tatum.im

{"posts":[{"layout":"post","title":"Run commands over SSH!","date":"2017-01-08 08:19:15 -0600","comments":true,"categories":"admin ssh devops","slug":"run-commands-over-ssh","postPath":"/blog/2017/01/08/run-commands-over-ssh","formattedDate":"January 08, 2017","formattedDateShort":"01/08/2017","html":"\n\n

There are times where I need to run a few command on a server. In the past, I would SSH into\nthe server and I would start making changes. But this is not ideal; since this it’s not repeatable.\nIf you’ve run into this problem, I have an alternative! You can run commands over SSH! The script\nis executed on your machine but then the commands are run on the remote machine.

Please be aware that there are better tools – Ansible, Terraform, CloudFormation, etc. But\nthose are heavy tools.

In this example, I have some configuration files that need to be copied to the remote system, and\nthen I need to execute a couple commands. I also wanted the script to be checked into version\ncontrol.

The first half of the script copies files, using scp, from my local machine to\nthe remote machine. The second half of the script (starting on line 12) runs commands from the\nremote machine. The files are moved to the correct locations and Nginx and Haproxy are restarted.

#!/bin/bash\n\nPEM=id_rsa.pub\nHOST=ec2-54-234-130-49.compute-1.amazonaws.com\n\nscp -i ~/.ssh/$PEM ./surrogate_pop.conf ubuntu@$HOST:/tmp\nscp -i ~/.ssh/$PEM ./haproxy.cfg ubuntu@$HOST:/tmp\nscp -i ~/.ssh/$PEM ./traffic_cop.lua ubuntu@$HOST:/tmp\nscp -i ~/.ssh/$PEM ./allowed_domains.lua ubuntu@$HOST:/tmp\n\n## These are executed on the remote host\nssh -i ~/.ssh/$PEM ubuntu@$HOST 'bash -s' <<EOF\nsudo mv /tmp/traffic_cop.lua /usr/share/nginx/traffic_cop.lua\nsudo mv /tmp/allowed_domains.lua /usr/share/nginx/allowed_domains.lua\nsudo mv /tmp/surrogate_pop.conf /etc/nginx/sites-enabled/surrogate_pop.conf\nsudo service nginx restart\n\nsudo mv /tmp/haproxy.cfg /etc/haproxy/haproxy.cfg\nsudo service haproxy restart\nEOF

","css":{"code":"","map":null},"head":"tatum.im"},{"layout":"post","title":"Cloudformation ApiGateway and Lambda","date":"2016-08-25 07:44:12 -0500","comments":true,"categories":"AWS cloudformation apigateway lambda","slug":"cloudformation-apigateway-and-lambda","postPath":"/blog/2016/08/25/cloudformation-apigateway-and-lambda","formattedDate":"August 25, 2016","formattedDateShort":"08/25/2016","html":"\n\n

Recently, I’ve been excited by serverless\ntechnology. I began using the serverless framework\nfor code boilerplate and deployment. After some time using the framework, I began feeling pain.\nServerless is an excellent project, but it’s moving very fast. For example, The\nframework uses cloudformation for resource dependencies such as dynamoDb, ApiGateway, roles and permissions (to name a few).\nCloudformation is also moving very fast. Support for ApiGateway was added to cloudformation on April\n18th, 2016.\nAs new features are added to cloudformation, you’ll be stuck waiting for\nserverless to implement features for feature parity. I’ve started using\ncloudformation direclty and relying on bash scripts for deployment. I’m quite\nhappy with the results.

Cloudformation stack

Once we have a\ncloudformation template,\nthe AWS cli provides us with everthing we need. Using the AWS CLI we can create the stack like so.

$ aws cloudformation create-stack \n\t--stack-name hello-world \n\t--template-body file://./cloudformation.json \n\t--capabilities CAPABILITY_IAM && \n\taws cloudformation wait stack-create-complete \n\t\t--stack-name hello-world

The first command fires off an async create request to AWS.\nThe second command tells our shell to wait for stack creation to complete.

After that’s complete, we’ll have created a few resources in AWS. =) Next, we’ll need a way to deploy.

Deployment

We have a few tasks for a complete deployment. We should seperate out the\nlambda depoyment and the ApiGateway deployment, but in this case I did not.

Update Lambda Code - Install any dependencies, zip our code, and upload it.
Publish a Version - From the latest version, It will tag a copy.
Update the alias - Our lambda is pointed to an alias. This will point the lambda to our new version.
deploy ApiGateway - Any changes we make to ApiGateway requires a deploy.

The script takes two args. The api-gateway-id and the function-name.

$ ./deploy.sh abc123 hello-word

#!/bin/bash\n\napiId=$1\nfunctionName=$2\nprofile=personal\n\n\nYELLOW='\\033[0;33m'\nWHITE='\\033[0m' # No Color\n\nfunction zipLambda {\n  say \"Zipping files.\" && \n  rm -rf target && \n  mkdir -p target && \n  cp -r *.js package.json target/ && \n  pushd target && \n  npm install --production && \n  zip -r \"${functionName}.zip\" . && \n  popd\n}\n\nfunction say {\n  printf \"\n${YELLOW} $@ ${WHITE}\n\"\n}\n\nfunction updateLambdaCode {\n  say \"Uploading new lambda code.\" && \n  aws lambda update-function-code --function-name $functionName --zip-file \"fileb://target/${functionName}.zip\" --profile $profile\n}\n\nfunction publishVersion {\n  say \"Publishing a new version.\" && \n  aws lambda publish-version --function-name $functionName --profile $profile\n}\n\nfunction updateAlias {\n  version=$(aws lambda list-versions-by-function --function-name $functionName --profile personal | grep Version | tail -n 1 | cut -d '\"' -f 4) && \n  say \"Updating the alias to version ${version}.\" && \n  aws lambda update-alias --function-name $functionName --function-version $version --name prod --profile $profile\n}\nfunction deployApiGatway {\n  say \"Deploying to Api Gateway.\" && \n  aws apigateway create-deployment --rest-api-id $apiId --stage-name v1 --profile $profile\n}\nprintf \"\n🚀🚀🚀 SHIP IT!!! 🚀🚀🚀 \n\n\"\nzipLambda && \n  updateLambdaCode && \n  publishVersion && \n  updateAlias && \n  deployApiGatway

","css":{"code":"","map":null},"head":"tatum.im"},{"layout":"post","title":"ActiveModel::Model","date":"2015-08-13 19:37:30 -0500","comments":true,"categories":"rails","slug":"activemodel-model","postPath":"/blog/2015/08/14/activemodel-model","formattedDate":"August 14, 2015","formattedDateShort":"08/14/2015","html":"\n\n

Rails 4 brought us ActiveModel::Model. It provides a light weight interface that’s similar to an ActiveRecord::Base model.

for example, I can create a Person class like so.

class Person\n  include ActiveModel::Model\n  attr_accessor :name, :age\n\n  validates :name, true\n\n  def save\n    ## Do cool stuff here...\n  end\nend

Loading development environment (Rails 4.2.1)\nirb(main):001:0> p = Person.new age: 21\n=> #<Person:0x007fc6367193b0 @age=21>\nirb(main):002:0> p.valid?\n=> false\nirb(main):003:0> p.errors\n=> #<ActiveModel::Errors:0x007fc638000a68 @base=#<Person:0x007fc6367193b0 @age=21, @validation_context=nil, @errors=#<ActiveModel::Errors:0x007fc638000a68 ...>>, @messages={:name=>[\"can't be blank\"]}>\nirb(main):004:0>

This is great for instances where you don’t need a full database backed Active Record model. I’ve used them for form objects and in controllers where I have complex logic.

You can think of these as higher level abstractions above your ActiveRecord classes. Also, be conscious of the dependancy direction. An ActiveModel model can depend on an ActiveRecord model but your ActiveRecord models shouldn’t depend on an ActiveModel model.

\n
\n

Here’s a more involved example.\nLets say I have 2 ActiveRecord classes Org and User

class Org < ActiveRecord::Base\n  validates :name, presence: true\nend

class User < ActiveRecord::Base\n  validates :first, :last, presence: true\nend

Now I’ll create an ActiveModel model (non database)

Notice the validates_each method… Its going to check each of the ActiveRecord objects and let them raise up any errors to the Signup class.

class Signup\n  include ActiveModel::Model\n  attr_accessor :first, :last, :name\n\n  validates_each :user, :org do |record, attr, value|\n    unless value.valid?\n      value.errors.each { |k,v| record.errors.add(k.to_sym, v) }\n    end\n  end\n\n  ## must return boolean\n  def save\n    if valid?\n      org.save && user.save\n    else\n      false\n    end\n  end\n\n  private\n\n    def org\n      @org ||= Org.new(name: name)\n    end\n\n    def user\n      @user ||= User.new(first: first, last: last)\n    end\nend

Awesome right!!

So why do all this? Well, the single responsibilty states that every class should have responsibility over a single part of the functionality provided by the software, and that responsibility should be entirely encapsulated by the class. ActiveRecord is responsible for persistence to the database. This will keep our classes with a narrow focus and allow us to refactor and create more use cases in the future. I think it’s a win. I find this strategy is generally good for one directional workflows such as signup or in a shopping app cart checkout.

","css":{"code":"","map":null},"head":"tatum.im"},{"layout":"post","title":"rails configuration","date":"2015-03-14 10:25:26 -0500","comments":true,"categories":["rails"],"slug":"rails-configuration","postPath":"/blog/2015/03/14/rails-configuration","formattedDate":"March 14, 2015","formattedDateShort":"03/14/2015","html":"\n\n

Occasionally I’ll see things like this in a code base.

def api_host\n  if Rails.production?\n    \"http://prod.fake.api.url\"\n  else\n    \"http://stag.fake.api.url\"\n  end\nend

I try to avoid writting methods like this. Rails provides a nice way to set environment specific variables.

http://guides.rubyonrails.org/configuring.html#custom-configuration

config/environments/staging.rb

config.api_host = \"http://stag.fake.api.url\"

config/environments/production.rb

config.api_host = \"http://prod.fake.api.url\"

So now you can refactor the method to this.

def api_host\n  Rails.configuration.api_host\nend

","css":{"code":"","map":null},"head":"tatum.im"},{"layout":"post","title":"Crypto","date":"2015-02-28 16:05:01 -0600","comments":true,"categories":"encryption","slug":"crypto","postPath":"/blog/2015/02/28/crypto","formattedDate":"February 28, 2015","formattedDateShort":"02/28/2015","html":"\n\n

I’ve been playing around with Public-key cryptography or asymmetric cryptography. With revaltions from Eric Snowden on programs like PRISM, I feel that encryption is more important than ever.

From Wikipedia

Public-key cryptography is a class of cryptographic algorithms which requires two separate keys, one of which is secret (or private) and one of which is public. Although different, the two parts of this key pair are mathematically linked. The public key is used to encrypt plaintext or to verify a digital signature; whereas the private key is used to decrypt ciphertext or to create a digital signature.\n

There are two main uses for public key crypto.

Public key encryption. A message is encrypted with a recipient’s public key. The message can only be unencrypted by the holder of the private key.
Digital Signature. A message is signed with a the senders private key to generate a cryptographic hash. Using the public key, one can verify the message was indeed sent with the coresponding private key and can ensure the message has not been altered.

Keys

First, let’s generate some keys. From the private key we will also generate the public key. Remember the private and public key are mathematically linked. This is important.

[1] pry(main)> require \"openssl\"\n=> true\n[2] pry(main)> private_key = OpenSSL::PKey::RSA.new(2048)\n=> #<OpenSSL::PKey::RSA:0x007ff03b379c30>\n[3] pry(main)> public_key = private_key.public_key\n=> #<OpenSSL::PKey::RSA:0x007ff03c3330b8>

Great. Now we have a key pair. We can write these keys to disk if we like.

## write the private key to disk.\nFile.open(\"~/.ssh/private_key\", \"w+\") do |f|\n  f.write private_key.to_pem\nend\n# write the public key to disk.\nFile.open(\"~/.ssh/public_key.pem\", \"w+\") do |f|\n  f.write public_key.to_pem\nend

We can read the key in from key like so.

key = OpenSSL::PKey::RSA.new(File.read(\"~/.ssh/private_key\"))

Public key enctryption

We’ll be encrypting a message with the public key. So it can only be unenctrypted by the owner of the private key.

## Use the public key to encrypt a message\n[4] pry(main)> encrypted_data = public_key.public_encrypt(\"Some private data is here.\")\n=> \"\fÒ\"\u0002l\u000eû\u0018ú¢Ì;Ârú\\ÛZY4ã\u0013iÛµ´<ì¸«\"aáà\u0001bì®À!\u0018È©ÞBe^Ìe\u0011Ü\u0019Ü\u001eX\u0011Ö\"bUJ°Bí\u0003}÷Iý\u0004\u0004ôQ§H\bÅaá¤\u0002kxô6A% ëë: Ñ¢ÿ¤$½PRéÓ\r>5Ù\u0010èYde`à½å\\\u0002ö\u000b\u0015Ôm\u0003ÍJ*¦õS9ÒM\u0010Õ 7Îð¹<¯e®`W;HZëØÿÞ\u0002\u0010mò*\tL2â`KÈ\u000e)OÚ¯k4Ð\rNó%}êM\u0015heß\u000fÆåª$\u0019\u0003V¾\u000e~LvÇ´o¡3âÞât!]-È¯ãÕý`TÙÍsÿ®(<½¹\"

This will result in some unreadable binary data. Next we’ll decrypt this data with the private key.

## Use the private key to decrypt\n[5] pry(main)> private_key.private_decrypt(enc)\n=> \"Some private data is here.\"

Nice!

The public key can encrypt but cannot decrypt the message. This enctryption only works in one direction. Only the private key can decrypt that message. You can also encrypt messages with a private key. Those messages can be unenctrypted with the public key and the private key.

Asymmetric public/private key encryption is slow and victim to attack in cases where it is used without padding or directly to encrypt larger chunks of data. Typical use cases for RSA encryption involve “wrapping” a symmetric key with the public key of the recipient who would “unwrap” that symmetric key again using their private key.

NOTE - The enctrypted messages are in binary format. If we want to encode the data for transmission accoss the net, we’ll want to use something like base64.

[6] pry(main)> require \"base64\"\n=> true\n[7] pry(main)> enc_string = Base64.encode64(encrypted)\n=> \"iRBt6WHFYP2sn2Qv+qs16js/EJqBGaTWyxUH7iI/aj3UEw1oUHHbrFs/705W\nP+8dJ77p5gAaBpS/spCYLu/strU3uN06DTOh3neTcyDQrpIL5Zqs0Gl6/76m\nOQFGi18khnwWPAyW4+uVcZiQmZU9M0tlWywwNlkVoKAwkFlwkYF07YZazfCY\nMrAoQ6nusfjqjfU7HQeQKSCnMrBkzInsqan0PUm+UuGCMbxpQMdPA1de2nHB\neMs7OR7Pd5q5T93z240Iacjtwo/CV3Tcr1EyrfCcx05Jp4FKi9DPJf33asPx\noJ7J2XNa3QXqEbisMGT/b+6QZDm/LbfZXKuCIDYOjA==\n\"

This works for small messages but if you try and encrpt a string larget than your key… you’ll hit an errors. You could break up the string into smaller chunks and encrypt each chunk individually. But this is not secure. This is what cypher block chaining is for. Below is an example.

cipher      = OpenSSL::Cipher.new 'AES-128-CBC'\ncipher.encrypt\niv          = cipher.random_iv\npwd         = 'tRiSsmiTp'\nsalt        = OpenSSL::Random.random_bytes 16\niter        = 20000\nkey_len     = cipher.key_len\ndigest      = OpenSSL::Digest::SHA256.new\n\nkey = OpenSSL::PKCS5.pbkdf2_hmac(pwd, salt, iter, key_len, digest)\ncipher.key = key\n\nFile.open(\"enc-text.txt\",'w') do |enc|\n  File.open(\"./plain.txt\") do |f|\n     loop do\n       r = f.read(4096)\n       break unless r\n       enc << cipher.update(r)\n     end\n     enc << cipher.final\n  end\nend

Digital Signature

Asymmetric digital signatures is a great way to verify integrity and authenticity of data. Create a keypair, send the public key to your receivers, and use this method to create a digital signature. By combining the data and the public key, you can verify that the signature was created by the owner of the private key.

require \"openssl\"\n\ndata = \"A small brown fox.\"\n\n\ndigest = OpenSSL::Digest::SHA256.new\n# To list available digests:\n#OpenSSL::Digest.constants\n\nsignature = private_key.sign(digest, data)\n\npublic_key.verify(digest, signature, data)\n# => true\npublic_key.verify(digest, signature, data + \"altered\")\n# => false\npublic_key.verify(digest, \"altered\" + signature, data)\n# => false

Using openssl library directly we can encrypt a file.

openssl aes-256-cbc -a -e -in source-file.txt -out enc-file.txt -k private_key

And to decrypt the file.

openssl aes-256-cbc -d -a -in enc-file.txt -out unenc-file.txt -k private_key

http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL.html#label-PBKDF2+Password-based+Encryption

","css":{"code":"","map":null},"head":"tatum.im"}],"page":1,"pagesCount":4}

Cloudformation stack

Deployment

Keys

Public key enctryption

Digital Signature

More

Recent posts