Tom's Notes

Remote Desktop connection to an Entra ID-joined Windows Server with Entra ID credentials… quick and dirty

By Tomica Kaniski in Other 07/08/2024 1 Comment

Connecting via Remote Desktop to an Entra ID-joined Windows machine, by using the Entra ID credentials, should be easy, right? It usually is… if you have covered all the prerequisites.

Multiple such guides are around, but none has listed all the steps needed (or I just haven’t found the right one) – I chose to follow this one, from my MVP colleague Tom Wechsler, available here.

Some points before we start:

I don’t have a P1 or P2 license, so there are no Conditional Access policies (if they were, I would create one skipping the MFA for these connections as per this article)
Security defaults are enabled on my tenant, so all users need to register for MFA in 14 days (which allowed me to skip MFA… for 14 days)
this is not to be used for production, as not all security best practices are being followed(!)

In my case, all the required steps that allowed me to finally access my Entra ID-joined Windows (Server) machine in Azure via (publicly accessible) Remote Desktop (FOR DEMO PURPOSES), are the following:

Create an Entra ID-joined Windows virtual machine in Azure:

first, you will need to select a supported operating system (Windows 10/11, Windows Server Datacenter 2019/2022):
- worked for me with both Windows Server 2019 Datacenter and Windows Server 2022 Datacenter

another thing needed during the creation of the machine itself is to select Login with Microsoft Entra ID under Management settings so that your machine would be automatically joined to the Entra ID and have the extension installed (note that this option automatically creates the system-assigned managed identity as well, and if not selected at the time of creation, it can also be added later, under virtual machine’s Extensions):

Create a user that will connect to the virtual machine:

the easiest thing would be to create a fresh, new Entra ID user, that will be used for connecting to this virtual machine (you can also use an existing user, but make sure it is not using MFA, which will prevent you from connecting) – my user will be called vmuser
try to sign in with this new user into the Azure portal if you need to change its password, or just to skip the MFA setup:

as the machine is Entra ID-joined, under the Access Control (IAM) settings of the virtual machine (in my case, temp-1), assign this user (vmuser) either the Virtual Machine User Login or the Virtual Machine Administrator Login role:

Connect to the virtual machine with a local admin account (created with the machine):

if you run dsregcmd /status command, the following should be configured already:
- AzureAdJoined: YES
- AzureAdPrt: NO
- IsDeviceJoined: YES
next, go to the System Properties – Remote Desktop settings and disable the Network Level Authentication option (enabled by default):

next, open the Local Security Policy console (secpol.msc) and check if the option Security Settings – Local Policies – Security Options – Network security: Allow PKU2U authentication requests to this computer to use online identities. is set to Enabled (if not, enable it – reboot will be required):

On the computer you will be connecting from (not Entra ID-joined):

do the same – open the Local Security Policy console (secpol.msc) and check if the option Security Settings – Local Policies – Security Options – Network security: Allow PKU2U authentication requests to this computer to use online identities. is set to Enabled (if not, enable it – reboot will be required):

next, download the RDP connection file from the portal:

and then edit the downloaded RDP file (with Notepad) – it should look like the below (more on the available options):
- remove the line with the username (as it will be provided on connection)
- add the following two lines:
  - enablecredsspsupport:i:0
  - authentication level:i:2

try connecting to the virtual machine now, by using the edited RDP file, username, and password of your Entra ID account:
- for the username, make sure you are using the AzureAD\upn-or-email-address format (in my case, AzureAD\[email protected])

your connection should be working, and you will have either the user or admin permissions on the system (depending on the assigned Entra ID role):

Hope this helps.

Cheers!

Challenge with FM radio signal… Raspberry Pi to the rescue!

By Tomica Kaniski in Other 27/03/2023 4 Comments

Not so long ago (actually, a weekend or two ago), I was presented with a real-life issue – an issue that needs to be taken care of… ASAP!

Production was suffering. Production of high-quality foods in my mom’s kitchen, that is! 🙂

So, what was the issue?

To better help you understand the issue, we need to introduce you to the environment first – there’s my mom’s kitchen, from where many amazing dishes come out on a daily basis.

And there’s a small FM radio in this kitchen, providing her company when cooking alone – nothing special, but it’s an essential part of the kitchen (and the overall cooking process)!

About two weekends ago, the user (mom) starts complaining that the radio is having issues with the reception of her favorite FM station. It’s not good when users start complaining, of course. Especially if they are the important ones!

If this isn’t taken care of, production (of food) may suffer! 🙂

So, let’s solve the issue.

As nothing has changed from the FM radio perspective, it seems that the issue is somewhere else. After a short research, it seems that adding a new frequency to the user’s favorite radio station somehow impacted the remaining two (one of which we were using)… and now we’re having bad reception.

Tried to switch to the other two frequencies… didn’t help. This station is transmitted in at least three frequencies, but none of it provides us a good reception anymore.

Even tried with another antenna… no luck.

Switching to another radio station… is not an option. 🙂

When I was thinking about other options, I remembered that this radio station also streams over the Internet (like the example I’m using below)!

Splendid!

As I had this spare Raspberry Pi just standing there, collecting dust, an idea was born – turn it into the “Internet radio”!

The initial solution needs to be basic as possible, headless, work as soon as connected, wireless (as much as possible), and stream the radio station in question. Rather than ditching the FM radio, I’ll use it for the output part – so, Raspberry Pi’s 3,5mm output as an input to the AUX IN of the FM radio, using its amplifier and speakers (switching to AUX input is just one click away, which is fine).

I started by preparing my Raspberry Pi:

downloaded Raspberry Pi Imager
used it to download and customize the Raspbian image (Raspberry PI OS (32-bit)):
- set hostname
- enabled SSH
- set username and password
- configured wireless LAN
- configured locale settings
booted my Raspberry Pi and did additional configuration via the included raspi-config utility:
- configured System Options – Boot/Auto Login – Console Autologin
- configured some other tiny things (like extending the storage, etc.)

Now it seems that I’m prepared for bringing up the “software part”.

After some reading and trying things out, I decided to go with VLC Player.

Now I just need to make it play what I want, play it on power on and without any other interaction.

Luckily, it’s not thaaat hard! 🙂

### check that you have your radio station's stream address (the right one)!
### i'll use https://audio.radio-banovina.hr:9998/stream, not https://www.radio-banovina.hr/uzivo/

# install all updates:
sudo apt update && sudo apt dist-upgrade -y

# install VLC (if not already):
sudo apt install vlc -y

# when I tried to play the stream, I got an error stating that the TLS certificate is not trusted
# so, I downloaded and copied CA (AlphaSSL CA - SHA256 - G2) and Root CA (GlobalSign Root CA) certificates into the /usr/local/share/ca-certificates/:
sudo cp *.crt /usr/local/share/ca-certificates/*

# and updated the certificates in use:
sudo update-ca-certificates

# that took care of the TLS error and stream could finally run:
vlc https://audio.radio-banovina.hr:9998/stream

### check that you have your radio station's stream address (the right one)!

### i'll use https://audio.radio-banovina.hr:9998/stream, not https://www.radio-banovina.hr/uzivo/

# install all updates:

sudo apt update && sudo apt dist-upgrade -y

# install VLC (if not already):

sudo apt install vlc -y

# when I tried to play the stream, I got an error stating that the TLS certificate is not trusted

# so, I downloaded and copied CA (AlphaSSL CA - SHA256 - G2) and Root CA (GlobalSign Root CA) certificates into the /usr/local/share/ca-certificates/:

sudo cp *.crt /usr/local/share/ca-certificates/*

# and updated the certificates in use:

sudo update-ca-certificates

# that took care of the TLS error and stream could finally run:

vlc https://audio.radio-banovina.hr:9998/stream

Great! That works if I manually start it… and there are no issues.

For the autostart part, I’m choosing to run it as a service, so:

### create the service file /etc/systemd/system/runRadio.service:
sudo nano /etc/systemd/system/runRadio.service

### inside the file, insert something like this:
[Unit]
Description=runRadio

[Service]
User=tomica
Environment="DISPLAY=:0"
ExecStartPre=/bin/sleep 30
ExecStart=/usr/bin/vlc -I dummy "https://audio.radio-banovina.hr:9998/stream"
WorkingDirectory=/home/tomica
Restart=always

[Install]
WantedBy=multi-user.target

### to register this service, I'm using standard commands:
sudo systemctl enable runRadio.service
sudo systemctl start runRadio.service
sudo systemctl status runRadio.service

### tips:
### - VLC shouldn't start with 'root', so this is why I'm using a user 'tomica'
### - -I dummy is something I learned during troubleshooting - it doesn't work (as a service) without specifying the correct (I)nterface!
### -  also, I'm using sleep 30 to make sure everything is up before starting a player (could be nicer, but... works!)

### create the service file /etc/systemd/system/runRadio.service:

sudo nano /etc/systemd/system/runRadio.service

### inside the file, insert something like this:

[Unit]

Description=runRadio

[Service]

User=tomica

Environment="DISPLAY=:0"

ExecStartPre=/bin/sleep 30

ExecStart=/usr/bin/vlc -I dummy "https://audio.radio-banovina.hr:9998/stream"

WorkingDirectory=/home/tomica

Restart=always

[Install]

WantedBy=multi-user.target

### to register this service, I'm using standard commands:

sudo systemctl enable runRadio.service

sudo systemctl start runRadio.service

sudo systemctl status runRadio.service

### tips:

### - VLC shouldn't start with 'root', so this is why I'm using a user 'tomica'

### - -I dummy is something I learned during troubleshooting - it doesn't work (as a service) without specifying the correct (I)nterface!

### - also, I'm using sleep 30 to make sure everything is up before starting a player (could be nicer, but... works!)

And… that’s it!

With a few hits and misses, there’s finally a simple wireless Internet radio, which starts playing once Raspberry Pi powers on (and connects to WiFi, and waits for 30 seconds, of course)! No more bad FM reception and the user is satisfied! 🙂

Cheers!

Using a self-hosted runner with GitHub Actions

By Tomica Kaniski in Other 17/10/2022 0 Comment

As I was going through the excellent short course called Azure Infrastructure as Code with GitHub (by fellow MVP, Barbara Forbes), a thought appeared – what do I need to do to use my custom runner machine inside a pipeline for… I don’t know… security/privacy concerns, isolation, special requirements, different OS, control, price… or just to complicate things a bit?

Of course, GitHub supports this and it’s called a self-hosted runner.

So, what do I need to do to use this self-hosted runner with my GitHub Actions?

It’s relatively simple – there is an application package, which will be installed on your runner machine, and which will listen for and eventually do all the work defined in your workflow!

But first, let’s introduce my environment.

I have a simple GitHub Action (workflow), which creates a simple storage account on my Azure environment (there is actually no need to convert Bicep to ARM before deployment, but it seemed cool 😀). It’s currently using the „ubuntu-latest“ runner, provided by GitHub… which has also all the needed components inside (like Azure CLI, Azure PowerShell, …).

And it works fine. When there is a push to my GitHub repository, GitHub Actions starts and does what is needed on my Azure environment via this workflow:

name: deploy-to-azure
on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

env:
  resourceGroupName: SimpleAzureRG

jobs:
  deploy-to-azure:
    runs-on: ubuntu-latest

    steps:
      - name: "Checkout the code from GitHub"
        uses: actions/checkout@v3

      - name: "Build Bicep code into ARM (JSON)"
        uses: Azure/cli@v1
        with:
          inlineScript: az bicep build --file ./main.bicep --outfile ./main.json

      - name: "Login to Azure"
        uses: Azure/login@v1.4.6
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      - name: "Create the resource group, if needed"
        uses: Azure/powershell@v1
        with:
          inlineScript: New-AzResourceGroup -Name ${{ env.resourceGroupName }} -location WestEurope -Force
          azPSVersion: latest

      - name: "Deploy the ARM template"
        uses: Azure/arm-deploy@v1.0.8
        with:
          scope: resourcegroup
          resourceGroupName: ${{ env.resourceGroupName }}
          template: main.json
          parameters: storageAccountPrefix=simplegh
          deploymentName: "gh${{ github.run_id }}"

on:

push:

branches: [ "main" ]

workflow_dispatch:

env:

resourceGroupName: SimpleAzureRG

jobs:

deploy-to-azure:

runs-on: ubuntu-latest

steps:

- name: "Checkout the code from GitHub"

uses: actions/checkout@v3

- name: "Build Bicep code into ARM (JSON)"

uses: Azure/cli@v1

with:

inlineScript: az bicep build --file ./main.bicep --outfile ./main.json

- name: "Login to Azure"

uses: Azure/[email protected]

with:

creds: ${{ secrets.AZURE_CREDENTIALS }}

enable-AzPSSession: true

- name: "Create the resource group, if needed"

uses: Azure/powershell@v1

with:

inlineScript: New-AzResourceGroup -Name ${{ env.resourceGroupName }} -location WestEurope -Force

azPSVersion: latest

- name: "Deploy the ARM template"

uses: Azure/[email protected]

with:

scope: resourcegroup

resourceGroupName: ${{ env.resourceGroupName }}

parameters: storageAccountPrefix=simplegh

deploymentName: "gh${{ github.run_id }}"

And the mighty Bicep file (😀) it’s using for the deployment is:

@maxLength(11)
param storageAccountPrefix string = 'bicep'
param location string = resourceGroup().location

var sta = '${storageAccountPrefix}${uniqueString(subscription().id)}'

resource storageaccount 'Microsoft.Storage/storageAccounts@2021-02-01' = {
  name: sta
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

@maxLength(11)

param storageAccountPrefix string = 'bicep'

param location string = resourceGroup().location

var sta = '${storageAccountPrefix}${uniqueString(subscription().id)}'

resource storageaccount 'Microsoft.Storage/storageAccounts@2021-02-01' = {

location: location

kind: 'StorageV2'

sku: {

}

Of course, this runs just fine on a standard (hosted) runner:

To run this workflow (successfully) not that much is needed.

First, I’ve created a new virtual machine (I’ll use a simple Ubuntu Hyper-V VM, no autoscaling, no… nothing) called hermes (god of speed 😀), with freshly installed Ubuntu 22.04.1-LTS (minimized).

After that, I went to the Settings of my GitHub repository and got the download and install scripts for the x64 Linux runner:

### get and install the runner application (script provided by GitHub)
## download the runner application
# create a runner folder
mkdir actions-runner && cd actions-runner

# download the latest runner package
curl -o actions-runner-linux-x64-2.298.2.tar.gz -L https://github.com/actions/runner/releases/download/v2.298.2/actions-runner-linux-x64-2.298.2.tar.gz

# (optional) validate the hash
echo "0bfd792196ce0ec6f1c65d2a9ad00215b2926ef2c416b8d97615265194477117  actions-runner-linux-x64-2.298.2.tar.gz" | shasum -a 256 -c

# extract the installer
tar xzf ./actions-runner-linux-x64-2.298.2.tar.gz


## configure the runner application
# create the runner and start the configuration experience
./config.sh --url https://github.com/TomicaKaniski/AzureIaCGH --token "<<--TOKEN_GOES_HERE!-->>"

# last step, run it! (we will actually run it via crontab at machine restart!)
# ./run.sh

### get and install the runner application (script provided by GitHub)

## download the runner application

# create a runner folder

mkdir actions-runner && cd actions-runner

# download the latest runner package

curl -o actions-runner-linux-x64-2.298.2.tar.gz -L https://github.com/actions/runner/releases/download/v2.298.2/actions-runner-linux-x64-2.298.2.tar.gz

# (optional) validate the hash

echo "0bfd792196ce0ec6f1c65d2a9ad00215b2926ef2c416b8d97615265194477117 actions-runner-linux-x64-2.298.2.tar.gz" | shasum -a 256 -c

# extract the installer

tar xzf ./actions-runner-linux-x64-2.298.2.tar.gz

## configure the runner application

# create the runner and start the configuration experience

./config.sh --url https://github.com/TomicaKaniski/AzureIaCGH --token "<<--TOKEN_GOES_HERE!-->>"

# last step, run it! (we will actually run it via crontab at machine restart!)

# ./run.sh

As you can see, I’ll be using crontab later to automatically (re)start my self-hosted runner.

If everything went well, you should see your runner “up and running” (😀) in the GitHub portal:

Next, I’ll use the following script to install all prerequisites for my workflow (like Azure CLI, Azure PowerShell, etc. – it really depends on your workflow and things you use):

### install (my) workflow prerequisites on self-runner machine
sudo su -

## install Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt)
curl -sL https://aka.ms/InstallAzureCLIDeb | bash

## install PowerShell  (https://learn.microsoft.com/en-us/powershell/scripting/install/install-ubuntu?view=powershell-7.2#installation-via-direct-download)
wget -q "https://github.com/PowerShell/PowerShell/releases/download/v7.2.6/powershell-lts_7.2.6-1.deb_amd64.deb" && dpkg -i powershell-lts_7.2.6-1.deb_amd64.deb

## install Bicep
az bicep install

## install other useful things
apt install apt-utils cron vim -y

## install Docker (https://cloudcone.com/docs/article/how-to-install-docker-on-ubuntu-22-04-20-04/)
# install prerequisites
apt install apt-transport-https curl gnupg-agent ca-certificates software-properties-common -y

# add GPG key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

# add repository
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable" -y

# install docker
apt install docker-ce docker-ce-cli containerd.io -y

# create docker group
newgrp docker
exit

# add current user (tomica) to docker group
sudo usermod -aG docker $USER

# configure Docker autostart
sudo systemctl enable docker
sudo systemctl restart docker
sudo systemctl status docker

## install Az module for PowerShell (https://learn.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-9.0.0)
pwsh
Install-Module Az -Repository PSGallery -Confirm:$false -Force
exit


### configure ./run.sh (GitHub runner application) to start automatically
crontab -e

# add the following line (uncommented, of course; and check if the path is right!):
# @reboot /home/tomica/actions-runner/run.sh

sudo reboot

### install (my) workflow prerequisites on self-runner machine

sudo su -

## install Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt)

curl -sL https://aka.ms/InstallAzureCLIDeb | bash

## install PowerShell (https://learn.microsoft.com/en-us/powershell/scripting/install/install-ubuntu?view=powershell-7.2#installation-via-direct-download)

wget -q "https://github.com/PowerShell/PowerShell/releases/download/v7.2.6/powershell-lts_7.2.6-1.deb_amd64.deb" && dpkg -i powershell-lts_7.2.6-1.deb_amd64.deb

## install Bicep

az bicep install

## install other useful things

apt install apt-utils cron vim -y

## install Docker (https://cloudcone.com/docs/article/how-to-install-docker-on-ubuntu-22-04-20-04/)

# install prerequisites

apt install apt-transport-https curl gnupg-agent ca-certificates software-properties-common -y

# add GPG key

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

# add repository

add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable" -y

# install docker

apt install docker-ce docker-ce-cli containerd.io -y

# create docker group

newgrp docker

exit

# add current user (tomica) to docker group

sudo usermod -aG docker $USER

# configure Docker autostart

sudo systemctl enable docker

sudo systemctl restart docker

sudo systemctl status docker

## install Az module for PowerShell (https://learn.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-9.0.0)

pwsh

Install-Module Az -Repository PSGallery -Confirm:$false -Force

exit

### configure ./run.sh (GitHub runner application) to start automatically

crontab -e

# add the following line (uncommented, of course; and check if the path is right!):

# @reboot /home/tomica/actions-runner/run.sh

sudo reboot

Once this is done, my self-hosted runner hermes should be ready to run the workflow.

To try this, I need to make a slight update to my workflow file – line 12 inside the job configuration should be updated from “runs-on: ubuntu-latest” to “runs-on: self-hosted“.

So, my workflow YAML file now looks like this:

name: deploy-to-azure
on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

env:
  resourceGroupName: SimpleAzureRG

jobs:
  deploy-to-azure:
    runs-on: self-hosted

    steps:
      - name: "Checkout the code from GitHub"
        uses: actions/checkout@v3

      - name: "Build Bicep code into ARM (JSON)"
        uses: Azure/cli@v1
        with:
          inlineScript: az bicep build --file ./main.bicep --outfile ./main.json

      - name: "Login to Azure"
        uses: Azure/login@v1.4.6
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      - name: "Create the resource group, if needed"
        uses: Azure/powershell@v1
        with:
          inlineScript: New-AzResourceGroup -Name ${{ env.resourceGroupName }} -location WestEurope -Force
          azPSVersion: latest

      - name: "Deploy the ARM template"
        uses: Azure/arm-deploy@v1.0.8
        with:
          scope: resourcegroup
          resourceGroupName: ${{ env.resourceGroupName }}
          template: main.json
          parameters: storageAccountPrefix=simplegh
          deploymentName: "gh${{ github.run_id }}"

on:

push:

branches: [ "main" ]

workflow_dispatch:

env:

resourceGroupName: SimpleAzureRG

jobs:

deploy-to-azure:

runs-on: self-hosted

steps:

- name: "Checkout the code from GitHub"

uses: actions/checkout@v3

- name: "Build Bicep code into ARM (JSON)"

uses: Azure/cli@v1

with:

inlineScript: az bicep build --file ./main.bicep --outfile ./main.json

- name: "Login to Azure"

uses: Azure/[email protected]

with:

creds: ${{ secrets.AZURE_CREDENTIALS }}

enable-AzPSSession: true

- name: "Create the resource group, if needed"

uses: Azure/powershell@v1

with:

inlineScript: New-AzResourceGroup -Name ${{ env.resourceGroupName }} -location WestEurope -Force

azPSVersion: latest

- name: "Deploy the ARM template"

uses: Azure/[email protected]

with:

scope: resourcegroup

resourceGroupName: ${{ env.resourceGroupName }}

parameters: storageAccountPrefix=simplegh

deploymentName: "gh${{ github.run_id }}"

And once I push the configuration to my GitHub, my workflow automatically starts and runs on hermes, my self-hosted runner:

If we prepared our runner right, all is good! 😊

Of course, our resources are deployed successfully:

So, this is how you can use your own, self-hosted runner, to execute your GitHub Actions (workflows).

Cheers!

Installing Azure ATP Sensor… failed with 0x80070643

By Tomica Kaniski in Other 08/10/2022 0 Comment

Another “short and sweet” one! 😀

I was installing a couple of Microsoft Defender for Identity (a.k.a. Azure Advanced Threat Protection, or Azure ATP) sensors, on Domain Controllers behind corporate proxies.

Everything went well on all of them… but the last one, of course!

Every other picked up the system proxy settings and installation went fine, but the last one failed… with a highly descriptive error saying “Installation failed. Error code: 0x80070643“:

It seems that this installation hasn’t picked up the system’s proxy settings (for whatever reason), and this information needed to be set manually during the installation.

So, after downloading and unpacking the Azure ATP Sensor installation, open Command Prompt (as Administrator, of course) and, from its folder, run this command (make sure you enter your proxy information and the right access key):

"Azure ATP Sensor Setup.exe" /quiet ProxyUrl="http://proxy.corporate.local:8080" NetFrameworkCommandLineArguments="/q" AccessKey="<<< MY WORKSPACE ACCESS KEY GOES HERE >>>"

1	"Azure ATP Sensor Setup.exe" /quiet ProxyUrl="http://proxy.corporate.local:8080" NetFrameworkCommandLineArguments="/q" AccessKey="<<< MY WORKSPACE ACCESS KEY GOES HERE >>>"

Hope it helps (helped me)! If it doesn’t, try reading this thread.

Cheers!

Fixing permissions for EC2 private key file

By Tomica Kaniski in Other 10/06/2022 0 Comment

This time, I was playing around with AWS and created some EC2 instances.

When you are creating and working with your instances, you will need to take care of the authentication – you would usually import or create new key pair and use private key on your machine to connect via SSH to the EC2 instance in AWS. The whole process of creating a key pair and downloading the private key is pretty simple – on the page below, you select name, type and format of your key pair and, when created, private key begins automatic download to your PC:

Now you can create your instance and select the created key pair for authentication:

If you have your private key ready and the instance is up and accessible to you, you can use (for example) SSH to connect to it:

So… we have a challenge! Looks like our private key is not secured enough and others may have access to it!

If we look at the permissions, we can see that all of them are actually inherited… so, we’ll need to remove the inheritance/inherited permissions and give them only to the account that needs it:

And after some “tweaking”:

If we retry the connection, this happens:

Excellent!

And if you’re not a fan of clicking through the permissions dialog, here are scripts that can help you with this – they basically remove the inheritance and add full access permissions to the owner of the file (needs path to your private key file as a parameter!):

the “PowerShell” flavour:

# script fixes permissions for a private key (PEM) file used to connect to EC2 instance
param (
    [Parameter(Mandatory)]
    [String] $file
)

$acl = Get-Acl -Path $file
$acl.SetAccessRuleProtection($true, $false) # disable inheritance, don't preserve existing rules
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($acl.Owner, "FullControl", "None", "None", "Allow") # allow only Full access for the file owner
$acl.SetAccessRule($rule)
Set-Acl -Path $file -AclObject $acl

# script fixes permissions for a private key (PEM) file used to connect to EC2 instance

param (

[Parameter(Mandatory)]

[String] $file

)

$acl = Get-Acl -Path $file

$acl.SetAccessRuleProtection($true, $false) # disable inheritance, don't preserve existing rules

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($acl.Owner, "FullControl", "None", "None", "Allow") # allow only Full access for the file owner

$acl.SetAccessRule($rule)

Set-Acl -Path $file -AclObject $acl

the “CMD” flavour:

@ECHO OFF
REM Script fixes permissions for a private key (PEM) file used to connect to EC2 instance
icacls.exe %1 /grant:r *S-1-3-0:(F) /inheritance:r

@ECHO OFF

REM Script fixes permissions for a private key (PEM) file used to connect to EC2 instance

icacls.exe %1 /grant:r *S-1-3-0:(F) /inheritance:r

Hope it helps!

Cheers!

P.S. Scripts are also available at my GitHub (https://github.com/TomicaKaniski/toms-notes-code/).

P.P.S. There’s also a script that restores inheritance and inherited permissions… in case you… mess something up. 😀

Playing around with Azure Stack HCI

By Tomica Kaniski in Other 27/03/2022 0 Comment

Decided to have some fun with (nested) Microsoft Azure Stack HCI in my lab.

If you want to do the same, I’ve scripted most the stuff you need, so… maybe it will be useful.

Steps to prepare a brand new, shiny, nested Azure Stack HCI lab are (roughly):

prepare your (parent) Windows Server 2022 Hyper-V host (ensure enough resources are available)
- it already hosts my Active Directory, DNS, DHCP, router, …, VMs
- everything will be saved locally to D:\AzureStackHCI
(optional) install Windows Admin Center (WAC) for easier management
- download it and install with simple command:

### install Windows Admin Center
Invoke-WebRequest 'https://aka.ms/WACDownload' -OutFile "D:\AzureStackHCI\WindowsAdminCenter2110.msi"
C:\Windows\System32\msiexec.exe /i "D:\AzureStackHCI\WindowsAdminCenter2110.msi" /qn /L*v "D:\AzureStackHCI\WindowsAdminCenter2110.log" SME_PORT=443 SSL_CERTIFICATE_OPTION=generate

### install Windows Admin Center

Invoke-WebRequest 'https://aka.ms/WACDownload' -OutFile "D:\AzureStackHCI\WindowsAdminCenter2110.msi"

C:\Windows\System32\msiexec.exe /i "D:\AzureStackHCI\WindowsAdminCenter2110.msi" /qn /L*v "D:\AzureStackHCI\WindowsAdminCenter2110.log" SME_PORT=443 SSL_CERTIFICATE_OPTION=generate

obtain the Azure Stack HCI 60-day trial ISO image from here
make VHD(X) from the obtained ISO image:

### check what's in the Azure Stack HCI ISO file
dism /Get-WimInfo /WimFile:E:\sources\install.wim
# Deployment Image Servicing and Management tool
# Version: 10.0.20348.1

# Details for image : E:\sources\install.wim

# Index : 1
# Name : Azure Stack HCI
# Description : This option installs Azure Stack HCI.
# Size : 7.996.171.122 bytes

# The operation completed successfully.

### convert ISO to VHDX
# https://github.com/x0nn/Convert-WindowsImage
$iso = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.iso"
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
Convert-WindowsImage -SourcePath $iso -VHDFormat "VHDX" -Edition "Azure Stack HCI" -SizeBytes 200GB -DiskLayout "UEFI" -VHDPath $vhd

### check what's in the Azure Stack HCI ISO file

dism /Get-WimInfo /WimFile:E:\sources\install.wim

# Deployment Image Servicing and Management tool

# Version: 10.0.20348.1

# Details for image : E:\sources\install.wim

# Index : 1

# Name : Azure Stack HCI

# Description : This option installs Azure Stack HCI.

# Size : 7.996.171.122 bytes

# The operation completed successfully.

### convert ISO to VHDX

# https://github.com/x0nn/Convert-WindowsImage

$iso = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.iso"

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

Convert-WindowsImage -SourcePath $iso -VHDFormat "VHDX" -Edition "Azure Stack HCI" -SizeBytes 200GB -DiskLayout "UEFI" -VHDPath $vhd

- note that I’m using Convert-WindowsImage.ps1 available here
- which gives me nice, generalized Azure Stack HCI VHD(X), which we will “upgrade with things” and later use for VM creation
install prerequisites into VHD(X)
- this one is fairly easy – install Windows roles and features directly to the VHD(X) itself:

### install Azure Stack HCI cluster prerequisites
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
$roles = @(
    "BitLocker",
    "Data-Center-Bridging",
    "EnhancedStorage",
    "Failover-Clustering",
    "FS-FileServer",
    "FS-Data-Deduplication",
    "Hyper-V",
    "Hyper-V-PowerShell",
    "NetworkATC",
    "RSAT-AD-PowerShell",
    "RSAT-Clustering-PowerShell",
    "Storage-Replica"
)
Install-WindowsFeature -Vhd $vhd -Name $roles -IncludeAllSubFeature -IncludeManagementTools

### install Azure Stack HCI cluster prerequisites

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

$roles = @(

"BitLocker",

"Data-Center-Bridging",

"EnhancedStorage",

"Failover-Clustering",

"FS-FileServer",

"FS-Data-Deduplication",

"Hyper-V",

"Hyper-V-PowerShell",

"NetworkATC",

"RSAT-AD-PowerShell",

"RSAT-Clustering-PowerShell",

"Storage-Replica"

)

Install-WindowsFeature -Vhd $vhd -Name $roles -IncludeAllSubFeature -IncludeManagementTools

- NOTE: If you try to install the Hyper-V role later, it may fail as we’re running Azure Stack HCI on “normal” Windows Server, so it get’s confused with nested virtualization availability. With preinstaling it, we make sure it just works.
update VHD(X) with latest patches:

### install Windows updates (into an offline VHDX image)
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
$packages = "D:\AzureStackHCI\Updates"
# mount image
$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
# install updates from folder
Add-WindowsPackage -Path "$(([string]$drive).Trim()):\" -PackagePath $packages -IgnoreCheck
# dismount image
Dismount-Vhd -Path $vhd

### install Windows updates (into an offline VHDX image)

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

$packages = "D:\AzureStackHCI\Updates"

# mount image

$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter

# install updates from folder

Add-WindowsPackage -Path "$(([string]$drive).Trim()):\" -PackagePath $packages -IgnoreCheck

# dismount image

Dismount-Vhd -Path $vhd

- I have previously downloaded all the Azure Stack HCI patches available to D:\AzureStackHCI\Updates
add Unattend.xml to handle the “set password at first login issue”
- it annoys me that I need to set up the initial password, so… simple Unattend.xml file, injected into VHD(X) should take care of this:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <UserAccounts>
                <AdministratorPassword>
                    <Value>UABAAHMAcwB3ADAAcgBkACEAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBQAGEAcwBzAHcAbwByAGQA</Value>
                    <PlainText>false</PlainText>
                </AdministratorPassword>
            </UserAccounts>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:c:/sources/install.wim#Azure Stack HCI SERVERAZURESTACKHCICORE" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

<?xml version="1.0" encoding="utf-8"?>

<Value>UABAAHMAcwB3ADAAcgBkACEAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBQAGEAcwBzAHcAbwByAGQA</Value>

<PlainText>false</PlainText>

</AdministratorPassword>

</UserAccounts>

</component>

</settings>

<cpi:offlineImage cpi:source="wim:c:/sources/install.wim#Azure Stack HCI SERVERAZURESTACKHCICORE" xmlns:cpi="urn:schemas-microsoft-com:cpi" />

</unattend>

### inject Unattend.xml (into an offline VHDX image)
$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"
# mount image
$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
# inject Unattend.xml
Copy-Item -Path ".\Unattend.xml" -Destination "$(([string]$drive).Trim()):\"
# dismount image
Dismount-Vhd -Path $vhd

### inject Unattend.xml (into an offline VHDX image)

$vhd = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

# mount image

$drive = (Mount-VHD -Path $vhd -PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter

# inject Unattend.xml

Copy-Item -Path ".\Unattend.xml" -Destination "$(([string]$drive).Trim()):\"

# dismount image

Dismount-Vhd -Path $vhd

- NOTE: Make sure you don’t use clear-text passwords in Unattend.xml file!
create Azure Stack HCI VMs
- I’m creating two VMs from our prepared VHD(X), with a couple of additional data disks, few network adapters for different purposes, nested virtualization enabled, etc.:

### create vms
$vms = "AZS1", "AZS2"
foreach ($vm in $vms) {
    # prepare paths
    $vmpath = "D:\AzureStackHCI\VMs"
    $vhd = "D:\AzureStackHCI\VMs\$vm\Virtual Hard Disks\$vm"
    $vhdt = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

    # prepare folders
    New-Item -Name $vm -Type Directory -Path $vmpath -Force
    New-Item -Name "Virtual Machines" -Type Directory -Path "$vmpath\$vm" -Force
    New-Item -Name "Virtual Hard Disks" -Type Directory -Path "$vmpath\$vm" -Force
    
    # copy boot disk
    Copy-Item -Path $vhdt -Destination "$($vhd)_0.vhdx"

    # create vm
    New-VM -Name $vm -MemoryStartupBytes 64GB -VHDPath "$($vhd)_0.vhdx" -SwitchName Corporate -Generation 2 -Path $vmpath
    Set-VM -VMName $vm -AutomaticStartAction Nothing -AutomaticStopAction ShutDown -CheckpointType Standard
    Set-VMProcessor -VMName $vm -Count 16 -ExposeVirtualizationExtensions $true
    New-VHD -Path "$($vhd)_1.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_1.vhdx"
    New-VHD -Path "$($vhd)_2.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_2.vhdx"
    New-VHD -Path "$($vhd)_3.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_3.vhdx"
    New-VHD -Path "$($vhd)_4.vhdx" -SizeBytes 480GB -Dynamic
    Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_4.vhdx"
    Rename-VMNetworkAdapter -VMName $vm -NewName "Corporate"
    Set-VMNetworkAdapter -VMName $vm -Name "Corporate" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "Storage_1" -SwitchName "Storage_1" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "Storage_2" -SwitchName "Storage_2" -DeviceNaming "On"
    Add-VMNetworkAdapter -VMName $vm -Name "VM" -SwitchName "Corporate" -DeviceNaming "On"
    Set-VMNetworkAdapter -VMName $vm -Name "VM" -MacAddressSpoofing "On"
    Set-VMFirmware -VMName $vm -BootOrder (Get-VMHardDiskDrive -VMName $vm -ControllerNumber 0 -ControllerLocation 0)
    Start-VM -VMName $vm
}

### create vms

$vms = "AZS1", "AZS2"

foreach ($vm in $vms) {

# prepare paths

$vmpath = "D:\AzureStackHCI\VMs"

$vhd = "D:\AzureStackHCI\VMs\$vm\Virtual Hard Disks\$vm"

$vhdt = "D:\AzureStackHCI\AzureStackHCI_20348.288_en-us.vhdx"

# prepare folders

New-Item -Name $vm -Type Directory -Path $vmpath -Force

New-Item -Name "Virtual Machines" -Type Directory -Path "$vmpath\$vm" -Force

New-Item -Name "Virtual Hard Disks" -Type Directory -Path "$vmpath\$vm" -Force

# copy boot disk

Copy-Item -Path $vhdt -Destination "$($vhd)_0.vhdx"

# create vm

New-VM -Name $vm -MemoryStartupBytes 64GB -VHDPath "$($vhd)_0.vhdx" -SwitchName Corporate -Generation 2 -Path $vmpath

Set-VM -VMName $vm -AutomaticStartAction Nothing -AutomaticStopAction ShutDown -CheckpointType Standard

Set-VMProcessor -VMName $vm -Count 16 -ExposeVirtualizationExtensions $true

New-VHD -Path "$($vhd)_1.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_1.vhdx"

New-VHD -Path "$($vhd)_2.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_2.vhdx"

New-VHD -Path "$($vhd)_3.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_3.vhdx"

New-VHD -Path "$($vhd)_4.vhdx" -SizeBytes 480GB -Dynamic

Add-VMHardDiskDrive -VMName $vm -Path "$($vhd)_4.vhdx"

Rename-VMNetworkAdapter -VMName $vm -NewName "Corporate"

Set-VMNetworkAdapter -VMName $vm -Name "Corporate" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "Storage_1" -SwitchName "Storage_1" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "Storage_2" -SwitchName "Storage_2" -DeviceNaming "On"

Add-VMNetworkAdapter -VMName $vm -Name "VM" -SwitchName "Corporate" -DeviceNaming "On"

Set-VMNetworkAdapter -VMName $vm -Name "VM" -MacAddressSpoofing "On"

Set-VMFirmware -VMName $vm -BootOrder (Get-VMHardDiskDrive -VMName $vm -ControllerNumber 0 -ControllerLocation 0)

Start-VM -VMName $vm

}

set node networking, join them to the domain, prepare for cluster (by using PowerShell Direct):

### customize AZS1
# set networking
$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"
Enter-PSSession -VMName "AZS1" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name
$adapters = "Corporate", "Storage_1", "Storage_2", "VM"
foreach ($adapter in $adapters) {
    Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter
}

# set IP addresses (AZS1)
$ia = "Corporate"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.51" -PrefixLength "24" -DefaultGateway "192.168.111.1"
Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"
Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"
Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works
$dc = Resolve-DnsName "DOM1"
Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS1)
$ia = "Storage_1"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "Storage_2"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "VM"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.1" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance
(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:
Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone
Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
Install-Module PSWindowsUpdate

# domain join
Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS1" -Restart -Force

## additional settings
$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"
Enter-PSSession -VMName "AZS1" -Credential $domainadmin

# disable SConfig on login
Set-SConfig -AutoLaunch $false

# Windows Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS1

# set networking

$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"

Enter-PSSession -VMName "AZS1" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name

$adapters = "Corporate", "Storage_1", "Storage_2", "VM"

foreach ($adapter in $adapters) {

Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter

}

# set IP addresses (AZS1)

$ia = "Corporate"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.51" -PrefixLength "24" -DefaultGateway "192.168.111.1"

Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"

Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"

Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works

$dc = Resolve-DnsName "DOM1"

Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS1)

$ia = "Storage_1"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "Storage_2"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "VM"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.1" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance

(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:

Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone

Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

Install-Module PSWindowsUpdate

# domain join

Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS1" -Restart -Force

## additional settings

$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"

Enter-PSSession -VMName "AZS1" -Credential $domainadmin

# disable SConfig on login

Set-SConfig -AutoLaunch $false

# Windows Update

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS2
# set networking
$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"
Enter-PSSession -VMName "AZS2" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name
$adapters = "Corporate", "Storage_1", "Storage_2", "VM"
foreach ($adapter in $adapters) {
    Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter
}

# set IP addresses (AZS2)
$ia = "Corporate"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.52" -PrefixLength "24" -DefaultGateway "192.168.111.1"
Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"
Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"
Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works
$dc = Resolve-DnsName "DOM1"
Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS2)
$ia = "Storage_1"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "Storage_2"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false
$ia = "VM"
New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.2" -PrefixLength "30"
Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance
(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:
Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone
Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted
Install-Module PSWindowsUpdate

# domain join
Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS2" -Restart -Force

## additional settings
$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"
Enter-PSSession -VMName "AZS2" -Credential $domainadmin

# disable SConfig on login
Set-SConfig -AutoLaunch $false

# Windows Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

### customize AZS2

# set networking

$localAdmin = Get-Credential -UserName "AZSx\Administrator" -Message "Enter password for the local Administrator account:"

Enter-PSSession -VMName "AZS2" -Credential $localAdmin

# rename network adapters per Hyper-V adapter name

$adapters = "Corporate", "Storage_1", "Storage_2", "VM"

foreach ($adapter in $adapters) {

Get-NetAdapterAdvancedProperty -RegistryKeyword HyperVNetworkAdapterName | Where-Object { $_.DisplayValue -eq $adapter } | Rename-NetAdapter -NewName $adapter

}

# set IP addresses (AZS2)

$ia = "Corporate"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "192.168.111.52" -PrefixLength "24" -DefaultGateway "192.168.111.1"

Set-DnsClientServerAddress -InterfaceAlias $ia -ServerAddresses "192.168.111.5"

Set-DnsClient -InterfaceAlias $ia -ConnectionSpecificSuffix "lab.tklabs.eu"

Set-NetIPInterface -InterfaceAlias $ia -InterfaceMetric 1

# test if it works

$dc = Resolve-DnsName "DOM1"

Test-NetConnection $dc.IPAddress

# set other IP addresses (AZS2)

$ia = "Storage_1"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.111.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "Storage_2"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.112.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

$ia = "VM"

New-NetIPAddress -InterfaceAlias $ia -IPAddress "10.111.113.2" -PrefixLength "30"

Set-DnsClient -InterfaceAlias $ia -RegisterThisConnectionsAddress $false

# enable RDP

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Power Options - High Performance

(Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'High Performance'").Activate()

# Rename C:

Set-Volume -DriveLetter "C" -NewFileSystemLabel "OSDisk"

# timezone

Set-Timezone "Central European Standard Time"

# Windows Update PowerShell module

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

Install-Module PSWindowsUpdate

# domain join

Add-Computer -DomainName "lab.tklabs.eu" -Credential "LAB\Administrator" -NewName "AZS2" -Restart -Force

## additional settings

$domainadmin = Get-Credential -UserName "LAB\Administrator" -Message "Enter password for the domain Administrator account:"

Enter-PSSession -VMName "AZS2" -Credential $domainadmin

# disable SConfig on login

Set-SConfig -AutoLaunch $false

# Windows Update

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

create the Azure Stack HCI cluster:

### create Azure Stack HCI cluster
# prepare and clean disks
$servers = "AZS1", "AZS2"
$cluster = "AzSCluster"
$clusterIp = "192.168.111.50/24"

Invoke-Command ($servers) {
    Update-StorageProviderCache
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Set-StoragePool -IsReadOnly:$false -ErrorAction SilentlyContinue
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Get-VirtualDisk | Remove-VirtualDisk -Confirm:$false -ErrorAction SilentlyContinue
    Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Remove-StoragePool -Confirm:$false -ErrorAction SilentlyContinue
    Get-PhysicalDisk | Reset-PhysicalDisk -ErrorAction SilentlyContinue
    Get-Disk | Where-Object { $_.Number -ne $null } | Where-Object { $_.IsBoot -ne $true } | Where-Object { $_.IsSystem -ne $true } | Where-Object { $_.PartitionStyle -ne "RAW" } | ForEach-Object {
        $_ | Set-Disk -IsOffline:$false
        $_ | Set-Disk -IsReadOnly:$false
        $_ | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false
        $_ | Set-Disk -IsReadOnly:$true
        $_ | Set-Disk -IsOffline:$true
    }
    Get-Disk | Where-Object { $_.Number -ne $Null } | Where-Object { $_.IsBoot -ne $True } | Where-Object { $_.IsSystem -ne $True } | Where-Object { $_.PartitionStyle -eq "RAW" } | Group-Object -NoElement -Property "FriendlyName"
} | Sort-Object -Property "PsComputerName", "Count"
# Count Name                      PSComputerName
# ----- ----                      --------------
#     4 Msft Virtual Disk         AZS1
#     4 Msft Virtual Disk         AZS2

# check if cluster can be created
Test-Cluster -Node $servers -Include "Storage Spaces Direct", "Inventory", "Network", "System Configuration"

# create cluster
New-Cluster -Name $cluster -Node $servers -StaticAddress $clusterIp -NoStorage

# check cluster
Get-Cluster -Name $cluster | Get-ClusterResource
# Name                        State  OwnerGroup    ResourceType
# ----                        -----  ----------    ------------
# Cluster IP Address          Online Cluster Group IP Address
# Cluster Name                Online Cluster Group Network Name
# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

# set cluster quorum (file share witness)
Set-ClusterQuorum -Cluster $cluster -FileShareWitness "\\DOM1.lab.tklabs.eu\Witness_AZSCluster$"
# Cluster              QuorumResource
# -------              --------------
# AzSCluster           File Share Witness

Get-Cluster -Name $cluster | Get-ClusterResource
# Name                        State  OwnerGroup    ResourceType
# ----                        -----  ----------    ------------
# Cluster IP Address          Online Cluster Group IP Address
# Cluster Name                Online Cluster Group Network Name
# File Share Witness          Online Cluster Group File Share Witness
# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

### create Azure Stack HCI cluster

# prepare and clean disks

$servers = "AZS1", "AZS2"

$cluster = "AzSCluster"

$clusterIp = "192.168.111.50/24"

Invoke-Command ($servers) {

Update-StorageProviderCache

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Set-StoragePool -IsReadOnly:$false -ErrorAction SilentlyContinue

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Get-VirtualDisk | Remove-VirtualDisk -Confirm:$false -ErrorAction SilentlyContinue

Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false } | Remove-StoragePool -Confirm:$false -ErrorAction SilentlyContinue

Get-PhysicalDisk | Reset-PhysicalDisk -ErrorAction SilentlyContinue

Get-Disk | Where-Object { $_.Number -ne $null } | Where-Object { $_.IsBoot -ne $true } | Where-Object { $_.IsSystem -ne $true } | Where-Object { $_.PartitionStyle -ne "RAW" } | ForEach-Object {

$_ | Set-Disk -IsOffline:$false

$_ | Set-Disk -IsReadOnly:$false

$_ | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false

$_ | Set-Disk -IsReadOnly:$true

$_ | Set-Disk -IsOffline:$true

}

Get-Disk | Where-Object { $_.Number -ne $Null } | Where-Object { $_.IsBoot -ne $True } | Where-Object { $_.IsSystem -ne $True } | Where-Object { $_.PartitionStyle -eq "RAW" } | Group-Object -NoElement -Property "FriendlyName"

} | Sort-Object -Property "PsComputerName", "Count"

# Count Name PSComputerName

# ----- ---- --------------

# 4 Msft Virtual Disk AZS1

# 4 Msft Virtual Disk AZS2

# check if cluster can be created

Test-Cluster -Node $servers -Include "Storage Spaces Direct", "Inventory", "Network", "System Configuration"

# create cluster

New-Cluster -Name $cluster -Node $servers -StaticAddress $clusterIp -NoStorage

# check cluster

Get-Cluster -Name $cluster | Get-ClusterResource

# Name State OwnerGroup ResourceType

# ---- ----- ---------- ------------

# Cluster IP Address Online Cluster Group IP Address

# Cluster Name Online Cluster Group Network Name

# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

# set cluster quorum (file share witness)

Set-ClusterQuorum -Cluster $cluster -FileShareWitness "\\DOM1.lab.tklabs.eu\Witness_AZSCluster$"

# Cluster QuorumResource

# ------- --------------

# AzSCluster File Share Witness

Get-Cluster -Name $cluster | Get-ClusterResource

# Name State OwnerGroup ResourceType

# ---- ----- ---------- ------------

# Cluster IP Address Online Cluster Group IP Address

# Cluster Name Online Cluster Group Network Name

# File Share Witness Online Cluster Group File Share Witness

# Virtual Machine Cluster WMI Online Cluster Group Virtual Machine Cluster WMI

### https://docs.microsoft.com/en-us/azure-stack/hci/deploy/register-with-azure
# prerequisites
Install-Module -Name "Az.StackHCI" -Force -Confirm:$false

# registration
Register-AzStackHCI -SubscriptionId "<your_Azure_subscription_ID>" -ResourceGroupName "AzureStackHCI"
# WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code DW84XWSHV to authenticate.
# WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph. Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.

# Result                          : Success
# AzurePortalResourceURL          : https://portal.azure.com/#@<some_resource_ID>/resource/subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster/overview
# AzureResourceId                 : /Subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster
# AzurePortalAADAppPermissionsURL : https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/<some_App_ID>/isMSAApp/
# Details                         : Azure Stack HCI is successfully registered. An Azure resource representing Azure Stack HCI has been created in your Azure subscription to enable an Azure-consistent monitoring, billing, and support experience.

### https://docs.microsoft.com/en-us/azure-stack/hci/deploy/register-with-azure

# prerequisites

Install-Module -Name "Az.StackHCI" -Force -Confirm:$false

# registration

# WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code DW84XWSHV to authenticate.

# WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph. Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.

# Result : Success

# AzurePortalResourceURL : https://portal.azure.com/#@<some_resource_ID>/resource/subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster/overview

# AzureResourceId : /Subscriptions/<your_Azure_subscription_ID>/resourceGroups/AzureStackHCI/providers/Microsoft.AzureStackHCI/clusters/AzSCluster

# AzurePortalAADAppPermissionsURL : https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/<some_App_ID>/isMSAApp/

# Details : Azure Stack HCI is successfully registered. An Azure resource representing Azure Stack HCI has been created in your Azure subscription to enable an Azure-consistent monitoring, billing, and support experience.

create CSV(s) and virtual switches for child workloads (but add nodes/cluster to WAC before, if not using PowerShell)
- NOTE: I’m not using intent-based networking at this time. Nor SDN.

play around with your new cluster
(optional) clean all/redeploy if needed:

### cleanup script
Get-VM "AZS*" | Stop-VM -TurnOff -Force
Remove-VM "AZS*" -Force
Remove-Item "D:\AzureStackHCI\VMs\AZS*" -Force -Recurse

### cleanup script

Get-VM "AZS*" | Stop-VM -TurnOff -Force

Remove-VM "AZS*" -Force

Remove-Item "D:\AzureStackHCI\VMs\AZS*" -Force -Recurse

And now you have fully functional, nested, 2-node Azure Stack HCI cluster – nothing too fancy, but you can extend it how you wish! 😊

You can begin exploring the Azure Stack HCI itself, use it with Azure Arc, or perhaps install AKS on Azure Stack HCI and play around with it. Or something else.

Cheers!

P.S. You can use these scripts also for stuff other than Azure Stack HCI, of course! 😉
P.P.S. Code is also available on my GitHub page.

Create a self-signed certificate for your web server with PowerShell

By Tomica Kaniski in Other 28/01/2022 0 Comment

Sometimes you may need SSL certificate just for testing your (local) web application. Of course, for public and trusted purposes, you’ll probably use free Let’s Encrypt certificate or something similar (or, of course, any of the paid options).

And this is OK as long as you have publicly resolvable domain name.

But what if you need certificate for, let’s say, “localhost” or “webserver.local”?

Then you’ll probably use your internal PKI infrastructure or a simple self-signed certificate.

Second one can be easily achieved with PowerShell, by using the New-SelfSignedCertificate cmdlet (or with OpenSSL, yes 🙂).

So, let me show you how.

We have a simple IIS setup hosting a single (default) website, responding to http://localhost/:

We’ll issue a new self-signed certificate, make it trusted (important!) and then attach it to our test website, with following:

# create your self-signed certificate for 'localhost', stored in Computer store and valid for 2 years
$selfCert = New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(2)
# Thumbprint                                Subject
# ----------                                -------
# 2CE1566A7F73D6974F5378C76759F23473434863  CN=localhost

# make this certificate trusted (locally) (i.e. copy it from Personal store to Trusted Root CAs store)
$srcStore = New-Object System.Security.Cryptography.X509Certificates.X509Store "My", "LocalMachine"
$srcStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly)

$cert = $srcStore.certificates -match $selfCert.Thumbprint

$dstStore = New-Object System.Security.Cryptography.X509Certificates.X509Store "Root", "LocalMachine"
$dstStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$dstStore.Add($cert[0])

$srcStore.Close()
$dstStore.Close()

# bind this certificate to our IIS website
New-IISSiteBinding -Name "Default Web Site" -BindingInformation "*:443:" -CertificateThumbPrint $selfCert.Thumbprint -CertStoreLocation "Cert:\LocalMachine\My" -Protocol https

# create your self-signed certificate for 'localhost', stored in Computer store and valid for 2 years

$selfCert = New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(2)

# Thumbprint Subject

# ---------- -------

# 2CE1566A7F73D6974F5378C76759F23473434863 CN=localhost

# make this certificate trusted (locally) (i.e. copy it from Personal store to Trusted Root CAs store)

$srcStore = New-Object System.Security.Cryptography.X509Certificates.X509Store "My", "LocalMachine"

$srcStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly)

$cert = $srcStore.certificates -match $selfCert.Thumbprint

$dstStore = New-Object System.Security.Cryptography.X509Certificates.X509Store "Root", "LocalMachine"

$dstStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)

$dstStore.Add($cert[0])

$srcStore.Close()

$dstStore.Close()

# bind this certificate to our IIS website

New-IISSiteBinding -Name "Default Web Site" -BindingInformation "*:443:" -CertificateThumbPrint $selfCert.Thumbprint -CertStoreLocation "Cert:\LocalMachine\My" -Protocol https

If everything goes well, we will see another binding created in our IIS console:

And if we open https://localhost/, all should be good as well:

Cheers!

Add a route to your VPN connection via PowerShell

By Tomica Kaniski in Other 12/01/2022 2 Comments

I’m sure that you’re using some VPN somewhere, and you’re having “trouble” with split tunneling and routing, right?

Well, I had. 😀

As I’m “here and there” most of the time, I’ve setup an “anchor” location (no, it’s not in the cloud… yet) which is always available via VPN, and which has few machines that I’m, more or less, using regularly. When I’m not there, I connect there via my precious Windows 10/11 laptop and work as I’m there locally. I know – you know what VPNs are used for… bear with me a bit longer. 😀

So, all good – I have a VPN client (Windows built-in), a VPN server and Internet connection, and I can work.

One thing that I like to have is Internet access which is not routed via my “anchor” location, so that “the work stuff” goes through VPN and “the fun stuff” not.

It’s really easy to set this up – in properties of your VPN connection, just untick the “Use default gateway on remote network” checkbox:

But then you’ll have an issue with connecting to “the work stuff” – your current default gateway doesn’t know where “the work stuff” network is and how to get there.

It needs a route.

No problem, it’s easy to add a route in Windows (my “the work stuff” network is 192.168.13.0/24 and my VPN gateway is 192.168.14.1, or publicly 141.138.55.154):

route add 192.168.13.0 mask 255.255.255.0 192.168.14.1

1	route add 192.168.13.0 mask 255.255.255.0 192.168.14.1

And now you have access to “the work stuff” network again! And Internet access works as it should (not via the “anchor” location)!

Great.

But then you disconnect. And reconnect. And route you’ve added is gone. So, you repeat the procedure. Or script it. Or…

What if I tell you there is actually a better way?

I’m not really sure in which release this came out, but now you have an updated set of PowerShell cmdlets in (Windows 10/11) (which is cool!). For this story, the one we’re interested the most is Add-VpnConnectionRoute.

“So, doest that mean that, with it, I can configure my VPN connection to always have the route I need, whenever I connect to VPN? No more adding routes manually?!”

Exactly.

If I use the discussed Add-VpnConnectionRoute on my existing VPN connection, I can add the route I need and it will be written in the connection configuration and made active when the tunnel comes up, while still using the split tunneling.

Let’s see:

connected to “the work stuff” VPN and this is (part of) routing table prior the route configuration:

C:\> route print
===========================================================================
Interface List
...
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.12.1   192.168.12.247     35
...
     192.168.12.0    255.255.255.0         On-link    192.168.12.247    291
   192.168.12.247  255.255.255.255         On-link    192.168.12.247    291
   192.168.12.255  255.255.255.255         On-link    192.168.12.247    291
...
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link    192.168.12.247    291
...
===========================================================================
Persistent Routes:
  None
...

C:\> route print

===========================================================================

Interface List

...

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.12.1 192.168.12.247 35

...

192.168.12.0 255.255.255.0 On-link 192.168.12.247 291

192.168.12.247 255.255.255.255 On-link 192.168.12.247 291

192.168.12.255 255.255.255.255 On-link 192.168.12.247 291

...

255.255.255.255 255.255.255.255 On-link 127.0.0.1 331

255.255.255.255 255.255.255.255 On-link 192.168.12.247 291

...

===========================================================================

Persistent Routes:

None

...

adding route configuration:

Add-VpnConnectionRoute -ConnectionName "MyWorkStuff" -DestinationPrefix "192.168.13.0/24" -RouteMetric 1

1	Add-VpnConnectionRoute -ConnectionName "MyWorkStuff" -DestinationPrefix "192.168.13.0/24" -RouteMetric 1

checking routes again:

C:\> route print
===========================================================================
Interface List
...
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.12.1   192.168.12.247     35
...
    141.138.55.154 255.255.255.255     192.168.12.1   192.168.12.247     36
...
     192.168.12.0    255.255.255.0         On-link    192.168.12.247    291
   192.168.12.247  255.255.255.255         On-link    192.168.12.247    291
   192.168.12.255  255.255.255.255         On-link    192.168.12.247    291
     192.168.13.0    255.255.255.0         On-link     192.168.14.14     36
   192.168.13.255  255.255.255.255         On-link     192.168.14.14    291
     192.168.14.0    255.255.255.0     192.168.14.1    192.168.14.14     36
    192.168.14.14  255.255.255.255         On-link     192.168.14.14    291
...
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link    192.168.12.247    291
...
===========================================================================
Persistent Routes:
  None
...

C:\> route print

===========================================================================

Interface List

...

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.12.1 192.168.12.247 35

...

141.138.55.154 255.255.255.255 192.168.12.1 192.168.12.247 36

...

192.168.12.0 255.255.255.0 On-link 192.168.12.247 291

192.168.12.247 255.255.255.255 On-link 192.168.12.247 291

192.168.12.255 255.255.255.255 On-link 192.168.12.247 291

192.168.13.0 255.255.255.0 On-link 192.168.14.14 36

192.168.13.255 255.255.255.255 On-link 192.168.14.14 291

192.168.14.0 255.255.255.0 192.168.14.1 192.168.14.14 36

192.168.14.14 255.255.255.255 On-link 192.168.14.14 291

...

255.255.255.255 255.255.255.255 On-link 127.0.0.1 331

255.255.255.255 255.255.255.255 On-link 192.168.12.247 291

...

===========================================================================

Persistent Routes:

None

...

As you can see, I’ve got new routes in my route table (it would be the same by using route add command above) and now I can access “the work stuff” without any issue:

And if I disconnect and connect again – it still works! 😊

Hope it helps someone!

Cheers!

Checking certificate expiration with PowerShell

By Tomica Kaniski in Other 05/01/2022 4 Comments

Had an idea to write some (PowerShell) script which will check and maybe notify me of certificates that are nearing expiration for a bunch of (public) sites that… somewhat matter to me. 😊

As it turns out, someone already had this idea and wrote very nice PowerShell script that does just that, available here – thank you!

While testing it, there were sites on which the script worked just fine, and there were sites on which I got errors like this one (Error: “String was not recognized as a valid DateTime.”):

# Exception while checking URL https://blog.kaniski.eu: Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"
# Cannot convert value "26.4.2022. 1:59:59" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
# At line:17 char:5
#      +     [datetime]$expiration = $req.ServicePoint.Certificate.GetExpirati ...
#      +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#      + CategoryInfo          : MetadataError: (:) [], ArgumentTransformationMetadataException
#      + FullyQualifiedErrorId : RuntimeException

# Exception while checking URL https://blog.kaniski.eu: Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"

# Cannot convert value "26.4.2022. 1:59:59" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."

# At line:17 char:5

# + [datetime]$expiration = $req.ServicePoint.Certificate.GetExpirati ...

# + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# + CategoryInfo : MetadataError: (:) [], ArgumentTransformationMetadataException

# + FullyQualifiedErrorId : RuntimeException

Seems to be connected to my regional settings (I know… who would ever use hr-HR instead of en-US, but… 😊) and date/time formatting:

PS C:\> (Get-Culture).DateTimeFormat
# AMDesignator                     :
# Calendar                         : System.Globalization.GregorianCalendar
# DateSeparator                    : .
# FirstDayOfWeek                   : Monday
# CalendarWeekRule                 : FirstDay
# FullDateTimePattern              : d. MMMM yyyy. H:mm:ss
# LongDatePattern                  : d. MMMM yyyy.
# LongTimePattern                  : H:mm:ss
# MonthDayPattern                  : d. MMMM
# PMDesignator                     :
# RFC1123Pattern                   : ddd, dd MMM yyyy HH':'mm':'ss 'GMT'
# ShortDatePattern                 : d.M.yyyy.
# ShortTimePattern                 : H:mm
# SortableDateTimePattern          : yyyy'-'MM'-'dd'T'HH':'mm':'ss
# TimeSeparator                    : :
# UniversalSortableDateTimePattern : yyyy'-'MM'-'dd HH':'mm':'ss'Z'
# YearMonthPattern                 : MMMM, yyyy
# AbbreviatedDayNames              : {ned, pon, uto, sri...}
# ShortestDayNames                 : {ne, po, ut, sr...}
# DayNames                         : {nedjelja, ponedjeljak, utorak, srijeda...}
# AbbreviatedMonthNames            : {sij, vlj, ožu, tra...}
# MonthNames                       : {siječanj, veljača, ožujak, travanj...}
# IsReadOnly                       : False
# NativeCalendarName               : gregorijanski kalendar
# AbbreviatedMonthGenitiveNames    : {sij, vlj, ožu, tra...}
# MonthGenitiveNames               : {siječnja, veljače, ožujka, travnja...}

PS C:\> (Get-Culture).DateTimeFormat

# AMDesignator :

# Calendar : System.Globalization.GregorianCalendar

# DateSeparator : .

# FirstDayOfWeek : Monday

# CalendarWeekRule : FirstDay

# FullDateTimePattern : d. MMMM yyyy. H:mm:ss

# LongDatePattern : d. MMMM yyyy.

# LongTimePattern : H:mm:ss

# MonthDayPattern : d. MMMM

# PMDesignator :

# RFC1123Pattern : ddd, dd MMM yyyy HH':'mm':'ss 'GMT'

# ShortDatePattern : d.M.yyyy.

# ShortTimePattern : H:mm

# SortableDateTimePattern : yyyy'-'MM'-'dd'T'HH':'mm':'ss

# TimeSeparator : :

# UniversalSortableDateTimePattern : yyyy'-'MM'-'dd HH':'mm':'ss'Z'

# YearMonthPattern : MMMM, yyyy

# AbbreviatedDayNames : {ned, pon, uto, sri...}

# ShortestDayNames : {ne, po, ut, sr...}

# DayNames : {nedjelja, ponedjeljak, utorak, srijeda...}

# AbbreviatedMonthNames : {sij, vlj, ožu, tra...}

# MonthNames : {siječanj, veljača, ožujak, travanj...}

# IsReadOnly : False

# NativeCalendarName : gregorijanski kalendar

# AbbreviatedMonthGenitiveNames : {sij, vlj, ožu, tra...}

# MonthGenitiveNames : {siječnja, veljače, ožujka, travnja...}

I’ve tried to fix it in a couple of ways, but the one that finally did it (for me) was explained on Dan Sheehan’s blog (thanks!), implemented on lines 25-26 below.

So, my adapted script looks like this (and works with my hr-HR culture):

$minimumCertAgeDays = 30
$timeoutMilliseconds = 6000
$urls = @(
    "https://blog.kaniski.eu/",
    "https://www.google.com/",
    "https://www.microsoft.com/"
)

# disabling the cert validation check. This is what makes this whole thing work with invalid certs...
[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

foreach ($url in $urls) {
    Write-Host "Getting certificate information for $url ..." -ForegroundColor "Yellow"
    $req = [System.Net.WebRequest]::Create($url)
    $req.Timeout = $timeoutMilliseconds

    try {
        $req.GetResponse() | Out-Null
    }
    catch {
        Write-Host "Exception occurred while checking URL $url`: $_ ." -ForegroundColor "Red"
    }
    $expirationString = $req.ServicePoint.Certificate.GetExpirationDateString()

    $dateTimeFormat = "$((Get-Culture).DateTimeFormat.ShortDatePattern) $((Get-Culture).DateTimeFormat.LongTimePattern)"
    $expiration = [DateTime]::ParseExact($expirationString, $dateTimeFormat, [System.Globalization.DateTimeFormatInfo]::InvariantInfo, [System.Globalization.DateTimeStyles]::None)

    [int]$certExpiresIn = ($expiration - $(Get-Date)).Days
    if ($certExpiresIn -gt $minimumCertAgeDays){
        Write-Host "Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration))." -ForegroundColor "Green"
    }
    else {
        Write-Host "ERROR: Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration)) and query threshold is set to $minimumCertAgeDays days!" -ForegroundColor "Red"
    }
}

$minimumCertAgeDays = 30

$timeoutMilliseconds = 6000

$urls = @(

"https://blog.kaniski.eu/",

"https://www.google.com/",

"https://www.microsoft.com/"

)

# disabling the cert validation check. This is what makes this whole thing work with invalid certs...

[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

foreach ($url in $urls) {

Write-Host "Getting certificate information for $url ..." -ForegroundColor "Yellow"

$req = [System.Net.WebRequest]::Create($url)

$req.Timeout = $timeoutMilliseconds

try {

$req.GetResponse() | Out-Null

}

catch {

Write-Host "Exception occurred while checking URL $url`: $_ ." -ForegroundColor "Red"

}

$expirationString = $req.ServicePoint.Certificate.GetExpirationDateString()

$dateTimeFormat = "$((Get-Culture).DateTimeFormat.ShortDatePattern) $((Get-Culture).DateTimeFormat.LongTimePattern)"

$expiration = [DateTime]::ParseExact($expirationString, $dateTimeFormat, [System.Globalization.DateTimeFormatInfo]::InvariantInfo, [System.Globalization.DateTimeStyles]::None)

[int]$certExpiresIn = ($expiration - $(Get-Date)).Days

if ($certExpiresIn -gt $minimumCertAgeDays){

Write-Host "Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration))." -ForegroundColor "Green"

}

else {

Write-Host "ERROR: Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration)) and query threshold is set to $minimumCertAgeDays days!" -ForegroundColor "Red"

}

It provides the following output (which can be further customized per your needs, of course… and I know – need to insert some line breaks, convert output to HTML, send it via e-mail, … it’s a start! 😊):

# ...
# Getting certificate information for https://blog.kaniski.eu/ ...
# Certificate for site https://blog.kaniski.eu/ expires in 110 days (on 26.04.2022.).
# Getting certificate information for https://www.google.com/ ...
# Certificate for site https://www.google.com/ expires in 46 days (on 21.02.2022.).
# Getting certificate information for https://www.microsoft.com/ ...
# Certificate for site https://www.microsoft.com/ expires in 204 days (on 28.07.2022.).
# ...

# ...

# Getting certificate information for https://blog.kaniski.eu/ ...

# Certificate for site https://blog.kaniski.eu/ expires in 110 days (on 26.04.2022.).

# Getting certificate information for https://www.google.com/ ...

# Certificate for site https://www.google.com/ expires in 46 days (on 21.02.2022.).

# Getting certificate information for https://www.microsoft.com/ ...

# Certificate for site https://www.microsoft.com/ expires in 204 days (on 28.07.2022.).

# ...

Note that I’m returning expiration date “the Croatian way”, by using the following formatting:

$('{0:dd.MM.yyyy.}' -f $expiration)

1	$('{0:dd.MM.yyyy.}' -f $expiration)

Hope it helps someone (and #kudos to original authors)!

Cheers!

UniFi Network Application on Ubuntu Server on Raspberry Pi 3 (arm64)

By Tomica Kaniski in Other 29/12/2021 2 Comments

Another catchy title, right? 😀

Decided that I want to move my UniFi network controller to Ubuntu based installation, which will be running on top of Raspberry Pi (3) device which was collecting dust.

UPDATE: If you’re having issues with Java 11 or path not being set, take a look at comment by G. Faria below.

This can be easily achieved by following these steps:

take a backup of your current configuration (my controller was offline, so I’ve just copied the last automatic backup from /var/lib/unifi/backup/autobackup)
prepare the SD card with OS installation (detailed info here) – I’ve selected Ubuntu Server 21.10:

with prepared SD card, boot Ubuntu Server on your Raspberry Pi device
first login is ubuntu/ubuntu, and you’ll need to change password immediately after
next, you’ll probably want to set your Raspberry Pi to use static IP configuration – I’m using netplan to set it up:
- just in case, I removed all *.yaml files inside /etc/netplan/
- create new netplan template (YAML file) called 00-eth0.yaml in /etc/netplan/ (watch those white spaces!)

# 00-eth0.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: false
      set-name: eth0
      match:
        driver: "smsc95xx"
      addresses: [192.168.13.4/24]
      routes:
      - to: default
        via: 192.168.13.1
      nameservers:
        addresses: [192.168.13.1]

# 00-eth0.yaml

network:

version: 2

renderer: networkd

ethernets:

eth0:

dhcp4: false

set-name: eth0

match:

driver: "smsc95xx"

addresses: [192.168.13.4/24]

routes:

- to: default

via: 192.168.13.1

nameservers:

addresses: [192.168.13.1]

- apply the configuration (your IP address will be reconfigured, so you’ll also lose the current SSH connection, if connected remotely(!))

netplan generate
netplan apply

1 2	netplan generate netplan apply

prepare for UniFi Network Application installation:
- two important prerequisites are MongoDB (available releases) and LibSSL (found it here):

sudo su -
cd ~

wget http://launchpadlibrarian.net/555133932/libssl1.0.0_1.0.2n-1ubuntu5.7_arm64.deb
dpkg -i libssl1.0.0_1.0.2n-1ubuntu5.7_arm64.deb

wget https://repo.mongodb.org/apt/ubuntu/dists/xenial/mongodb-org/3.6/multiverse/binary-arm64/mongodb-org-server_3.6.23_arm64.deb
dpkg -i mongodb-org-server_3.6.23_arm64.deb

sudo su -

cd ~

wget http://launchpadlibrarian.net/555133932/libssl1.0.0_1.0.2n-1ubuntu5.7_arm64.deb

dpkg -i libssl1.0.0_1.0.2n-1ubuntu5.7_arm64.deb

wget https://repo.mongodb.org/apt/ubuntu/dists/xenial/mongodb-org/3.6/multiverse/binary-arm64/mongodb-org-server_3.6.23_arm64.deb

dpkg -i mongodb-org-server_3.6.23_arm64.deb

install the UniFi Network Application:
- there is a nice official guide here, once you take care of prerequisites, but basically:

# install prerequisite packages
apt-get update && apt-get install ca-certificates apt-transport-https

# add Ubiquity repo (for ARM)
echo 'deb [arch=armhf] https://www.ui.com/downloads/unifi/debian stable ubiquiti' | tee /etc/apt/sources.list.d/00-ubnt-unifi.list

# download and install GPG keys
wget -O /etc/apt/trusted.gpg.d/unifi-repo.gpg https://dl.ui.com/unifi/unifi-repo.gpg

# prevent updating OpenJDK
apt-mark hold openjdk-11-*

# update repos and install UniFi Network Application
apt-get update && apt-get install unifi -y

# install prerequisite packages

apt-get update && apt-get install ca-certificates apt-transport-https

# add Ubiquity repo (for ARM)

echo 'deb [arch=armhf] https://www.ui.com/downloads/unifi/debian stable ubiquiti' | tee /etc/apt/sources.list.d/00-ubnt-unifi.list

# download and install GPG keys

wget -O /etc/apt/trusted.gpg.d/unifi-repo.gpg https://dl.ui.com/unifi/unifi-repo.gpg

# prevent updating OpenJDK

apt-mark hold openjdk-11-*

# update repos and install UniFi Network Application

apt-get update && apt-get install unifi -y

restore from backup and start using it:

Note: If you’ll check your unifi service status, you may see “WARN Unable to load properties from ‘/usr/lib/unifi/data/system.properties’“:

This can easily be resolved by enabling the built-in “uncomplicated firewall” (ufw) – don’t forget to open ports you’ll need when it’s active! (such as SSH (22/tcp), inform endpoint for your devices (8080/tcp), UniFi Network Application web (8443/tcp), etc.):

# check if UFW is enabled already (probably not)
ufw status

# set exceptions
ufw allow 22/tcp
ufw allow 8080/tcp
ufw allow 8443/tcp

# enable UFW and recheck
ufw enable
ufw status

# restart unifi service
service unifi restart
service unifi status

# check if UFW is enabled already (probably not)

ufw status

# set exceptions

ufw allow 22/tcp

ufw allow 8080/tcp

ufw allow 8443/tcp

# enable UFW and recheck

ufw enable

ufw status

# restart unifi service

service unifi restart

service unifi status

* can be done more restricted, if needed
** full list of ports is available at https://help.ui.com/hc/en-us/articles/218506997-UniFi-Ports-Used – add them if needed (for instance, 6789/tcp is used when testing upload/download with mobile app)
*** be careful – it’s a firewall!

Note: If your access point is shown offline/timeout, maybe you forgot to open up the “inform port” 8080/tcp in UFW (been there, of course 😀):

And that’s it – you now have the fully functioning UniFi controller/UniFi Network Application running on top of your Ubuntu Server powered Raspberry Pi device!

Cheers!

P.S. Enable the autobackup feature… it’s useful (sometimes)! 😀