Yevgeniy Afanasyev's questions

I'm using AWS LightAail on Ubuntu.

Initially Web based Terminal was working fine, but when I did

$ sudo apt-get update
$ sudo apt-get upgrade

I got an error

Log in failed. If this instance has just started up, try again in a minute or two.
CLIENT_UNAUTHORIZED [769]

I have a situation when some DDOS attacks are putting my PHP server down. Occasionally.

I'm using AWS with auto scaling groups, so it is not a problem.

The problems start when this server is going down in the middle of the cron job scheduled PHP script.

So my idea was to block all of the routs on the PHP servers except for the /healthcheck...

How can I do that and is there a better solution?

I'm trying to request a (SSL/TLS) certificate with AWS Certificate Manager.

but getting this error:

Something went wrong Cannot request more certificates in this account. Contact Customer Service for details.

I tried to make a case Limit Increase: Certificate Manager, but it stays unassigned for 24 hours.

I have never hit a limit of 100 certificates.

It started, when I tried to make a certificate for a domain that was not registered with route 53. Now I cannot even create a certificate for domains that registered with route 53. Was it a coincidence or is it related?

I set _dmarc to see my email authentication reports (in case it fails).

like that

"v=DMARC1;p=quarantine;pct=100;rua=mailto:[email protected]"

And I receive these reports form Google.

a report I receive my emails are good, because they are comming from AWS SES and all configured fine, it comes like that

<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>

BUT sometimes I get records like this

<record>
  <row>
    <source_ip>209.85.220.41</source_ip>
    <count>1</count>
    <policy_evaluated>
    <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>mydomain.com</header_from>
  </identifiers>
  <auth_results>
    <dkim>
      <domain>mydomain.com</domain>
      <result>pass</result>
      <selector>xxx</selector>
    </dkim>
    <dkim>
      <domain>amazonses.com</domain>
      <result>pass</result>
      <selector>gggxxx</selector>
    </dkim>
    <spf>
      <domain>gmail.com</domain>
      <result>pass</result>
    </spf>
  </auth_results>
</record>

And I understand that someone has forwarded my email but without overwriting headers and this someone was gmail.

Why gmail doesn't overwrite headers and why should I care about forwarding at all? They only suppose to send me emails when it is my problem, right?

Am I confusing something?

I'm an AWS SES user.

I'm getting emails from [email protected] with this message:

This is an email abuse report for an email message from amazonses.com

Based on this Why do I receive messages from [email protected]?

I know that

When you receive such an email, you should verify that the complaining recipient is not included in your future email sends. This will ensure that you have happy email recipients and fall under the good graces of Amazon SES.

Now, my question - what can I do to reverse this action? What if customer did it by mistake, or he did not think it through.

My business is selling coupons online, sometimes with subscription. Now what if someone make my email as a spam? I need to notify this person that his email address will never be used for future emails and I need to offer people an option to resubscribe to our service if they did it by mistake.

1) What can I recommend them todo? What is the procedure for a customer to unmark my email address as SPAM?

2) How can I deliver this message if I'm not allowed to email?

3) Does it mean that only one email address of mine was blacklisted or whole domain?

Thanks

On my web server Yesterday I have caught a POST request with following text for a host

"><script>alert('qualys_xss_joomla_2.5.3')</script>

in full it was like this

headers
{
  ...
  "host": "%22%3e%3cscript%3ealert('qualys_xss_joomla_2.5.3')%3c%2fscript%3e",
  "x-forwarded-port": "443",
  "x-forwarded-proto": "https",
  ...
}
httpMethod
POST

Is it a hacking attack? What was it aimed for?

I'm using AWS CodeDeploy and getting an error message:

Script at specified location: ... "failed to complete in 5 seconds"

the script is called from appspec.yml->hooks:->BeforeInstall:

How can I fix it?

Is it an indication of something? Why is it 5 seconds limit? How can I increase it?