Final Part 1

MOCs

• Network Diagram
• Configure Networking
  • VPC
  • Subnets
    • Public Subnet
    • Private Subnet
  • Internet Gateway
  • Elastic IP
  • Routing
• Create Instances
• NAT Gateway
  • Update Private Route Table
• To associate the Elastic IPs
• SSHing
• MySQL Installation
  • MySQL Setup
  • Install Apache
  • Install Apache
  • Install PHP
  • WordPress Installation
  • WordPress Configuration

Network Diagram

Configure Networking

VPC

1. Open VPC console
2. From the VPC dashboard, click Create VPC
3. Select VPC only
4. In the Name tag field, name the VPC final-paul
5. Specify the 10.10.0.0/16 IPv4 CIDR block
6. Click Create VPC to complete

Subnets

Public Subnet:

1. In the left navigation bar, click Subnets
2. Click Create Subnet
3. Select the final-paul VPC
4. Name the subnet public-subnet-paul
5. Select AZ us-east-1a
6. Specify the IPv4 block as 10.10.10.0/24
7. Click Create Subnet to complete

Private Subnet:

1. Click Create Subnet
2. Select the final-paul VPC
3. Name the subnet private-subnet-paul
4. Select AZ us-east-1a
5. Specify the IPv4 block as 10.10.15.0/24
6. Click Create Subnet to complete

Internet Gateway

Create main internet gateway:

1. On the left navigation bar, click Internet gateways
2. Click Create internet gateway
3. Name it final-igw-paul
4. Click Create internet gateway to complete

Attach to VPC:

1. Go to Actions > Attach to VPC
2. Select the final VPC
3. Click Attach internet gateway

Elastic IP

Create Elastic IP (Do this step twice):

1. On the left navigation bar, click Elastic IPs
2. Click Allocate Elastic IP address
3. Confirm proper region is selected
4. Click Allocate

Routing

Create the public route table:

1. On the navigation bar, click Route tables
2. Click Create route table
3. Name it public-route-table-paul
4. Select the final VPC
5. Click Create route table to complete

Create the private route table:

1. Go back to Route tables
2. Click Create route table
3. Name it private-route-table
4. Select the final VPC
5. Click Create route table to complete

Associate the subnets:

1. Go back to Route tables
2. Select public-route-table-paul
3. Click Actions > Edit subnet associations
4. Click public-subnet
5. Click Save associations
6. Select private-route-table
7. Click Actions > Edit subnet associations
8. Click private-subnet
9. Click Save associations

Add a route to allow internet traffic into the VPC:

1. Click on public-route-table
2. Click Actions > Edit routes
3. Click Add route
4. For Destination, set to 0.0.0.0/0
5. For Target, set to Internet Gateway and select the final-igw-paul
6. Click Save changes

Create Instances

Create Web instance:

1. Search for EC2
2. Click Launch instances
3. Name it Web
4. Choose Ubtuntu and use the 22.04 LTS AMI
5. Create a new keypair, final-joekey
6. Edit network settings
7. Specify the final VPC
8. Ensure the public-subnet is selected
9. Create a new security group named public-sg-web
10. Update the description
11. Expand the Advanced network configuration section
12. For the Primary IP, specify 10.10.10.25
13. Click Launch instance

Create Jumpbox instance:

1. Click Launch instances
2. Name it Jumpbox
3. Choose Ubtuntu and use the 22.04 LTS AMI
4. Use the new keypair, final-joekey
5. Edit network settings
6. Specify the final VPC
7. Ensure the public-subnet is selected
8. Create a new security group named public-sg-jumpbox
9. Update description
10. Expand the Advanced network configuration section
11. For the Primary IP, specify 10.10.10.30
12. Click Launch instance

Create the MySQL instance:

1. Click Launch instances
2. Name it MySQL
3. Choose Ubtuntu and use the 22.04 LTS AMI
4. Use the new keypair, final-joekey
5. Edit network settings
6. Specify the final VPC
7. Ensure the private-subnet is selected
8. Create a private-sg security group
9. Update the description
10. Expand the Advanced network configuration section
11. For the Primary IP, specify 10.10.15.60
12. Click Launch instance

Configure Security Groups

You don’t have to touch public-sg-jumpbox
Configure public-sg-web:

1. Go to Security Groups in the left navigation bar
2. Click on the Security group ID of the public-sg-web
3. Click Edit inbound rules
4. Click Add rule
   • Type: HTTP
   • Source: Anywhere-IPv4
5. Edit the SSH rule from 0.0.0.0/0 to 10.10.10.30/32
6. Click Save rules

Configure private-sg:

1. Go back to Security Groups
2. Click on the Security group ID of the private-sg
3. Click Edit inbound rules
4. Remove the 0.0.0.0/0 and replace with 10.10.10.30/32
5. Click Add rule
   • Type: MYSQL/Aurora
   • Source: 10.10.10.25/32
6. Click Save rules

NAT Gateway

Create the NAT Gateway for public-subnet:

1. Search for VPC
2. In the left naviagtion bar, click NAT gateways
3. Click Create NAT gateway
4. Name it public-nat-gateway
5. Select the public-subnet
6. Click Allocate Elastic IP
7. Click Create NAT gateway

Update Private Route Table

Add the route to the NAT gateway:

1. In the left naviagtion bar, click Route Tables
2. Click private-route-table
3. Click Actions > Edit routes
4. Click Add route
   • Destination: 0.0.0.0/0
   • Target: NAT Gateway & select the gateway
5. Click Save changes

To associate the Elastic IPs:

Associate Elastic IPs:

1. In the navigation bar, click Elastic IPs
2. Right click on an unassociated Elastic IP and click Associate Elastic IP Address
3. Choose the Jumpbox instance and fill in the assigned private IP
4. Repeat the steps on the other unassociated Elastic IP and assign it to the Web instance

SSHing

SSH into a host with an Elastic IP by:

ssh -i /path/to/key.pem ubuntu@<Public-IP>

To access the MySQL/Web instances:

1. SCP private key to Jumpbox

scp -i ./paul-final.pem ubuntu@<Public-IP>:~

2. SSH into Jumpbox

ssh -i ./paul-final.pem ubuntu@<Public-IP>

3. Change permissions on the keyfile

chmod 400 paul-final.pem

4. SSH from Jumpbox to MySQL

ssh -i paul-final.pem ubuntu@<Public-IP>

MySQL Installation

1. SSH to MySQL instance
2. Install MySQL Server

sudo apt install mysql-server

3. Prepare to run mysql_secure_installation script

sudo mysql

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'root';

Info

This changes the password to root and avoids the issues with the secure installation script. Don’t worry, this is changed when the script is run.

exit

4. Run the secure installation script

sudo mysql_secure_installation

Info

Answer NO to the VALIDATE PASSWORD plugin. YES to the rest

1. Connect to the MySQL server

mysql -u root -p

MySQL Setup

1. Create a database for the WordPress installation:

CREATE DATABASE wordpress_db;

2. Create the WordPress user:

CREATE USER 'wp_user'@'10.10.10.25' IDENTIFIED BY 'password';

3. Apply proper permissions to the user:

GRANT ALL ON wordpress_db.* TO 'wp_user'@'10.10.10.25';

4. Flush privileges:

FLUSH PRIVILEGES;

5. Exit

exit

7. Set MySQL to listen for remote connections:

sudo vim /etc/mysql/mysql.conf.d/mysqld.cnf

7. Change the bind-address line to the private IP

bind-address = 10.10.15.60

8. Restart mysql

sudo systemctl restart mysql.service

Install Apache

1. SSH into jump instance
2. SSH into Web instance
3. Apt update
4. Install apache2

sudo apt install apache2

4. Enable Apache

sudo systemctl enable apache2

5. Test that the temp apache web server is up at the public IP of the web instance

Install PHP

On Web:

1. Install php packages:

sudo apt install php libapache2-mod-php php-mysql

2. Check that php installed correctly

php -v

WordPress Installation

On Web:

1. Install the latest WordPress tarball

cd /tmp && wget https://wordpress.org/latest.tar.gz

2. Decompress:

tar -xvf latest.tar.gz

3. Copy the folder to /var/www/html

sudo cp -R wordpress /var/www/html/

4. Change ownership of /wordpress/:

sudo chown -R www-data:www-data /var/www/html/wordpress/

5. Change file permissions of directory contents:

sudo chmod -R 755 /var/www/html/wordpress/

6. Create /uploads/:

sudo mkdir /var/www/html/wordpress/wp-content/uploads

7. Change perms of /uploads/:

sudo chown -R www-data:www-data /var/www/html/wordpress/wp-content/uploads/

WordPress Configuration

On your host:

1. Browse to http://Public-IP/wordpress
2. Select a language and Continue
3. Hit Lets go!
4. Fill out the wizard
   • DB Name: wordpress_db
   • Username: wp_user
   • Password: password
   • Database Host: 10.10.15.60
5. Submit
6. Run the installation
7. Set the site title, username, and password. Then proceed.
8. Log in with the credentials you just set