Internet Protocols¶

# View certificate information
openssl x509 -text -noout -in certificate.crt

# Generate CSR
openssl req -new -key private.key -out server.csr

# Generate self-signed certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout private.key -out certificate.crt

2001:0db8:85a3:0000:0000:8a2e:0370:7334
│    │    │    │    │    │    │    │
│    │    │    └────┴────┴────┴────┴── Interface ID (64 bits)
└────┴────┴────┴────────────────────── Network Prefix (64 bits)

# Network: 192.168.1.0/24 (256 addresses)
# Subnet into 4 smaller networks (62 hosts each)

Subnet 1: 192.168.1.0/26   (192.168.1.1   - 192.168.1.62)
Subnet 2: 192.168.1.64/26  (192.168.1.65  - 192.168.1.126)  
Subnet 3: 192.168.1.128/26 (192.168.1.129 - 192.168.1.190)
Subnet 4: 192.168.1.192/26 (192.168.1.193 - 192.168.1.254)

# DevOps network segmentation example
DMZ Subnet:    10.0.1.0/24   # Web servers, load balancers
App Subnet:    10.0.2.0/24   # Application servers  
DB Subnet:     10.0.3.0/24   # Database servers
Mgmt Subnet:   10.0.10.0/24  # Management, monitoring

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Acknowledgment Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags |           Window Size           |        Checksum     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

# 1xx Informational
100 Continue          # Request can proceed
101 Switching Protocols # Protocol upgrade (WebSocket)

# 2xx Success  
200 OK               # Request successful
201 Created          # Resource created successfully
202 Accepted         # Request accepted for processing
204 No Content       # Success, but no response body

# 3xx Redirection
301 Moved Permanently # Resource permanently relocated
302 Found            # Temporary redirect
304 Not Modified     # Resource unchanged (caching)

# 4xx Client Errors
400 Bad Request      # Invalid request syntax
401 Unauthorized     # Authentication required
403 Forbidden        # Access denied
404 Not Found        # Resource doesn't exist
429 Too Many Requests # Rate limiting

# 5xx Server Errors  
500 Internal Server Error  # Generic server error
502 Bad Gateway           # Upstream server error
503 Service Unavailable   # Server temporarily unavailable
504 Gateway Timeout       # Upstream server timeout

# Security Headers
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff

# Performance Headers  
Cache-Control: public, max-age=3600
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"
Expires: Wed, 21 Oct 2024 07:28:00 GMT

# Load Balancing Headers
X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178
X-Real-IP: 203.0.113.195
X-Forwarded-Proto: https

# Monitoring Headers
X-Request-ID: 550e8400-e29b-41d4-a716-446655440000
X-Response-Time: 123ms

# Nginx SSL configuration
server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificate files
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;

    # Security settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
}

# Generate SSH key pair
ssh-keygen -t ed25519 -C "devops@example.com"
ssh-keygen -t rsa -b 4096 -C "devops@example.com"  # Legacy systems

# Copy public key to server
ssh-copy-id user@server.example.com

# Manual installation
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Client configuration (~/.ssh/config)
Host production-server
    HostName prod.example.com
    User deploy
    IdentityFile ~/.ssh/production_key
    Port 2222

Host *.example.com
    User admin
    IdentityFile ~/.ssh/company_key
    ProxyJump bastion.example.com

# Server configuration (/etc/ssh/sshd_config)
# Disable password authentication
PasswordAuthentication no
PubkeyAuthentication yes

# Disable root login
PermitRootLogin no

# Change default port
Port 2222

# Limit users
AllowUsers deploy admin

# Disable X11 forwarding  
X11Forwarding no

# Set idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2

# Local port forwarding (access remote service locally)
ssh -L 8080:localhost:80 user@server.com

# Remote port forwarding (expose local service remotely)  
ssh -R 9000:localhost:3000 user@server.com

# Dynamic port forwarding (SOCKS proxy)
ssh -D 1080 user@server.com

# SSH tunnel for database access
ssh -L 5432:db-server:5432 bastion.example.com

    # GitHub Actions example
    - name: Deploy to server
        uses: appleboy/ssh-action@v0.1.5
        with:
            host: ${{ secrets.HOST }}
            username: ${{ secrets.USERNAME }}
            key: ${{ secrets.SSH_KEY }}
            script: |
                cd /var/www/app
                git pull origin main
                docker-compose up -d --build

# SFTP - Interactive file transfer
sftp user@server.com
sftp> put local-file.txt remote-file.txt
sftp> get remote-file.txt local-file.txt
sftp> ls -la
sftp> exit

# SCP - Simple file copy
scp file.txt user@server.com:/path/to/destination/
scp -r directory/ user@server.com:/path/to/destination/

# rsync - Synchronization  
rsync -avz --delete source/ user@server.com:/destination/
rsync -avz --progress large-file.zip user@server.com:/backup/

# Secure alternatives to FTP
FTPS (FTP over SSL/TLS)     # Encrypted FTP
SFTP (SSH File Transfer)    # SSH-based transfer  
WebDAV over HTTPS          # HTTP-based file access
API-based transfers        # REST APIs for file management

# Never use in production:
FTP (unencrypted)          # Credentials sent in plain text
Telnet                     # Unencrypted remote access

# Test connectivity and protocols
ping google.com                    # Basic connectivity (ICMP)
telnet google.com 80               # Test TCP port connectivity
nc -zv google.com 80               # Port scanning with netcat
nmap -sT -p 80,443 google.com      # Port scanning with nmap

# HTTP/HTTPS testing
curl -I https://example.com         # Headers only
curl -v https://example.com         # Verbose output
curl -k https://example.com         # Ignore SSL errors
curl --connect-timeout 10 https://example.com

# SSL/TLS testing
openssl s_client -connect example.com:443 -servername example.com
openssl s_client -connect example.com:443 -verify_return_error

# DNS testing
nslookup example.com               # Basic DNS lookup
dig @8.8.8.8 example.com          # Test specific DNS server
host -t MX example.com             # Specific record type

#!/bin/bash
# Protocol health monitoring script

# HTTP health check
http_check() {
    local url=$1
    local expected_code=${2:-200}

    response=$(curl -s -o /dev/null -w "%{http_code}" "$url")
    if [ "$response" -eq "$expected_code" ]; then
        echo "✓ HTTP $url: $response"
        return 0
    else
        echo "✗ HTTP $url: $response (expected $expected_code)"
        return 1
    fi
}

# SSH connectivity check
ssh_check() {
    local host=$1
    local port=${2:-22}

    if nc -z "$host" "$port" 2>/dev/null; then
        echo "✓ SSH $host:$port: reachable"
        return 0
    else
        echo "✗ SSH $host:$port: unreachable"
        return 1
    fi
}

# SSL certificate expiry check
ssl_expiry_check() {
    local host=$1
    local port=${2:-443}

    expiry=$(echo | openssl s_client -servername "$host" -connect "$host:$port" 2>/dev/null | \
             openssl x509 -noout -enddate | cut -d= -f2)

    expiry_epoch=$(date -d "$expiry" +%s)
    current_epoch=$(date +%s)
    days_left=$(( (expiry_epoch - current_epoch) / 86400 ))

    if [ "$days_left" -gt 30 ]; then
        echo "✓ SSL $host: expires in $days_left days"
        return 0
    else
        echo "⚠ SSL $host: expires in $days_left days"
        return 1
    fi
}

# Run checks
http_check "https://example.com/health"
ssh_check "server.example.com"
ssl_expiry_check "example.com"

# Secure SSH configuration checklist
sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#Protocol 2/Protocol 2/' /etc/ssh/sshd_config

# Restart SSH service
systemctl restart sshd

# Firewall configuration (ufw example)
ufw allow 2222/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw enable