Raft) algorithm to quickly converge to a consistent state.
• Centralized locking can be based on this K/V store.

tsungtwu

sudo useradd --no-create-home --shell /bin/false node_exporter

curl -fsSL https://github.com/prometheus/node_exporter/releases/download/v0.17.0/node_exporter-0.17.0.linux-amd64.tar.gz \
  | sudo tar -zxvf - -C /usr/local/bin --strip-components=1 node_exporter-0.17.0.linux-amd64/node_exporter \
  && sudo chown node_exporter:node_exporter /usr/local/bin/node_exporter

tsungtwu

Configure Nginx Reverse Proxy as failover

In this exemple of configuration, if the first server fail (proxy_connect_timeout) one time (max_fails), the second server will be used for 60s (fail_timeout).

The SSL certificate need to be configure on the ReverseProxy server AND the proxyied servers. You can use the same certificate and configurations on all servers.

To test the configuration you can change your host file to simulate the correct domain name.

Use the following tool to configure SSL with optimal configuration.

tsungtwu

/**

Example of how to configure Nginx for signed urls. Make sure to replace YOUR_URL_SECRET_KEY_HERE with your url signing key

location /secrets/ {
    # Headers for debugging
    add_header X-Secure-Uri "$uri";
    add_header X-Secure-Ip "$remote_addr";
    add_header X-Secure-Expires "$arg_expires";