nealalan.github.io/EC2_Ubuntu_LEMP

Project goals

Terminology

Lets get started…

What I won’t go over:

AWS account

Identity and Access Management (IAM) & Account Security

Pick Your Domain Name

Create a Hosted Zone in Route 53

XXXXX Strike this section because an Elastic IP works better - IAM Access for DNS Record Updates

Virtual Private Cloud (VPC)

VPC CIDR Address

VPC: Public Subnetwork (Subnet)

VPC: Security: Network Access Control Lists (ACLs)

EC2: Network & Security: Key Pairs

LAUNCH INSTANCE!

CONNECT TO YOUR INSTANCE

$ ssh -i ~/.ssh/neals_web_server.pem ubuntu@<ip-address>

# The first thing you want to do is ensure you're upgraded
# The second is install NGINX webserver
ubuntu@ip-10-10-10-13:~$ sudo apt -y update; sudo apt -y upgrade; sudo apt install -y nginx

# OVERWRITE WHAT'S HERE WITH YOUR DOMAIN NAME
# for this change to show, it'll take a reboot
$ sudo nano /etc/hostname

Install Certbot

$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt -y update; sudo apt -y upgrade
$ sudo apt -y install python-certbot-nginx

Configure NGINX webserver

# MAKE THE HTML FOLDER FOR THE SERVERS
$ sudo mkdir -p /var/www/nealalan.com/html
$ sudo mkdir -p /var/www/neonaluminum.com/html
# CREATE LINKS IN THE HOME FOLDER TO THE WEBSITES
$ ln -s /var/www/nealalan.com /home/ubuntu/nealalan.com
$ ln -s /var/www/neonaluminum.com /home/ubuntu/neonaluminum.com
# CHANGE OWNERSHIP OF THE WEBSITE HTML FOLDERS
$ sudo chown -R $USER:$USER /var/www/nealalan.com/html
$ sudo chown -R $USER:$USER /var/www/neonaluminum.com/html
# CREATE GENERIC HTML PAGES
$ echo "nealalan.com" > ~/nealalan.com/html/index.html
$ echo "neonaluminum.com" > ~/neonaluminum.com/html/index.html
# CREATE LINE TO SITES-AVAILABLE NGINX CONFIG FILES
$ ln -s /etc/nginx/sites-available /home/ubuntu/sites-available
$ ln -s /etc/nginx/sites-enabled /home/ubuntu/sites-enabled
# CREATE NGINX CONFIG FILES
$ cd sites-available
$ sudo nano nealalan.com

server {
	listen 80;
	listen [::]:80;
	server_name nealalan.com www.nealalan.com;
	# configure a new HTTP (80) server block to redirect all http requests to your webserver to https
	return 301 https://nealalan.com$request_uri;
}
server {
	listen 443 ssl; # managed by Certbot
	server_name nealalan.com www.nealalan.com;
	# Where are the root key and root certificate located?

	#
	# Secure cipher suites and TLS protocols only within the 443 SSL server block?
	# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	# ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
	#
	#  HTTP Strict Transport Security (HSTS) within the 443 SSL server block.
	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
	#
	# Server_tokens off
	server_tokens off;
	#
	# Disable content-type sniffing on some browsers
	add_header X-Content-Type-Options nosniff;
	#
	# Set the X-Frame-Options header to same origin
	add_header X-Frame-Options SAMEORIGIN;
	#
	# enable cross-site scripting filter built in, See: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
	add_header X-XSS-Protection "1; mode=block";
	#
	# disable sites with potentially harmful code, See: https://content-security-policy.com/
	add_header Content-Security-Policy "default-src 'self'; script-src 'self' ajax.googleapis.com; object-src 'self';";
	#
	# referrer policy
	add_header Referrer-Policy "no-referrer-when-downgrade";
	#
	# certificate transparency, See: https://thecustomizewindows.com/2017/04/new-security-header-expect-ct-header-nginx-directive/
	add_header Expect-CT max-age=3600;
	# HTML folder
	root /var/www/nealalan.com/html;
	index index.html;
}

# CREATE LINKS FROM SITES-AVAILABLE TO SITES-ENABLED
$ sudo ln -s /etc/nginx/sites-available/nealalan.com /etc/nginx/sites-enabled/
$ sudo ln -s /etc/nginx/sites-available/neonaluminum.com /etc/nginx/sites-enabled/
# VERIFY NGINX CONFIGURATION
$ look for feedback to match the screenshot
$ sudo nginx -t
$ sudo systemctl restart nginx

Update you DNS A Record

$ curl ifconfig.co

Run CertBot!

$ sudo certbot --authenticator standalone --installer nginx -d nealalan.com -d www.nealalan.com --pre-hook 'sudo service nginx stop' --post-hook 'sudo service nginx start'

$ sudo certbot renew --dry-run

$ sudo reboot now

Install Git & Pull Down A Website

# DOWNLOAD & INSTALL GO
$ cd
$ sudo curl -O https://storage.googleapis.com/golang/go1.9.1.linux-amd64.tar.gz
$ sudo tar -xvf go1.9.1.linux-amd64.tar.gz
$ sudo mv go /usr/local
$ rm go1.9.1.linux-amd64.tar.gz
$ sudo nano ~/.profile
# ADD THE FOLLOWING LINE TO THE END OF .profile
#	export PATH=$PATH:/usr/local/go/bin
# REFRESH THE PROFILE
$ source ~/.profile
$ go 

# DOWNLOAD & INSTALL HUB
$ git clone https://github.com/github/hub.git && cd hub
$ script/build -o ~/bin/hub

$ source ~/.profile

Security: Where we are now?

FTP access and users

To be continued…

Auto Update Route 53

NOTE: This is no longer needed, since Amazon is nice enough to include a free static IP address. You can set this up from the AWS Console: EC2 Dashboard: Elastic IPs.

edit