Oracle Cloud Instance Ubuntu iptables

I've recently been exploring Oracle's Cloud offerings while looking to migrate a website from an Amazon EC2 instance.  After struggling with troubleshooting connectivity through Oracle's Cloud seemingly straight forward security offerings, I found the default Ubuntu image has iptables configured as well.  It restricts all ingress except port 22 for SSH.

Given I rarely dabble in iptables, here's a few tips for next time:

! Show iptables configuration including line numbers
sudo iptables -L -n --line-numbers

! Add and entry to accept traffic on port 80 at configuration line number 4
! Existing entries at line 4 and beyond will slide down to 5 and beyond
sudo iptables -I INPUT 4 -p tcp --dport 80 -m state --state NEW -j ACCEPT

! Add and entry to accept traffic on port 443 at configuration line number 4
! Existing entries at line 4 and beyond will slide down to 5 and beyond
sudo iptables -I INPUT 4 -p tcp --dport 443 -m state --state NEW -j ACCEPT

! Make the entries persistent
sudo netfilter-persistent save

If your successful, your iptables look something like this:

ubuntu@server001:~$

ubuntu@server001:~$ sudo iptables -L -n --line-numbers

Chain INPUT (policy ACCEPT)

num  target     prot opt source               destination

1    ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

2    ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0

3    ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0

4    ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 state NEW

5    ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 state NEW

6    ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22

7    REJECT     0    --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Cisco CUCM Remote RISDC is down or unreachable

Restart these services from the affected node:

• Cisco RIS Data Collector (From serviceability Network services)
• Cisco Call Manager Serviceability RTMT (From serviceability Network services)
• Cisco RTMT Reporter Servlet (From serviceability Network services)
• Cisco Trace Collection Servlet (From serviceability Network services)
• Cisco Trace Collection Service (From serviceability Network services)
• Cisco AMC Service (From serviceability Network services)
• Cisco SOAP-Real-Time Service APIs (From serviceability Network services)
• Cisco SOAP-Performance Monitoring APIs (From serviceability Network services)

My experience has been the Cisco AMC Service is the offender.  My ability to monitor the RISDB from RTMT was restored after that restart.

Cisco CUBE troubleshooting commands

# on by default from IOS-XE 17.4.1 17.3.2

voice service trace
    trace

show voip trace    
    all = don't do this, process intense
    cover-buffers = displays list of calls (cover-buffers)

# to find a call

show voip trace cover-buffer | include <calling or called number>

show voip trace cover-buffer | section <calling or called number>

# to find call detail

show voip trace call-id <call-id>

The results can be digested by https://cway.cisco.com/csa or TranslatorX.  If using csa, include show run and show version to include additional analysis (dial-peer matches).

Win10 modify environment variables for a different user

Problem:

Working in an environment where administrative access to the local PC was unavailable.  Local admin access was only available temporarily by elevating access with another local account. 

Found I needed to set and later remove a user environment variable SSLKEYLOGFILE.

When opening the System Properties app and then Environment Variables using the local admin credentials I found setting and deleting the variable was user specific and was being set for the local admin account that couldn't be used for interactive login.  The variable did not affect my account that I used for normal business.

Fix:

First, I needed to find the SID of my real user:

wmic useraccount where name="my_usual_username" get sid

Then I needed to open the registry editor via regedit.  I was allowed to do this via the local admin account.

I found the user specific environment variables are held in HKEY_USERS\the_sid_you_were_returned_above\Environment.

From there you can add and delete environment variables for any of the accounts that exist on the PC.

Using environment variables in Flask vs. Gunicorn

Problem:

 I recently built an app that sent mail in Flask / Flask_Mail via smtp.gmail.com.

After moving it to production using nginx and gunicorn rather than the flask development server I found the emails attempts were rejected by GMail and the logs stated authentication was required.

I was using the same .env file in production that held the mail credentials and was reading that file the same way with load_dotenv().  After stopping nginx and starting the flask server in production I found the mail was sent normally so there was no firewall or permission issues in production.

Fix:

create a gunicorn.config.py and load the .env file there. This is the extent of my file:

import os

from dotenv import load_dotenv

load_dotenv('.env')

Extract the Contents of Cisco COP Files

 This is simply a partial repost of :

How to Extract the Contents of Cisco COP Files

at https://ipcommute.co.uk/technical-articles/19--how-to-extract-the-contents-cisco-cop-files.html

All credit goes to  Aaron Harrison : Development Engineer at IPCommute UK

I found it so useful today I wanted to make sure Aaron's post lives on.  Thanks Aaron!

Cisco Option files (COP Files) are released for Cisco Unified Communications Manager (CUCM) to add new functionality, fixes, and other optional components such as locales or phone firmware.

Each COP file is essentially an archive of files - some are copied to the CUCM server, some are used as data to import to the database, others might be scripts.

Occasionally it might be useful to be able to look at the files that make up a COP file. This has been most useful for me when working with National Dial Plans (NDP); these aren't as well documented as they might be, and I find it useful to look into the files and see exactly what each of the clauses in the NDP actually mean in terms of dialled numbers.

So - here is how to do it.

The COP file is basically a gzip, with an encryption header that makes it unrecognisable to archive packages such as 7-ZIP. You'll need two pieces of software:

• A hex editor. I use HxD, which is free (https://www.google.com/search?q=hxd)
• A file archiver. I use 7-ZIP, which is also free (https://www.google.com/search?q=7-zip)

Once you have downloaded and installed these, grab your COP file of choice. I'll use a Dial Plan from the UK (dp-ffr.3-1-18.GB.cop.sgn).

Run HXD, and open the .cop.sgn file. You'll be presented with a screen that looks like this:

Note above that I’ve highlighted in red the name of the file. Where you see this, highlight it with the mouse, and you should see the hex pattern ‘1F 8B 08’ just after it. This is a Magic Number that marks the start of a GZip file (see http://en.wikipedia.org/wiki/Magic_number_(programming) for more information on Magic Numbers).

What we need to do is highlight everything before that Magic Number, and remove it. Highlight is so that it looks like the following picture, and then click the Edit/Cut menu option. Accept the file size warning.

Once removed, your file should start with the hex values 1F 8B 08. Click the File/Save As menu option and save the file with an additional .gz on the end – e.g. dp-ffr.3-1-18.GB.cop.sgn.gz

Now you can run 7-ZIP, and open the dp-ffr.3-1-18.GB.cop.sgn.gz file. 

PI Meeting / Program Increment Planning

PI Planning stands for Program Increment Planning.

PI Planning sessions are regularly scheduled events held throughout the year where multiple teams within the same Agile Release Train (ART) meet to align to a shared vision, discuss features, plan the roadmap, and identify cross-team dependencies.

Agile Release Train (ART)

An Agile release train (ART) is a team of several Agile Teams working towards a common goal. 

VS Code Remote-SSH to AWS EC2 - disconnect and won't reconnect

Running VS Code 1.83.1 and Remote-SSH to AWS micro / free version EC2 instance of Ubuntu 20.04.6 LTS.

Found that after random intervals of low server stress the Remote-SSH session is disconnected and will not reconnect until the server is stopped and started.  Reloading VS Code does not help. Rebooting the EC2 instance does not help.  Remote IP / AWS security inbound rules are correct.

The fix for me was adding a swap file to the EC2 instance.

See here for the original post I used to set it up:
https://repost.aws/knowledge-center/ec2-memory-swap-file

Use the dd command to create a swap file on the root file system. The block size you specify should be less than the available memory on the instance or you receive a "memory exhausted" error.

I had success setting the swap file to 1 GB (128 MB x 8):

$ sudo dd if=/dev/zero of=/swapfile bs=128M count=8

Update the read and write permissions for the swap file:

$ sudo chmod 600 /swapfile

Set up a Linux swap area:

$ sudo mkswap /swapfile

Make the swap file available for immediate use by adding the swap file to swap space:

$ sudo swapon /swapfile

Verify that the procedure was successful:

$ sudo swapon -s

My results look like so:

Filename                                Type            Size    Used    Priority

/swapfile                               file            1048572 90880   -2

Start the swap file at boot time by editing the /etc/fstab file.

$ sudo nano /etc/fstab

Add the following new line at the end of the file, save the file, and then exit:

/swapfile swap swap defaults 0 0

CUCM SQL DNs on device types

 Returns device type, device name, associated DNs, etc. where DNs are 1+10 digit format. 

run sql SELECT TypeModel.Name, Device.Name, Device.Description,  DeviceNumPlanMap.Display, NumPlan.DNOrPattern,  DeviceNumPlanMap.NumPlanIndex,  CallingSearchSpace.Name  FROM NumPlan  INNER JOIN TypeModel INNER JOIN Device ON TypeModel.Enum =  Device.tkModel INNER JOIN DeviceNumPlanMap ON Device.pkid =  DeviceNumPlanMap.fkDevice ON NumPlan.pkid = DeviceNumPlanMap.fkNumPlan  INNER JOIN CallingSearchSpace ON  NumPlan.fkCallingSearchSpace_SharedLineAppear = CallingSearchSpace.pkid  INNER JOIN RoutePartition ON NumPlan.fkRoutePartition =  RoutePartition.pkid where dnorpattern like '1%' and length(dnorpattern) = 11 ORDER BY NumPlan.DNOrPattern

CUCM SQL device and owner ID where LDAP integrated

 Returns a list of physical devices that are owned by a LDAP integrated user

run sql SELECT device.name, enduser.userid FROM device LEFT JOIN enduser ON device.fkenduser = enduser.pkid where device.name like "SEP%" and enduser.fkdirectorypluginconfig is not null

VS Code Connect to host Remote SSH invalid format Permission denied (publickey)

After moved a website from one AWS ubuntu EC2 instance to a another AWS ubuntu ECS instance I wanted to make some quick modifications to some python code there.

Using VS Code, I created a new host in my C:\users\Administrator\.ssh\config file using the same format as my previously working host config:

Host XX.XXX.XX.XXX
  HostName XX.XXX.XX.XXX
  User ubuntu
  IdentityFile "C:/Users/Administrator/Documents/Projects/TTS/key_that_works_with_putty.ppk"

Connecting using that host entry consistently returned in VS Code terminal:

[21:32:12.279] Running script with connection command: "C:\WINDOWS\System32\OpenSSH\ssh.exe" -T -D 56925 "XX.XXX.XX.XXX" bash

[21:32:12.283] Terminal shell path: C:\WINDOWS\System32\cmd.exe

[21:32:12.608] > ]0;C:\WINDOWS\System32\cmd.exe

[21:32:12.608] Got some output, clearing connection timeout

[21:32:12.957] > Load key "C:/Users/Administrator/Documents/Projects/TTS/key_that_works_with_putty.ppk" i

> nvalid format

[21:32:12.990] > ubuntu@XX.XXX.XX.XXX: Permission denied (publickey).

Although the key worked with putty and WinSCP, VS Code called it invalid and public.

The fix was:

• puTTYgen
• Load
• point to key_that_works_with_putty.ppk
• Conversions | Export OpenSSH key
• Call the new key something like key_that_works_OpenSSH_style.ppk
• Modify VS Code host entry IdentityFile to point to new key.

Hope that helps.

CUCM Block Inbound Callers by Caller ID on CUBE or gateway level

For information on blocking inbound callers by caller ID on MGCP gateways via CUCM, see my old post here: http://webmaxtor.blogspot.com/2017/12/blocking-calls-based-on-calling-party-id.html

Since a co-worker and an old client just recently asked about doing it at the gateway level using SIP trunks, here's a quick synopsis of one way to do it:

Create a voice translation rule that identifies calls with a very specific number.  Here for example I am focusing on the telephone number +1(716)555-1212.

!
voice translation-rule 99
    rule 1 reject /7165551212/
!

Then create a translation profile that indicates you want to use that rule when looking at calling numbers.  Since we are looking to block a caller with this caller ID the profile would look like so, keeping in mind the word BLOCK is just a label and could be anything.

!

voice translation-profile BLOCK

 translate calling 99

!

Then use that profile to block calls handled by a specific inbound dial peer.  Here dial peer 88 is the incoming dial peer that handles calls from the PSTN.  The profile we created called BLOCK is used to identify which incoming calls on this dial peer should be rejected.

!

dial-peer voice 88 voip

    call-block translation-profile incoming BLOCK

    call-block disconnect-cause incoming call-reject

!

Webex Contact Center CJA report on IVR menu option dialed

I was recently asked to set up a simple telephony IVR with six options and provide the ability to report on which options were chosen by callers.  

In UCCX world I would use a Set Enterprise Info step to write a custom variable and then report on it later.  Here, since some of the IVR options were already being served by Webex Contact Center I wanted the IVR and reporting to be a function of Webex as well.

Below is what I came up with after a tip from the Reddit r/ciscoUC group found here: https://www.reddit.com/r/ciscoUC/comments/wrqw7v/webex_contact_center_menu_option_selection_report/ 

1. new Global Variable created called Global_OptionEntered
2. new dialed number to Entry Point Mapping
3. new Entry Point to new Flow Routing Strategy
4. Flow IVR created with Menu activity with six Custom Menu Links
5. Each Menu Link flow path is connected to a Set Variable activity
6. Each Set Variable activity set the Global_OptionEntered variable to a string that describes the reason for the option selected. For example, option 1 was set to "1. Vanilla", option 2 was set to "2. Chocolate", etc.
7. The Set Variable flow path was then connected to a Blind Transfer activity to send the caller to another system, or to a GoTo activity to route the caller to another Entry Point already in production in Webex Contact Center.

Set Variable

1. In CJA create a new visualization with the Customer Session Record type
2. The Row Segment is the new global variable Global_OptionEntered
3. The Profile Variable is the Count of Global_OptionEntered
4. The Filters is Global_OptionEntered "is in" and the six strings (i.e. "1. Vanilla", "2. Chocolate", etc.) written to the variable by the Set Variable activities in the flow.

CJA Customer Session Record Filter

1. The report output is then basically this:

Sample Report Output

CUCM SQL

This provides devices and DNs where the External Phone Number Mask is like 7162010662. The percent sign allows you to allow for an unknown number of characters if you are searching for partial numbers. This sample sorts by device name.

run sql select d.name, d.description, n.dnorpattern, dmap.e164mask from device as d inner join devicenumplanmap as dmap on dmap.fkdevice = d.pkid inner join numplan as n on dmap.fknumplan = n.pkid where dmap.e164mask like '%7162010662' order by d.name

This provides Translation Patterns where the Called Party Transform Mask is starts with 330.

run sql select dnorpattern, calledpartytransformationmask from numplan where tkpatternusage=3 and calledpartytransformationmask like '330%'

This provides CUCM phone Device Name, Description, Model and Phone Load Name configured on device if present:

run sql SELECT d.name AS device, d.description, m.name AS model, d.specialloadinformation AS device_load FROM device d INNER JOIN typemodel m ON d.tkmodel = m.enum WHERE m.tkclass = 1 ORDER BY m.name, d.name;

Download Cisco RTMT Real Time Monitoring Tool via direct URL

Perhaps your browser doesn't allow you to download Cisco RTMT from your CUCM | Application | Plugins link.  I suspect this might be a standard setting in more security conscious locations.

Try this: https://your_CUCM_url_or_IP_address:8443/plugins/CcmServRtmtPlugin.exe

Now when you get it installed and it is visually unusable, check this bug out:  https://quickview.cloudapps.cisco.com/quickview/bug/CSCva07316

1. Right click your RTMT executable
2. Click Compatibility tab
3. Click Change High DPI Settings button
4. Check Override high DPI scaling behavior.
5. Choose System from dropdown

Enjoy your Cisco RTMT.

Create Cisco prompt WAV files via TTS

Here's a little website I put together while experimenting with Google's Text-to-Speech Client Libraries and the Text-to-Speech API:

https://www.ciscoprompts.com

It will create WAV files in 8bit 8khz uLaw format, suitable for uploading to Cisco UCCX, Unity Connection, etc. via Google's text to speech service.

If you find it useful or have a suggestion on how to make it useful, I'd appreciate leaving me message.

Visual Studio Code and Remote-SSH to AWS EC2 Ubuntu

View | Command Palette...

Remote SSH

Add New SSH Host...

ssh ubuntu@18.18.18.18

select your SSH configuration file from dropdown

Open Config

Modify your config file accordingly.  The HostName value should be the EC2 host name / public DNS setting found in the AWS EC2 console.  The User will generally be ubuntu.  When using Visual Studio Code in Windows the IdentityFile path should be enclosed in double quotes, use single forward slashes and use the .pem extension on your key despite using the .ppk when connecting via  PuTTy, WinSCP or the like.

For example:

Host 18.18.18.18

HostName ec2-18-18-18-18.compute-1.amazonaws.com

User ubuntu

IdentityFile "C:/Users/rmaslanka/Documents/AWS/AWSmykey.pem"

Win10 SSH configuration for Visual Studio Code

If you have the ppk but not the base64 / pem private key required here, you can convert the ppk using PuTTygen, a key generating tool by the developers of PuTTy, found here: 

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Choose Load and browse for your existing key with the ppk extension.  Choose Conversions | Export OpenSSH key and save it, now with the a pem extension.  You'll then have both the ppk and base64 pem private key versions.

PuTTygen ppk to pem conversion

CUCM 12.5 CDR billing and DRS server failure after upgrade

 Tl;dr: CUCM 12 and beyond supports a shorter list of encryption algorithms for SFTP file transfers.

After completing a CUCM cluster upgrade from 11.5(1)SU6 to 12.5(1)SU3 I found errors in RTMT indicating CDR records were no longer being sent to the existing RSI billing server.

There were no networking changes and all CUCM services were running so we started with restarting the Cisco CDR Repository Manager and Cisco CDR Agent because who knows, why not?  When that failed I quickly added another billing server and pointed it to a freeFTPd server I was using to serve Cisco upgrade media.  I immediately started receiving billing records there. With that there then didn't seem to be any issue with the CUCM record collection and transfer themselves but something unique to the old billing server.

Collect logs from CUCM publisher

I grabbed all the logs related to CDR from the Publisher via RTMT, used grepWin to dig through them to find references to the billing server IP address configured in CUCM and found: 

2020-12-29 05:47:57,549 INFO  [Thread-15] cdrrep.CDRSender (CDRSender.java:175) - There was file delivery failure for destination 2 in last round, re-connect server now!

2020-12-29 05:47:59,619 ERROR [Thread-15] sftpapi.SFTPConnection (SFTPConnection.java:319) - error Making SFTP connectionAlgorithm negotiation fail

2020-12-29 05:47:59,619 ERROR [Thread-15] sftpapi.ftpClient (ftpClient.java:246) - connect(): Failed connect to 10.10.10.10

The interesting bit there is Algorithm negotiation fail.

Some Googling turns up a bug CSCuz80145 indicating I may need to eliminate some CTR ciphers:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz80145

Of course my version is well beyond the affected and fixed versions so how it applies is questionable.  It does maybe mean there is some sort of issue with using the CTR ciphers.

The Administration Guide for Cisco Unified Communications Manager, Release 12.5(1)SU1 (which I honestly have never looked at) does indeed indicate that ONLY the CTR ciphers are supported in version 12 and beyond, at least for DRS purposes.

aes128-ctr, aes192-ctr and aes256-ctr supported

The RSI support representative the client contacted was in no mood to answer questions about what SFTP server was installed or how it was configured and simply suggested it was a CUCM issue. Cisco TAC was not going to respond anytime soon to confirm whether CDR transport had the same limitations as DRS.

How does one confirm what the SFTP servers support without their vendor support?

I fell upon a post by Kenneth Perry at https://nocthoughts.wordpress.com/2019/07/25/cdr-export-to-billing-server-failing/ describing a very similar issue discovered in a different fashion.  Given the date on his post and his SFTP server scans it seems he was working on an older CUCM version that did not support CTR ciphers, while my 12.5 version ONLY supported CTR ciphers.  Regardless, thanks Ken and whoever your colleague Mark is!

Although not my normal go-to tool, I did happen to have nmap installed on my laptop to prep for another "Cisco DevNet, DevOPs, CI/CD, automate everything and move it to the cloud training bootcamp" I sat through recently.

More info on the specific nmap script used and nmap in general is here: https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html

Scanning the failing RSI as well as my successful test SFTP server returned what I suspected.  The old RSI billing server was not advertising the new CTR cipher support that the 12.5 admin guide indicated is required. The questionable but free and easy freeFTPd server showed it supported the CTR ciphers required by 12.5 as well as the old CBC list used by 11.5.

cbc only list on failing server

What to do?

RSI support did ultimately attempt to update their SFTP server to support the new ciphers but it didn't make a difference.  

Ultimately we put our fingers in our ears, flipped it all to FTP and called it a day.

Pretty cool regardless.

Update 02242022

Was recently tasked with configuring OpenSSH on a Windows Server 2016 (before it was offered as an installable Windows app / feature).
It was to serve as the target of multiple version 11.5/6 UC servers.

Notable configuration options used:

# Ciphers and keying specifically for 11.X but not newer
Ciphers aes128-cbc
KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

# To restrict access to a particular Windows local group, here called SFTPUsers
AllowGroups SFTPUsers

Cisco Unity Connection via MRA Expressway Core HTTP allow list

 Deploying Expressway version 12.6 to support MRA and B2B calling with CUCM 11.5(1)SU8 I found voicemail was unavailable via the Jabber clients when connected via Expressway.  

The clients would indicate they couldn't connect to VMREST via 443.

The Unity Connection servers were discovered in Expressway Core (Configuration > Unified Communications > Unity Connection Servers) and the inbound rules seemed to be automatically populated (Configuration > Unified Communications > HTTP Allow List > Automatic Inbound Rules).

Regardless I found "Access Denied" messages in the Expressway Core event logs stating otherwise.

The fix was to seemingly replicate the rules manually (Configuration > Unified Communications > HTTP Allow List > Editable Inbound Rules).

To keep the list simple I used prefixes to VMREST on port 443 and the root on port 7080.

Add SSL support to nginx deployments

This is essentially a copy and paste of important points found at https://www.techrepublic.com/article/how-to-enable-ssl-on-nginx/. Please stop and go there to get a more complete version.

If you are following the logic and nginx configuration steps found at http://webmaxtor.blogspot.com/2020/08/flask-python-sqlite-aws-ec2-nginx.html feel free to follow this abridged and custom version instead.

Generate a self-signed certificate:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

Configure nginx to use SSL:

sudo nano /etc/nginx/snippets/self-signed.conf

ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

sudo nano /etc/nginx/snippets/ssl-params.conf

ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers
ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

Generate pem:

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Assuming you are using the sites-enabled verses site-available, do the following. Alternatively you can do the same in site-available and create a link to it in site-enabled.

sudo nano /etc/nginx/sites-enabled/bttb

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    include snippets/self-signed.conf;
    include snippets/ssl-params.conf;

    server_name 100.25.168.210 therealsitename.com www.therealsitename.com;
    location /static {
        alias /home/ubuntu/bttb/app_BTTB/static;
    }

    location / {
        proxy_pass http://localhost:8000;
        include /etc/nginx/proxy_params;
        proxy_redirect off;
    }
}

server{
    listen 80;
    listen [::]:80;

    server_name 100.25.168.210 therealsitename.com www.therealsitename.com;

    return 302 https://$server_name$request_uri;
}

Check to see if nginx is SSL enabled

sudo ufw app list

Restart and try https: and http: access. Both should send you to your page over https but with a self-signed certificate.

sudo systemctl restart nginx