Amazon’s S3 file storage service started life as just that — a simple way to store static files and pay for only the data you used. When you don’t need an always-on server, S3 fits the bill.

But if you can store static files, why not whole static websites? In 2011 Amazon began allowing you to point your own domain to an S3 “bucket”, a folder in Amazon parlance. Custom domain support made it simple to host entire static sites; the catch was that you needed to use a subdomain — for example, www.

Now the www restriction has been lifted and you can point any root domain at S3 and serve your files directly. The only catch is that Amazon has created its own non-standard DNS workaround, which means you must use Amazon’s Route 53 service to host the DNS data for your domain.

Unfortunately, while the new root domain support is great news for anyone using a static blog generator like Jekyll, Amazon’s documentation leaves much to be desired. To help you get started with S3 hosting, here’s a quick guide to setting up S3 to serve files from a root domain (rather than making the root domain redirect to www.mydomain.com, as the Amazon blog post instructions do).

First, register a domain name and point your DNS records to Amazon’s Route 53 service (the Route 53 docs have detailed instructions on how to do this). The next step is to create an S3 bucket for your domain. In other words, a bucket named mydomain.com.

Now click the Properties button, select the Website tab and make sure that the option is enabled and the Index Document is set to index.html. You’ll also need to click the Permissions tab and set a bucket policy (you can use this basic example from Amazon).

Now upload your site to that bucket and head back to Route 53. Here comes the magic. To make this work you need to create an A “Alias” DNS record. Make sure you name it the same as your domain name. Sticking with the earlier example, that would be mydomain.com. Now click the Alias Target field and select the S3 endpoint you created earlier when you set up the bucket.

And that’s it. Behind the scenes that Route 53 “Alias” record looks like a normal DNS A record. That means things like email will continue to work for your domain and at the same time Route 53 directs requests to your S3 bucket. If you want to make www redirect to the root domain you can either set that up through Route 53 (see Amazon’s instructions) or handle it through another service.

A group of DNS providers and content delivery network (CDN) companies have devised a new extension to the DNS protocol that that aims to more effectively direct users to the closest CDN endpoint. Google, OpenDNS, BitGravity, EdgeCast, and CDNetworks are among the companies participating in the initiative, which they are calling the Global Internet Speedup.

The new DNS protocol extension, which is documented in an IETF draft, specifies a means for including part of the user’s IP address in DNS requests so that the nameserver can more accurately pinpoint the destination that is topologically closest to the user. Ensuring that traffic is directed to CDN endpoints that are close to the user could potentially reduce latency and congestion for high-impact network services like video streaming.

The new protocol extension has already been implemented by OpenDNS and Google’s Public DNS. It works with the CDN services that have signed on to participate in the effort. Google and OpenDNS hope to make the protocol extension an official IETF standard. Other potential adopters—such as Internet ISPs—are free to implement it from the draft specification.

It’s not really clear in practice how much impact this will have on network performance. It’s worth noting that GeoIP lookup technology is already used by some authoritative DNS servers for location-aware routing. The new protocol extension will reportedly address some of the limitations of previous approaches.

This article originally appeared on Ars Technica, Wired’s sister site for in-depth technology news.

On the resume that convinced Wired to hire me, I said that I knew enough about Unix that it didn’t scare me anymore. This wasn’t exactly true. Unix was still a chilling concept for me when I arrived at the San Francisco office armed with a copy of Unix for Dummies. The managing editor steered me to my desk and instead of the Macintosh I was hoping for, there sat a purple SGI machine.

I realized then that I needed to learn a lot about Unix fast. Initially I tried using SGI’s graphical user interface, which mimicked the Macintosh desktop fairly well, but soon realized that it was just too damn slow. So I stole some better Unix books from the engineering staff and found a nice Unix expert to help me. Soon I was cp-ing, mv-ing, and chmod-ing like lightning. Unix still gives me the occasional nightmare, but basically I love it. It’s fast, it makes sense (most of the time), and anyone can figure it out with a little work. Plus, it looks great on a résumé. If you can convince a prospective employer that you have a working knowledge of Unix, you’re one step ahead of everyone else who is too scared even to try figuring it out.

I’ve put together a very basic explanation of Unix to get you started. But first, a warning. Unix is very powerful. The wrong collection of keystrokes can blow away files that you’ll probably never be able to recover, so practice on sample files before you move on to anything important.

Getting started

Before you can do anything, you need an account. Find someone at your school or workplace whose title is webmaster, server administrator, systems administrator, or Unix god. Be very nice to this person. Bring gifts and libations, and then ask them to set up an account and user directory for you. Promise that you won’t bug them very often with questions, even though this may indeed turn out to be a white lie.

Keep in mind that Unix installations vary widely. If something doesn’t work for you here, it may be that a program wasn’t installed or your account was misconfigured. There’s also a strong possibility that you’re using one of several different kinds of Unix, which means your commands may vary slightly from what you learn here. If you run into trouble, go ask the person who set up your account to help you — but don’t forget to bring a gift.

Once you’ve got your account, go to the bookstore and purchase a few Unix books. My favorite is O’Reilly & Associates’ UNIX in a Nutshell. It’s a fabulous dictionary of commands.

Telnet

To access your account, you’ll need a shell (a program that sends whatever you type to the host computer). The easiest way to go about this is to open a Telnet window. (If you’re sitting at the host computer, you’ll already have a shell.) Accessing files with Telnet is essentially the same as opening the Finder on your Mac or opening the Windows Explorer on a Microsoft machine — except that when you get into the file structure, you won’t find all those sissy color-coded directories.

So open Telnet, and choose Open Connection from the File menu. Fill in the Host/Session Name slot with your host’s address and hit Connect. You’ll be asked to enter the username and password that your nice sysadmin assigned you when your account was set up. You should also have a user directory, which is the first place you’ll end up when you Telnet to your Host. When you log on, you should get something that looks like this:

 IRIX (sutro)



 login:pam



 Password:



 IRIX Release 5.3 IP20 sutro



 Copyright 1987-1994 Silicon Graphics, Inc. All Rights Reserved.



 Last login:Fri Dec 13 14:04:59 PST 1996 by UNKNOWN@hill.hotwired.com



 You have mail.



 sutro[~]%

Although you probably won’t see it when you log on, the actual location of your user directory is

 sutro.hotwired.com[~]%pwd



 /usr/people/pam

Basic Commands

I’ve put together a few commands to get you started. Most of these commands have several options that make them even more powerful, but I won’t go into those here. You can find them in the Unix Online Manual, which I’ll explain in a minute (or you can use that book you went out and bought).

ls – list files in a directory syntax:ls [options] [names]

You should get something that looks like this:

 sutro.hotwired.com[~]% ls

 airwolf.au          goo.html    unixclass

 apanel.parameters   graphics

In this example I have two files ( airwolf.au and goo.html) and three directories (unixclass, apanel.parameters, and graphics) in my user directory.

cd – change directory syntax:cd [dir]

Here’s an example of it what the result might be:sutro.hotwired.com[~]% cd unixclass

 sutro.hotwired.com[~/unixclass]% ls

 one       one.html  two       two.html

 sutro.hotwired.com[~/unixclass]%

In this case, I’ve changed from my user directory to the unixclass directory, which holds one directory and two files (if you want to move back one directory use % cd ../).

mv – moves or renames a file or directory syntax:mv [options] sources target

Here’s what it might look like:

 sutro.hotwired.com[~/unixclass]% mv one/ two/

 sutro.hotwired.com[~/unixclass]% ls

 one.html  two       two.html

 sutro.hotwired.com[~/unixclass]% ls two/

 one

 sutro.hotwired.com[~/unixclass]%

I moved the directory one into directory two.

If you use mv to rename a file, it will look something like this:

 sutro.hotwired.com[~/unixclass]% mv two/ somethingdifferent

 sutro.hotwired.com[~/unixclass]% ls

 one.html            somethingdifferent  two.html

In this example, I’ve renamed the directory two. Now it is called somethingdifferent.

rm – removes a file syntax:rm [options] [files]

Here’s an example of removing a file:

 sutro.hotwired.com[~/unixclass]% rm one.html

 sutro.hotwired.com[~/unixclass]% ls

 somethingdifferent  two.html

I removed the file one.html from the directory unixclass.

rm -ir – removes a directory

Here’s what happens when you remove a directory:

 sutro.hotwired.com[~/unixclass]% rm -ir somethingdifferent/

 Directory somethingdifferent/. Remove ? (yes/no)[no] :yes

 Directory somethingdifferent//one. Remove ? (yes/no)[no] :yes

 sutro.hotwired.com[~/unixclass]% ls

 two.html

In this example, I’ve used rm -ir to remove the directory somethingdifferent. Before the directory is removed, I must confirm that I really want it gone. Once I do, somethingdifferent no longer exists. Be very careful with rm, because once files or directories are gone, they’re probably gone forever.

mkdir – creates new directory syntax:mkdir [options] directories

Here’s how you do it:

 sutro.hotwired.com[~/unixclass]% mkdir waga

 sutro.hotwired.com[~/unixclass]% ls

 two.html  waga

I used mkdir to create the directory waga.

more – more a file when you just want to read it (not edit it)

less – less really is more. It does the same thing as more, but it allows you to search through a file (among other things).

exit – allows you to log out of your host

date – prints the current date and time

cal 1997 – prints the 1997 calendar

whoami – prints who is currently logged on to your terminal

mail – brings up a simple mail editor

pwd – tells you where you are; it prints the full pathname of the current directory

Unix online manualIf you want more details about a particular command, you can check out the Unix main page, which is basically just a manual for Unix. For example, if you want to find out more about ls, type

 sutro.hotwired.com[~/unixclass]% man ls

And you’ll get:ls(1)

NAME

      ls - list contents of directory



SYNOPSIS



      ls [-RadLCxmlnogrtucpFbqisf1AM] [names]



DESCRIPTION



      For each directory argument, ls lists the contents of the directory; for

      each file argument, ls repeats its name and any other information

      requested. The output is sorted alphabetically by default.

To quit man, type q.

Permissions

As you travel around your host computer, you’re going to find there are lots of things you can’t do. You won’t have the freedom to move and edit files as you did in your user directory.

Remember ls from our basic commands? One of this command’s options (ls -l) gives you loads of information about files and directories.

Here’s an example:

sutro.hotwired.com[~/unixclass]% ls -l



total 20



drwxrwxr-x    2 pam      staff        512 Dec  5 09:34 one



-rw-rw-r--    1 pam      staff       4233 Dec  5 09:35 one.html



drwxrwxr-x    2 pam      staff        512 Dec  5 09:34 two



-rw-r--r--    1 pam      staff       4233 Dec  5 09:36 two.html

Here we have the contents of the directory unixclass, which contains two directories (one and two) and two files (one.html and two.html). The first column of letters determines who can read, write, or execute your files and directories. (I know it just looks like a bunch of letters, but give me a second and I’ll explain.)

The second list (pam, pam, pam, pam) tells who owns the file. In this case, it’s me.

The next column tells which group I was part of when I made these files. To find out what groups you belong to, type groups and your name, like this:

 sutro.hotwired.com[~/unixclass]% groups pam

 infomgr staff prod edit

The fourth column shows the size of the files.

The fifth is the date and time the file was last modified; the sixth is the name of the file.

What the Heck is rwx?

As I mentioned before, these letters determine who can read, write, or execute your files. They break down like this:

For files:

r = read – you can read the file (more or less it)

w = write – you can write to the file (edit it with vi, Emacs, or Pico)

x = execute – you can execute the file (run a Perl program)

For directories:

r = read – you can read the directory

w = write – you can create, move, rename, or remove files or directories

x = execute – you can search the directory

Take a look at this ls -l example:

 drwxrwxr-x    2 pam      staff        512 Dec  5 09:34 one/

 -rw-rw-r--    1 pam      staff       4233 Dec  5 09:35 one.html

For every folder and file there are four sets of rwx. In the example above, they are easy to spot because they’re set apart by hyphens. The first set shows your permissions, the second is for a group, the third is for anything else (other), and the fourth is for everyone (all).

Now, to make things a little more complicated, each one is referred to by a single letter:

you = u

group = g

other = o

all = a

To add permissions on a file or directory, you use +, and to remove them, you use -. Let’s try it out. We’ll remove group write privileges for this file:

 -rw-rw-r--    1 pam      staff       4233 Dec  5 09:35 one.html

To do this, we must also use the chmod command to change the access mode of the file.

 sutro.hotwired.com[~/unixclass]% chmod g-w one.html

 sutro.hotwired.com[~/unixclass]% ls -l

 total 19

 -rw-r--r--    1 pam      staff       4233 Dec  5 10:59 one.html

To make a program executable for everyone, we’d do this:

 sutro.hotwired.com[~/unixclass]%ls -l svensprogram.pl

 -rw-rw-r--    1 pam      staff          0 Dec  5 11:02 svensprogram.pl

 sutro.hotwired.com[~/unixclass]% chmod a+x svensprogram.pl

 sutro.hotwired.com[~/unixclass]% ls -l

 total 19

 -rwxrwxr-x    1 pam      staff          0 Dec  5 11:02 svensprogram.pl

To change who actually owns a file, use the chown command:

 sutro.hotwired.com[~/unixclass]% ls -l svensprogram.pl

 -rwxrwxr-x    1 pam      staff          0 Dec  5 11:02 svensprogram.p

 sutro.hotwired.com[~/unixclass]% chown sven svensprogram.pl

 sutro.hotwired.com[~/unixclass]% ls -l

 total 19

 -rwxrwxr-x    1 sven     staff          0 Dec  5 11:02 svensprogram.pl

To change which group can access the file, use the chgrp command:

 sutro.hotwired.com[~/unixclass]% ls -l svensprogram.pl

 -rwxrwxr-x    1 sven     staff          0 Dec  5 11:02 svensprogram.pl

 sutro.hotwired.com[~/unixclass]% chgrp infomgr svensprogram.pl

 svensprogram.pl - Not privileged

D’oh! Not privileged. Until you become a powerful Unix god, you will see this message many times. But keep at it, and deityhood may be closer than you think.

Text Editors

VI

The most commonly available text editor is [[Tutorial:Vi Tutorial for Beginners|vi] (pronounced vee-eye), which I especially recommend for Mac users. You really only need to know a few commands to get started.

To start vi, simply type vi at the command prompt:

 sutro.hotwired.com[~/unixclass]% vi myfile.html

and you’ll be instantly thrown into this crazy-looking environment with a ~ on every line. Don’t be afraid. The annoying thing about vi is that you have to tell it when you’re adding and deleting text. You can’t simply type and delete, you have to use the following commands:

• To add text – hit the esc key and the letter i (for insert)
• To delete text – hit the esc key and the letter x (for delete)
• To delete an entire line – hit the esc key and the letters dd
• To save your file – hit the esc key and type :w and then hit return
• To save and exit vi – hit the esc key and type :wq and hit return

Emacs

Emacs is the favorite editor of many, but Macintosh users may tell you not to bother because they find it really irritating. PC users will probably offer a different opinion.

PICO

If you’re a beginner, pico is probably your best bet. Simply type in

 sutro.hotwired.com[~/unixclass]%pico myfile.html

and you’ll be thrown into the editor. All the commands are listed on the top and bottom of the screen. Be sure to save frequently.

Go outside and pop the hood of your car. You should see a thick metal barrier at the back of the engine compartment. This is called the firewall. To see how it works, poke a small hole in the fuel line so that a tiny amount of gasoline starts dripping on the engine block. Now close the hood, start the car, and head out on the highway (Some of you may choose to save life and limb (and time!) by merely visualizing this exercise).

If you have positioned the puncture correctly, within a few minutes the escaped gasoline should ignite and cause a small engine fire. At this point you may see smoke emerge from the engine compartment. Continue driving. You should be able to proceed a considerable distance before the heat becomes uncomfortable and toxic fumes and flames start to enter the passenger compartment.

The reason you can drive so far with a flaming engine is because the firewall is a highly effective barrier between the engine compartment and the passenger compartment. If your car had no firewall, the engine fire would have already melted the dashboard electronics and plastic, destroyed the upholstery, and toasted you to a crisp.

Now. Pull over and very carefully extinguish the fire.

A similar principle can be applied to networked computers. Picture your machine as the cozy, tricked-out interior of your automobile, and the outside world as the dirty but powerful engine that makes it go. It won’t do to have the vulnerable components of your network exposed to the engine’s maliciously raging heat — it’s best to install a firewall.

Let us abandon our weakening metaphor here before it carries us into a ping-pong tournament without a paddle. A firewall, in the networking sense, is a machine that straddles the interface between a private network and the Internet at large, and follows predetermined rules for allowing certain traffic to pass, while blocking traffic that’s unwanted.

So, how to get yourself one of those disaster-averting firewalls? You can start by reading on.

A Firewall for the Home

There are a hundred ways to build a firewall, from turnkey machines (am I the only one who always misreads that word as “turkey”?) that you can just plug in and ignore to a vast variety of software packages.

The elves who bring us Linux, though, have seen fit to incorporate into the Linux kernel the capacity to filter incoming and outgoing packets. They’ve also incorporated tools into Linux distributions to manage these packet-filtering capabilities, making it easy to turn a basic Linux box into a firewall. And all for free! Since we’re now saving up for a new car, we’ll go the thrifty route and set up our system using inexpensive hardware and gratis software.

For purposes of illustration, let’s imagine that you have a small home network. You have just one broadband line running into the house, and you want to share it amongst all the computers:your big desktop system, your laptop, the entertainment system in the livingroom, your live-in boyfriend’s laptop, and the iMac that the boyfriend’s mother, who lives in the basement, uses to surf eBay all day. (Just a temporary arrangement, the boyfriend assures you, until she gets back on her feet and finds a reasonably priced mobile home. Fine, you say, but you both know he owes you big.) Obviously, this is a small-scale example, but the principles can be applied to anything from a single machine to a gigantic network.

Or perhaps you want to run a web server and want it to be a bit less crackable. Whatever your setup, you need a firewall.

Sharing and Masquerading

First, if you want to share one connection among several machines, you can use a gateway masquerading machine for your firewall. As long as traffic is relatively low, it doesn’t have to be particularly powerful.

So exhume that old Pentium 150 from the closet, evict the dust bunnies, stick in US$20 worth of RAM to bring it up to 128 MB, and install a nice new copy of Linux. You will also need two network interface cards — one to talk to the outside world via the broadband line, and one to talk to the rest of the machines in the house. You split your connection amongst the machines in your house with an Ethernet hub, either the shmancy wireless laptop-on-the-roof kind or the traditional kind that you can trip over.

An IP masquerading setup means that, as far as the internet at large is concerned, there’s only one computer here in your house. It has one IP address. When packets come from the outside world, they are sent to that IP address. Our firewall and masquerading box figures out which of the computers inside the house (each of which has its own internal IP address known only to its LAN-mates) should get that packet.

Now you want to configure your firewall. There are a few major versions of the Linux kernel that are in widespread use — version 2.2, which is older but more tried-and-true, and versions 2.4 and 2.6, which are newer, with more and better features. Typically a Linux distribution that you acquire today will use 2.6, but some distros use older kernel versionss. Somewhat inconveniently for us, the firewalling code has changed significantly between these versions.

The Linux Firewall How-To and the Firewall FAQ are indispensable as well.

The first step, though, is to make sure your Linux box is reasonably secure in and of itself. The Linux Security HOWTO is an excellent guide. Basically you want to download any security updates that may exist for the version of Linux that you’re running, turn off any services you’re not using (which should mean most services), and generally lock everything down. A firewall that gets broken into is no good at all.

Tables and Chains

The 2.2 Linux kernel packet-filtering tool is called “ipchains.” The updated version that ships with version 2.4 and 2.6 is known as “iptables.” (There is an older version still, called “ipfwadm,” that works with the 2.0 kernel, but one can’t live in the past.) All of these tools operate on a very simple principle — apply sets of rules to control which sorts of traffic are allowed in and out, and which are not.

Each workstation in the house knows that the firewall machine is its gateway. When workstation number one sends a packet to the firewall machine, the latter assigns the packet to a particular port number (so as to keep track of where it came from), replaces the IP number in the originating header with its own real-world IP address, and sends the packet out. When it receives a reply to the packet from the outside world, the reply will come to the same TCP/IP port. The firewall machine knows that traffic on that port goes to workstation number one, so it replaces the port number and IP address with their original values and passes the packet on to the workstation. This process is completely transparent to both parties.

There are a number of tools that configure ipchains and iptables for you automatically. These easy-to-use tools include PMFirewall and Mason. PMFirewall involves making choices about the configuration you desire. Mason has a “learning mode” that simply looks at how you use your network and sets up firewalling rules automatically to accommodate you. Download and install one of these tools, and configuring your firewall is approximately as easy as pie.

Set up a Firewall with iptables

This section needs expanding. Please log in and edit it.

Set up PMFirewall with ipchains

Just for fun, let’s go over how to set up a firewall with PMFirewall. The installation of Mason is similar, but Mason takes care of detecting your network setup automatically. First, you have to make sure that you have ipchains installed. It should come with your Linux distribution. If you can’t find it on your system (and you’re running the 2.2 kernel), check the CDs or DVDs you installed from. If it’s not there either, it can be downloaded from here. You’ll also want to make sure your kernel is configured to work with ipchains. Chances are that it is … if you get a message that it’s not, the ipchains HOWTO will tell you how to check, and how to fix your configuration if you have to.

Download the zipped PMFirewall from the creator’s site and save it wherever you like to save such things on your system. Unpack the file by typing

tar -xzvf ./pmfirewall-x.x.x.tar.gz

where x.x.x is the version number. Then cd to the pmfirewall directory thus created, and, as the root user, type

sh install.sh

The installation process will prompt you for answers to some preliminary questions – where do you want config files installed, where does your copy of ipchains live, how are you connected to the Internet – for which the default answers should typically suffice. Then it will ask about how you want the firewall set up. Are there machines that you want to give unquestioned access to? Are there machines that you want to prohibit unilaterally? You will be asked to enter their IP addresses.

You also have to tell PMFirewall whether you have a static IP address or whether you’re given a new one every time you log on, via DHCP. Then it asks what services you are running on the firewall machine:FTP? SSH? Telnet? SMTP? DNS? POP? a Web server? IMAP? and so forth. And are there any other ports that you want left open?

Finally, you are asked to configure masquerading, supply information about your internal network, and specify startup behavior. Voila! PMFirewall has configured your firewall automatically. You can proceed to tweak the settings manually if you want or need to.

When your firewall is set up, you can test it by going to the Self Port Scan, which will check your machine for open ports. Try accessing the page from your firewall machine with the firewall turned off and then with it turned on. The difference should be striking … like, say, the difference between slightly elevated temperatures and third-degree burns all over your body.