←Project_Database

Cloud Infrastructure & Enterprise Services (AWS/Linux)

Advanced Systems Server // Cloud_Core

AWS VPC / EC2bind9 DNSnftablesPython / Boto3OpenLDAPNFS / Samba
INTERACTIVE_TOOL // LIVE_DEMO

nftables Generator

A tool I built to take the guesswork out of writing Linux firewalls. Pick your distribution, describe what the server does, and it generates a complete, valid /etc/nftables.conf with stateful connection tracking, hardened chain policies, and the exact install commands for your package manager. Everything runs locally in your browser — no data ever leaves this page.

Overview

Enterprise-grade cloud and OS-level engineering from the Advanced Systems Server coursework. The work spans architecting authoritative DNS and stateful OS firewalls across an isolated AWS VPC, deploying distributed file systems and centralized LDAP identity, and automating the entire cloud footprint through a Python/Boto3 Infrastructure as Code pipeline.

Major Projects

  1. 01

    Authoritative DNS Infrastructure & Stateful OS Firewalls

    AWS VPCEC2Ubuntubind9nftablessystemd-resolvedPostfix

    Overview // Architected a secure, logically isolated cloud network and engineered a fully functional, replicated Domain Name System (DNS) protected by strict OS-level firewalls.

    • Network Topology & Routing: Deployed a split AWS Virtual Private Cloud (VPC) topology utilizing public and private subnets. Bypassed default AWS DHCP by engineering persistent static routing using netplan and overriding cloud-init configurations.
    • Authoritative DNS Architecture: Engineered a primary and secondary replicated DNS infrastructure using bind9 for a custom internal domain (.ops).
    • Zone Management: Developed and deployed custom forward and reverse lookup zones (in-addr.arpa), meticulously managing SOA, NS, A, and PTR records to ensure seamless internal hostname resolution.
    • DNS Security: Hardened the DNS infrastructure by restricting zone transfers and queries (allow-query, allow-recursion) exclusively to the local VPC network.
    • Stateful OS Firewalls: Replaced reliance on basic AWS Security Groups with highly customized, OS-level firewalls using nftables. Compiled strict rulesets enforcing default DROP policies across INPUT, FORWARD, and OUTPUT chains.
    • Packet Inspection: Engineered stateful firewall rules (ct state established,related) to explicitly permit SSH (TCP 22), DNS (TCP/UDP 53), and ICMP traffic, effectively dropping all unauthorized packet traversal.
    • Service Integration: Leveraged the custom DNS infrastructure to successfully deploy Postfix Mail Transfer Agents (MTAs) for internal subnet mail routing.
  2. 02

    Python/Boto3 Infrastructure Automation Pipeline

    PythonAWS Boto3 SDKAWS CLIEC2S3RDSNFSBash

    Overview // Engineered a robust “Infrastructure as Code” (IaC) Python pipeline to achieve zero-touch cloud provisioning, completely bypassing manual AWS Management Console operations.

    • Programmatic Cloud Deployment: Utilized the AWS Boto3 SDK to programmatically provision, tag, and launch a complete AWS environment from scratch, ensuring rapid and error-free reproducibility.
    • Network & Compute Automation: Automated the creation of custom VPCs, CIDR-block subnets, Internet Gateways, and the dynamic deployment of Linux EC2 instances into specified Availability Zones.
    • Storage & Database Provisioning: Extended the automation pipeline to deploy highly available object storage via Amazon S3 (including dynamic bucket policies) and managed relational databases via Amazon RDS.
    • Dynamic OS Bootstrapping: Engineered the automation script to perform OS-level configuration immediately upon instance launch.
    • Automated File Systems: Programmatically generated and applied Distributed File System configurations, including writing NFS /etc/exports control lists (rw,sync,no_root_squash) and triggering service restarts.
    • Metadata Integration: Extracted live AWS instance metadata (such as dynamic IP addresses) during script execution to automatically populate and deploy accurate bind9 DNS zone files across newly launched nodes.

Skills Gained

Enterprise DNS & Mail Architecture

  • Engineered authoritative Primary and Secondary DNS servers using bind9 — custom forward and reverse (in-addr.arpa) lookup zones managing SOA, NS, A, and PTR records.
  • Secured zone transfers (allow-query, allow-recursion) and deployed Postfix MTAs for internal VPC mail routing.

Distributed File Systems (NFS & CIFS)

  • Provisioned nfs-kernel-server environments with strict /etc/exports configurations (rw,sync,no_root_squash).
  • Engineered client-side automounting utilizing autofs (indirect maps) and /etc/fstab.
  • Deployed Samba (smbd) servers utilizing tdbsam backends for secure Windows/Linux interoperability via CIFS.

Centralized Identity Management (LDAP)

  • Deployed OpenLDAP (slapd) directory services to centralize POSIX user authentication.
  • Integrated cosine, nis, and inetorgperson schemas, and bridged LDAP authentication with NFS shares for scalable user roaming profiles.

Advanced Linux Networking & OS Security

  • Bypassed AWS DHCP by engineering persistent static routing using netplan and systemd-resolved, implementing overrides to prevent cloud-init modifications.
  • Architected strict OS-level firewalls using nftables — default DROP policies on INPUT, FORWARD, and OUTPUT hooks while managing stateful connections for SSH (TCP 22) and DNS (TCP/UDP 53).

AWS Cloud Automation (IaC)

  • Transitioned from manual AWS Management Console operations to Infrastructure as Code (IaC) using Python's Boto3 SDK and the AWS CLI.
  • Programmatically deployed VPCs, CIDR-block subnets, EC2 instances, S3 buckets, and RDS databases.
←Project Archive