CS338 Computer Security
Friday, 15 November 2024

+ Exam, etc.

+ I'm thinking about takeaways from this course
- Thinking about processes/protocols
    - Diagramming
        - Easy: Diffie Hellman key exchange
        - session cookies
        - HTTP Basic Auth
        - the new iOS 18.1 feature
        - 
    - Where are the attack opportunities?
    - When there's a security intervention, what
      attack(s) is it designed to mitigate and how
      does it do so?
        - Duo pre and post the 3-digit thing
        - DMARC/SPF/DKIM
- ...

+ Getting a certificate
- Let's Encrypt
    https://letsencrypt.org/how-it-works/
    https://datatracker.ietf.org/doc/html/rfc8555

- let's do intrigue.jeffondich.com on the same
    server as danger.jeffondich.com

- some setup details
    - server hosted by https://www.linode.com/
        (Linode purchased by Akamai in 2022)
    - Ubuntu 22.04.5 LTS (a Linux distribution)
    - DNS for jeffondich.com has subdomains danger & intrigue
        pointing at IP address
    - nginx web server
        - capable of handling multiple domains at the same IP address
        - think about the Host: header, but also...
        - ...https://en.wikipedia.org/wiki/Server_Name_Indication

- OK, let's go
    1. set up nginx http at intrigue.jeffondich.com
        /etc/nginx/sites-available/intrigue.jeffondich.com
        /etc/nginx/sites-enabled/intrigue.jeffondich.com
        /var/www/intrigue.jeffondich.com
    2. run Let's Encrypt's certbot
    3. fix the nginx to do https for intrigue.jeffondich.com
    4. test
    5. **** what the heck did certbot do??
        - certbot is running as root on the server to which 
            intrigue.jeffondich.com points
        - creates a new RSA key pair
        - assembles a "certificate request" (includes the domain name
            and the public key) (like our old bob.com & P_B)
        - sends letsencrypt.com (certificate authority) the request
        - letsencrypt server
            - checks does http://intrigue.jeffondich.com/ exist?
            - if so, server sends certbot a challenge
            - certbot puts the challenge in /var/www/intrigue.jeffondich.com/.well-known/
            - certbot says okey-dokey, that's done
            - server asks for http://intrigue.jeffondich.com/.well-known/challenge-file-name
            - if the challenge succeeds
                server says "my friend certbot actually controls intrigue.jeffondich.com"
            - here's your signed cert!
        - certbot puts files in the right places



======

sudo apt-get install python3-certbot-nginx

sudo certbot --nginx -d intrigue.jeffondich.com

sudo certbot certonly --webroot --webroot-path=/var/www/intrigue.jeffondich.com  -d intrigue.jeffondich.com

sudo ls -l /etc/letsencrypt/live/example.com

Create /etc/nginx/snippets/ssl-example.com.conf, root:root rw-r--r--, containing:

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

/var/log/letsencrypt/letsencrypt.log