PowerShell Archives - Apostolidis Cloud Corner

Monitor & Dependencies agents at once!

Pantelis Apostolidis — Fri, 26 Apr 2024 07:30:11 +0000

Download the two agents from the links below:

The Monitor agent needs extravtion. To extract use the command: MMASetup-.exe /c /t:

e.g.: MMASetup-AMD64.exe /c /t:C:\Temp

Add all files to a network share like: \\server\share\

φτιάξε ένα bat or cmd file, π.χ. setupagents.bat με το παρακάτω περιεχόμενο αλλά βάλε τα δικά σου shares, workspace ID & Key:

create a bat or cmd file, e.g. setupagents.bat and add the below content. Change the share link, the Workspace ID and Key:

net use y: \\server\share\

y:\Setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID="" OPINSIGHTS_WORKSPACE_KEY="" AcceptEndUserLicenseAgreement=1

y:\InstallDependencyAgent-Windows.exe /S /RebootMode=manual

net use y: /delete

For example, I created the setupagents.bat, and added the files to the network share \\dcvm\Temp . The content of my setupagents.bat is:

net use y: \\dcvm\Temp

y:\Setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID="b987ae35-b7e3-44ba-bd27-000000000000" OPINSIGHTS_WORKSPACE_KEY="OZz8YN5A12biINsMbja9PHkZLDdYNNZEw+QDIsAmi0ys/2+000000000000==" AcceptEndUserLicenseAgreement=1

y:\Temp\InstallDependencyAgent-Windows.exe /S /RebootMode=manual

net use y: /delete

After running the setupagents.bat, both agents are installed. You can check at the programs and features:

At the control panel the Microsoft Monitoring Agent will appear and open it to check that it is connected to y our Log Analytics Workspace.

Here is a list of sample Log Search commands for the dependency analysis:

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Monitor & Dependencies agents at once! appeared first on Apostolidis Cloud Corner.

Azure Firewall Policy Rules to CSV

Pantelis Apostolidis — Sat, 12 Feb 2022 08:21:53 +0000

Azure Firewall is a virtual network firewall service that provides your resources in an Azure Virtual Network. It’s a firewall as a service, build on the cloud for the cloud. It provides both east-west and north-south traffic inspection. Some features are Threat Intelligence, DNAT, SNAT, Application & Network filtering rules, DNS Proxy, TLS Inspection, IDPS, URL Filtering, Web Categories. And as an Azure native service has built-in high availability and cloud scalability.

There is plenty of information and guides for Azure Firewall at the Microsoft Docs Azure Firewall documentation | Microsoft Docs. In this post, I want to share some PowerShell scripts that we created with my colleague Panagiotis Tsoukias. One script to Export all Firewall Policy rules, of all Policy Groups in a CSV file. Then edit the rules in Excel. And a second script to import the rules to the same or to a different Firewall Policy.

Export the Azure Firewall Policy Rules

The first script is to Export the Firewall Policy Rules of a Rule Collection, in a manageable CSV format. Edit the script, change the first three variables, and the path to export, and run it. Open the exported CSV with Microsoft Excel and you will have this result:

The first three columns are the Rule Collection’s Name, Priority & Action Type. We will need this info to create the Rule Collections and import the rules to the corresponding Rule Collection.

You can copy the script from the below box or download it from my GitHub link: Export Azure Firewall Policy Rules.ps1

#Provide Input. Firewall Policy Name, Firewall Policy Resource Group & Firewall Policy Rule Collection Group Name
$fpname = azfwpolicy
$fprg = azurehub
$fprcgname = DefaultNetworkRuleCollectionGroup

$fp = Get-AzFirewallPolicy -Name $fpname -ResourceGroupName $fprg
$rcg = Get-AzFirewallPolicyRuleCollectionGroup -Name $fprcgname -AzureFirewallPolicy $fp

$returnObj = @()
foreach ($rulecol in $rcg.Properties.RuleCollection) {

foreach ($rule in $rulecol.rules)
{
$properties = [ordered]@{
    RuleCollectionName = $rulecol.Name;
    RulePriority = $rulecol.Priority;
    ActionType = $rulecol.Action.Type;
    RUleConnectionType = $rulecol.RuleCollectionType;
    Name = $rule.Name;
    protocols = $rule.protocols -join ", ";
    SourceAddresses = $rule.SourceAddresses -join ", ";
    DestinationAddresses = $rule.DestinationAddresses -join ", ";
    SourceIPGroups = $rule.SourceIPGroups -join ", ";
    DestinationIPGroups = $rule.DestinationIPGroups -join ", ";
    DestinationPorts = $rule.DestinationPorts -join ", ";
    DestinationFQDNs = $rule.DestinationFQDNs -join ", ";
}
$obj = New-Object psobject -Property $properties
$returnObj += $obj
}

#change c:\temp to the path to export the CSV
$returnObj | Export-Csv c:\temp\rules.csv -NoTypeInformation
}

Import the Azure Firewall Policy Rules

After done editing the rules in Excel, we are ready to import them back to the Azure Policy or to a new Azure Policy. We need to export one CSV per Rule Collection. It will help us that the first column has the Rule Collection Name. Then run the import script. The script creates a Rule Collection, if it does not already exist, and adds the Rules in this specific Rule Collection.

You can copy the script from the below box or download it from my GitHub link: Import Azure Firewall Policy Rules.ps1

#Provide Input. Firewall Policy Name, Firewall Policy Resource Group & Firewall Policy Rule Collection Group Name
$fpname = azfwpolicy
$fprg = azurehub
$fprcgname = DefaultNetworkRuleCollectionGroup

$targetfp = Get-AzFirewallPolicy -Name $fpname -ResourceGroupName $fprg
$targetrcg = New-AzFirewallPolicyRuleCollectionGroup -Name $fprcgname -Priority 200 -FirewallPolicyObject $targetfp

$RulesfromCSV = @()
# Change the folder where the CSV is located
$readObj = import-csv C:\temp\rules.csv
foreach ($entry in $readObj)
{
    $properties = [ordered]@{
        RuleCollectionName = $entry.RuleCollectionName;
        RulePriority = $entry.RulePriority;
        ActionType = $entry.ActionType;
        Name = $entry.Name;
        protocols = $entry.protocols -split ", ";
        SourceAddresses = $entry.SourceAddresses -split ", ";
        DestinationAddresses = $entry.DestinationAddresses -split ", ";
        SourceIPGroups = $entry.SourceIPGroups -split ", ";
        DestinationIPGroups = $entry.DestinationIPGroups -split ", ";
        DestinationPorts = $entry.DestinationPorts -split ", ";
        DestinationFQDNs = $entry.DestinationFQDNs -split ", ";
    }
    $obj = New-Object psobject -Property $properties
    $RulesfromCSV += $obj
}

$RulesfromCSV
Clear-Variable rules
$rules = @()
foreach ($entry in $RulesfromCSV)
{
    $RuleParameter = @{
        Name = $entry.Name;
        Protocol = $entry.protocols
        sourceAddress = $entry.SourceAddresses
        DestinationAddress = $entry.DestinationAddresses
        DestinationPort = $entry.DestinationPorts
    }
    $rule = New-AzFirewallPolicyNetworkRule @RuleParameter
    $NetworkRuleCollection = @{
        Name = $entry.RuleCollectionName
        Priority = $entry.RulePriority
        ActionType = $entry.ActionType
        Rule       = $rules += $rule
    }
}

# Create a network rule collection
$NetworkRuleCategoryCollection = New-AzFirewallPolicyFilterRuleCollection @NetworkRuleCollection
# Deploy to created rule collection group
Set-AzFirewallPolicyRuleCollectionGroup -Name $targetrcg.Name -Priority 200 -RuleCollection $NetworkRuleCategoryCollection -FirewallPolicyObject $targetfp

Feel free to take, edit, use & comment on the scripts, you can find them at my repo:

Dark Mode

automation (this link opens in a new window) by proximagr (this link opens in a new window)

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Firewall Policy Rules to CSV appeared first on Apostolidis Cloud Corner.

Azure VM | Add Multiple Data Disks v2

Pantelis Apostolidis — Fri, 02 Jul 2021 08:26:54 +0000

This is a new version of my previous script Add multiple managed disks to Azure RM VM

Changes:

- Shows the disk capacity of the VM and asks how many disks to add.
- Prompts for the size of every disk
- Checks for empty Luns to add the disks

# 1. You need to login to the Azure Rm Account

Login-AzAccount

# 2. The script will query the Subscriptions that the login account has access and will promt the user to select the target Subscription from the drop down list
 
$subscription = Get-AzSubscription | Out-GridView -Title "Select a Subscription" -PassThru
Select-AzSubscription -SubscriptionId $subscription.Id

# 3. The script will query the available VMs and promt to select the target VM from the VM list
 
$vm = Get-AzVM | Out-GridView -Title "Select the Virtual Machine to add Data Disks to" -PassThru

# 4. I set the storage type based on the OS disk. If you want to spesify somehting else you can cahnge this to: $storageType = StandardLRS or PremiumLRS etc.

$storageType = $VM.StorageProfile.OsDisk.ManagedDisk.StorageAccountType

# 5. Enter how many data disks you need to create

$VMdiskCapacity = ($VM.StorageProfile.DataDisks).Capacity
 
$diskquantity = Read-Host "How many disks you need to create? Max Capacity" $VMdiskCapacity "."

# 6. The script will promt for disk size, in GB

$diskSizeList = @()
for($i = 1; $i -le $diskquantity; $i++)
{
    $disk = (Read-Host "Disk " $i " Size")
    $diskSizeList += $disk
}
$diskSizeList

# 7. check for exisiting disks

$existinglun = @()
for($i = 0; $i -lt $VMdiskCapacity; $i++) {
    $existinglun += ($VM.StorageProfile.DataDisks)[$i].Lun
}

# 8. disks creation

for($i = 0; $i -lt $diskquantity; $i++)
{
$diskName = $vm.Name + "-DataDisk-" + $i.ToString()
$diskConfig = New-AzDiskConfig -AccountType $storageType -Location $vm.Location -CreateOption Empty -DiskSizeGB $diskSizeList[$i]
$DataDisk = New-AzDisk -DiskName $diskName -Disk $diskConfig -ResourceGroupName $vm.ResourceGroupName
for ($j = 0; $j -lt $VMdiskCapacity; $j++) {
    if ( $null -eq $existinglun[$j] ) {
        $nextLunIndex
        for ($k = 0; $k -lt $VMdiskCapacity; $k++ ) {
            $nextLunIndex = $k
            for ( $m = 0; $m -lt $VMdiskCapacity; $m++ ) {
                if ( $k -eq $existinglun[$m] ) {
                    $nextLunIndex = -1 
                    break 
                }
            }
            if ($nextLunIndex -ne -1 ) {
                break
            }
        }
        Add-AzVMDataDisk -VM $vm -Name $DiskName -CreateOption Attach -ManagedDiskId $DataDisk.Id -Lun $nextLunIndex
        $existinglun[$j] = $nextLunIndex
        break
    } 
}
}
Update-AzVM -VM $vm -ResourceGroupName $vm.ResourceGroupName

You can download the script from: https://github.com/proximagr/automation/blob/master/Add-DataDisks-DIffSize_v3.ps1

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure VM | Add Multiple Data Disks v2 appeared first on Apostolidis Cloud Corner.

Learn Azure for Free using Sandbox!

Pantelis Apostolidis — Fri, 13 Nov 2020 09:59:04 +0000

Learn Azure for Free using Sandbox!

Did you know that you can use Azure for free for learning purposes? And when I say free, i am not talking about the free account where you need to add your credit card and have 170€ credit. I am talking about a completely free environment to learn the Azure services and resources, but only for Learning purposes.

The Azure Sandbox is offered by the Microsoft Learn platform. Microsoft Learn is a completely free, online training platform that provides interactive learning for Microsoft products and more.

The Microsoft Learn sandbox (sometimes called the Azure sandbox) is a free environment that you can use to explore Azure through Microsoft Learn content.

And the magic here is that you don’t need an Azure account to use a sandbox! All you need is a Microsoft account to sign in with. If you don’t have one, you can create one for free.

Take a look at this. This is the Microsoft Learn home page where you can select whatever learning path or module you want to follow.

When you start a module that needs Microsoft Azure Access, there is an “Activate sandbox” button

When you press is, the only thing that you will be asked is to enter a mobile phone number, just for verification. It will not ask for credit card!

Once you verify your number, it will ask you to Review and accept the permissions to use Microsoft Azure using your Microsoft Account

And the Sandbox environment is ready! You can have 10 Sandboxes per day, for 2 hours each.

You can use Bash, PowerShell and the Azure Poral at will:

Bash:

PowerShell:

Azure Portal:

You can use the Sandbox to complete the specific exercise, but you can also play around with the resources. You can see at the below screenshot, that except the two “webVM”s of the exercise, I have created a “test” VM directly from the portal.

Start your learning path at Microsoft Learn NOW!

And remember: The sandbox may only be used to complete training on Microsoft Learn.

Pantelis Apostolidis

www.cloudcorner.gr

The post Learn Azure for Free using Sandbox! appeared first on Apostolidis Cloud Corner.

Azure Application Gateway | WAF Policy per Listener

Pantelis Apostolidis — Fri, 25 Sep 2020 05:22:48 +0000

Azure Application Gateway | WAF Policy per Listener

With Azure Application Gateway v2 coming, a lot of new features have been added. Much faster deployment and change times, auto-scaling and the ability to assign different Web Application Firewall (WAF) policies per Application Gateway’s listener. This feature provides more control over each listener and also can limit the number of different Application Gateways you need to deploy.

With a custom WAF policy we can control the firewall per listener (URL) with:

Firewall mode, Prevention – Detection
Request body properties
WAF rule set category & version
Custom Rules with If / Then conditions
- Match IP address, Number, String, Geo location
- Allow / Deny Traffic

This post scenario

We have on Azure Application Gateway with two Listeners (listens to two different URLs at its Public IP). The two listeners are forwarding the traffic to two different Web Apps, as shown at the below image.

My request is to allow all traffic to the first URL but allow traffic only from a specific IP to the second URL.

For the demo, I assume that you already have an Azure Application Gateway v2 in place and you have published two back ends (web apps, VMs, custom IP) and your web sites / apps are healthy and you can browse them behind the Application Gateway.

Since I am using the default azurewebsites.net domain, I added two hosts at my workstation’s host file, in order to route the traffic to the Application Gateway’s IP and not directly to the Web Apps.

I can browse both Web Apps, through the Application Gateway, from my browser. I am using http and not https for the demo since I am using the default domain and I cannot add a custom certificate.

We need to create two Web Application Firewall policies (WAF). One for each listener. To create a WAF policy, search the Azure Portal for waf and click the “Web Application Firewall policies (WAF)”.

At the “Web Application Firewall policies (WAF)” page click +Add

At the Project details select “Regional WAF (Application Gateway)”.

Select the Subscription that your Application Gateway resides, select Resource Group, add a name for the Policy and the same region as your Application Gateway. The policy must set to Enabled to apply. I named the policy URLNumber02 to start creating the policy for the second URL that I want the custom rule.

At the Policy Settings change the setting to Prevention from Detection and go to the Custom rules and Add custom rule

I named the rule “AllowOnlyOneIP”, since I want to allow only one IP to access the second URL (listener) of the gateway. Give a priority, I added 1 as it is the only one. At the conditions select:

March Type: IP address
Operation: Does not contain
IP address or range: add the only IP that you want to allow access to the URL

At the “Then” condition, select “Deny Traffic”

This rule will allow traffic only of the IP is the IP address that we added to the condition. For all other IPs access will be denied.

Now that we created the policy, we need to assign it to the listener. At the next step of the WAF policy wizard we need to select the Application Gateway and the Listener.

First click the “Associate an application gateway” and select the Application Gateway. Remember that this policy will need to overwrite the default Application Gateway’s WAF policy. So before proceeding migrate your current WAF settings and customizations to the new WAF policy.

After you select the Application Gateway, associate the listener. I associate the “mylistener02” that is my second URL, with this policy.

After saving the policy, go to the Application gateway and check the “Web Application Firewall” settings. There you will see that all settings disappeared and you can only see that the gateway is associated with a WAF policy. We see that it is Associated to the URLNumber2 polily.

You need to create one more WAF rule for URL 01 for the correct functionality. Once you create a WAF policy and associate it to the other listener of the Application gateway, you will see that at the “Web application firewall” is associated to the new policy. Actually the Application gateway is associated to both WAF policies, one at each listener. You just cannot see this at the Azure Portal.

We can see the WAF rules that are associated to the Application Gateway’s Listeners using the PowerShell. Running the “Get-AzApplicationGateway -Name AppGw01 -ResourceGroupName AppGw01” command you can see that the “URLNumber01” WAF policy is associated to the “mylistener” and the “URLNumber2” is associated to the “mylistener02”.

To test the policies, I tried to access both URLs from a computer that don’t have the Public IP that I added tot he policy and I can access the URL 1 app but I cannot access the URL 2 app. From the computer that has the Public IP we added at the rule, I can browse both sites.

The WAF rules can be edited at the Web Application Firewall policies (WAF) blade and all settings will apply to the corresponding listener.

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Application Gateway | WAF Policy per Listener appeared first on Apostolidis Cloud Corner.

Azure Failover Cluster with Shared Disk – Step by Step

Pantelis Apostolidis — Sat, 04 Apr 2020 13:02:03 +0000

Azure Failover Cluster with Shared Disk

Recently MIcrosoft Azure anounched the preview feature “Shared Disk”. The Shared Disk can be attached at two Azure MVs at the same time. The purpose is to create SQL Server Failover Cluster Instances (FCI), Scale-out File Server (SoFS), File Server for General Use (IW workload), Remote Desktop Server User Profile Disk (RDS UPD) and SAP ASCS/SCS. More or less we can have a failover cluster at Azure VMs like haveing an on-premises failover cluster with shared storage.

At this post I will demostrate step-by-step how to create a Failover Cluster in Azure with two Azure VMs and a Shared Disk.

Since this is a preview feature at the time I am wroting this post, we need to sign up for our preview.

Once we have the confiration that the Shared Disk preview is enabled at our Subscription, we can proceed and create our Shared Disk. Currently this can be done only by using an ARM Template, in order to define the “maxShares”: “[parameters(‘maxShares’)]” disk property. This property defines in how VMs can this Disk be attached.

The following table illustrates the allowed maximum values for `maxShares` by disk size:
Disk sizes	maxShares limit
P15, P20	2
P30, P40, P50	5
P60, P70, P80	10

Other limitations of the preview are:

Currently only available with premium SSDs.
Currently only supported in the West Central US region.
All virtual machines sharing a disk must be deployed in the same proximity placement groups.
Can only be enabled on data disks, not OS disks.
Only basic disks can be used with some versions of Windows Server Failover Cluster, for details see
Failover clustering hardware requirements and storage options.
ReadOnly host caching is not available for premium SSDs with maxShares>1.
Availability sets and virtual machine scale sets can only be used with FaultDomainCount set to 1.
Azure Backup and Azure Site Recovery support is not yet available.

From the Azure Portal search and open the “Template Deployment”

Select the “Build your own template in the editor”

And paste the Shared Disk Json at the template

The Shared Disk Json:

{ 
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "dataDiskName": {
      "type": "string",
      "defaultValue": "mySharedDisk"
    },
    "dataDiskSizeGB": {
      "type": "int",
      "defaultValue": 1024
    },
    "maxShares": {
      "type": "int",
      "defaultValue": 2
    }
  },
  "resources": [
    {
      "type": "Microsoft.Compute/disks",
      "name": "[parameters('dataDiskName')]",
      "location": "[resourceGroup().location]",
      "apiVersion": "2019-07-01",
      "sku": {
        "name": "Premium_LRS"
      },
      "properties": {
        "creationData": {
          "createOption": "Empty"
        },
        "diskSizeGB": "[parameters('dataDiskSizeGB')]",
        "maxShares": "[parameters('maxShares')]"
      }
    }
  ] 
}

After the Template Deployment is comleted you will see a normal disk at the Resoruce Group.

Create the VMs

Create both VMs like any normal Azure VM creation. I created wto Windows Server 2016 VMs. Both VMs must be added to the same availability set (Fault Domain = 1), in order to add them behing an internal load balancer and they must be added to the same Proximity Placement Group.

To create a Proximity Placement Group, just create a new resource, search for “Proximity Placement Group” and press create. Just provide a name for the PPG and the location, that must be the same as the Disk.

And select it at the VM creation wizard:

Attach the Sahred Disk to Both VMs

When attaching the Shared Disk to the VMs you will see the “disk shares used” This reports in how many VMs this disk is attached.

Once the VMs are ready we can start the Failover Cluster process. We need to add both VMs to the Domain. Then go tot he Disk Management and bring the disks online, GTP on both servers. The next step is to enable the Failover Clustering feature on both VMs. This can be easily acomplished using the below command:

Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools –ComputerName SDVM01
Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools –ComputerName SDVM02

Restart both VMs

Lets start the Failover Cluster Wizard. Select both Azure VMs and validate with running all tests.

The report should have sucess to all Storage Related Stuff. Only the Cluster IP will fail, since it cannot allocate an Azure IP.

So we will not create the Cluster uning the GUI wizard. We will create the cluster unsing the new-cluster command to spesify the cluter IP. But first lets create the Cluster IP Load Balancer.

To enable the Cluster IP we need to create an Internal StandardLoad Balancer with Static IP. Add both VMs to the Backend pool of the load balancer.

And Run this command to one of the two VMs:

New-Cluster -Name cluster1 -Node SDVM01,SDVM02  -StaticAddress 192.168.0.10

The cluster is ready and we can now we can add the Disk to the Cluster

righ click at the Cluster Disk 1 and select “Add to cluster shared volumes”

Wait untill the disk is online

‘

and check the C:\ClusterStorage path for the “Volume1” link.

open the Volume1 and create a file, just to cehck that it is working

To have a more stable cluster, add a Quorum. At the cluster name, right click and select More Actions / Configure Quorum settings.

Since we are on Azure we will configure an Azure Storage account for quorum. Select the “Advanced Configuration”

and select the “Configure CLoud Witness”.

Create an Azure Storage Account

add the Storage Account to the Virtual Network of the VMs, to secure it

And once the Storage Account is ready, copy/paste the name and the Key to the Culster Quorum wizard.

Now we have a full failover cluster

Server 1:

Server 2:

Now we can deploy SQL Server FCI, File Server, etc.. !!!!

More info abuot the Shared Disk: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-shared-enable

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Failover Cluster with Shared Disk – Step by Step appeared first on Apostolidis Cloud Corner.

Serverless Computing | Check your expired public certificates

Pantelis Apostolidis — Fri, 12 Oct 2018 09:41:29 +0000

Serverless Computing | Check your expired public certificates

Check for expired public certificates serverless, using an Azure Function App. Magically run the required PowerShell script directly at the Portal without deploying VMs or App Services. At this post I combine Azure Function Apps, with a PowerShell script to check the certificate expirations and the Send-MailMessage PowerShell function for sending emails directly from the PowerShell script.

Setup the Azure Function App

At the Azure Portal, create a new Function App. Select Consumption Plan and .NET Runtime Stack

Once the Function App is created, we need to enable PowerShell language support. To do so, open it, select the Function App and at the Platform features tab, open the Application Settings

Change the FUNCTIONS_EXTENSION_VERSION to ~1 and delete the FUNCTIONS_WORKER_RUNTIME line

Before:

After:

Create the Function

Once you click Save, go back to the Function App, select the “Functions” and press “New function”

If we change the application settings correctly, the “Experimental Language Support” option will appear. Enable it and the templates will be able to support PowerShell (And more languages). To get started click the “Time trigger” template.

At the window, select “PowerShell” for language and set the schedule. “Enter a cron expression of the format ‘{second} {minute} {hour} {day} {month} {day of week}’ to specify the schedule.”

Entering 0 0 0 1 * * the function will run once per day

Add the PowerShell script

Once the Function is created, you will be directed to the “Function Name” run.ps1 file. There we can run PowerShell scripts.

Below is the script, change the required variables to fit your needs and paste it to the Function run.ps1 file. The variables that you need to change is:

$WebsiteURLs | This is the list, comma separated, of the URLs you want to check for certificate expiration
$From | The email address of the Sender
$To | The email address of the Recipient
$Cc | The email address of the CC Recipient
$Subject | The subject of the email
$SMTPServer | The email server you will use to send the emails. You can Use the SendGrid service from Azure that currenlty provides 25000 email per month for free. More details here: https://sendgrid.com/docs/API_Reference/SMTP_API/getting_started_smtp.html
$SMTPPort | The port that the SMTP service requires
$username | The username to authenticate to the SMTP Service
$password = ConvertTo-SecureString “here you need to add the password in plain text” -AsPlainText -Force

$WebsiteURLs= @("e-apostolidis.gr","azureheads.gr")
$WebsitePort=443
$Threshold=120
$Severe=30
$ID=0

$body +=  "
"
$body +=  ""
$body += "#	Website_URL:	Current Certificate:	Expiration Date:	Days Remaining:	Errors:"
foreach ($WebsiteURL in $WebsiteURLs){
$CommonName=$WebsiteURL
$ID+=1
Try{
$Conn = New-Object System.Net.Sockets.TcpClient($WebsiteURL,$WebsitePort) 
Try {
$Stream = New-Object System.Net.Security.SslStream($Conn.GetStream(),$false, {
param($sender, $certificate, $chain, $sslPolicyErrors) 
return $true
})
$Stream.AuthenticateAsClient($CommonName) 

$Cert = $Stream.Get_RemoteCertificate()
$CN=(($cert.Subject -split "=")[1] -split ",")[0]
$ValidTo = [datetime]::Parse($Cert.GetExpirationDatestring())

$ValidDays = $($ValidTo - [datetime]::Now).Days
if ($ValidDays -lt $Threshold) {
$fontcolor +=  ""
} 
if ($ValidDays -lt $Severe) {
$fontcolor +=  ""
}
$body += "
"
$body += $fontcolor
$body += "$ID	$WebsiteURL	$CN	$ValidTo	$ValidDays"
}
Catch { Throw $_ }
Finally { $Conn.close() }
}
Catch {
$body += "
"
$body +=" gest "
$body += " $ID	$WebsiteURL"
$body +=  ""
}

}

$From = "alias@domain.gr"
$To = "alias@domain.gr"
$Cc = "alias@domain.gr"
$Subject = "check the certificates"

$SMTPServer = "mail.mailserver.gr"
$SMTPPort = "587"


$username = "username"
$password = ConvertTo-SecureString "password" -AsPlainText -Force
$mycred = New-Object System.Management.Automation.PSCredential($username, $password)
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { return $true }
Send-MailMessage -From $From -to $To -Cc $Cc -Subject $Subject -SmtpServer $SMTPServer -UseSSL -port $SMTPPort -Credential ($mycred) -Body $body -BodyAsHtml

Press SAve & Run and you are ready. Now on, once per day the script will run and it will sent an email with the certificates. Something like this:

Feel free to play with the colors on the script. I have added Dark Green for the valid certificates and Red for those that is about to expire.

Credits

Use this line to ignore the certificate check on the email server when sending the email

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { return $true }

https://social.technet.microsoft.com/Forums/windows/en-US/d9e9af2b-3bb9-4cb4-8046-dd0a092bc456/send-email-by-powershell?forum=winserverpowershell

The basic script for checking for certificate revocation:

https://isc.sans.edu/forums/diary/Assessing+Remote+Certificates+with+Powershell/20645/

At his blog is the idea for sending emails with powershell with html:

http://www.techtrek.io/send-automated-email-with-powershell/

Pantelis Apostolidis

www.cloudcorner.gr

The post Serverless Computing | Check your expired public certificates appeared first on Apostolidis Cloud Corner.

Custom pfSense on Azure Rm | a complete guide

Pantelis Apostolidis — Wed, 03 Jan 2018 15:12:52 +0000

Custom pfSense on Azure Rm | a complete guide

A complete guide on how to create a pfSense VM on a local Hyper-V server, prepare it for Microsoft Azure, upload the disk to Azure and create a multi-NIC VM.

Download the latest image from https://www.pfsense.org/download/

Open Hyper-V Manager create a Generation 1 VM. I added 4096 ram, 2 cores, use VHD, add an extra NIC (for second interface) and select the downloaded ISO. (create a fixed VHD as Azure supports only fixed VHDs for custom VMs)

Start the VM and at the first screen press enter.

At all screens I accepted the default settings. Finally at the reboot prompt remove the installation ISO.

There is no need to setup VLANs, select the second interface for WAN and the first for LAN.

Once the pfSense is ready press 2 and change the LAN (hn0) interface IP to one at your network. Then select the option 14 to enable SSH.

Now we can login with putty, with username admin password pfsense and press 8 for Shell access.

The first thing is to update the packages running:

pkg upgrade

Python

Then install Python, as it is requirement for the Azure Linux Agent.

Search for Python packages running:

pkg search python

Install the latest Python package, setup tools and bash:

pkg install -y python27-2.7.14

pkg search setuptools

pkg install py27-setuptools-36.2.2

ln -s /usr/local/bin/python /usr/local/bin/python2.7

pkg install -y bash

Azure Linux Agent

ref: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/classic/freebsd-create-upload-vhd

pkg install git

git clone https://github.com/Azure/WALinuxAgent.git

cd WALinuxAgent

git tag

git checkout WALinuxAgent-2.1.1

git checkout WALinuxAgent-2.0.16

python setup.py install

ln -sf /usr/local/sbin/waagent /usr/sbin/waagent

check the agent is running:

waagent -Version

One final step before uploading the VHD to Azure is to set the LAN interface as dhcp.

This can be done by the web interface, go to https://lanaddress, login using admin / pfsense, and go to interfaces / LAN and select DHCPas ipv4 configuration.

Now, shutdown the pfSense and upload it to Azure Storage.

I use the Storage Explorer, https://azure.microsoft.com/en-us/features/storage-explorer/ a free and powerful tool to manage Azure Storage. Login to your Azure Account and press Upload. Select as Blob type: “Page blob”

After the upload is completed we can create a multiple NIC VM. This cannot be accomplished from GUI. We will create this using PowerShell.

$ResourceGroupName = "******"
$pfresourcegroup = "*******"
$StorageAccountName = "******"
$vnetname = "*****"
$location = "West Europe"
$vnet = Get-AzureRmVirtualNetwork -Name $vnetname -ResourceGroupName $ResourceGroupName
$backendSubnet = Get-AzureRMVirtualNetworkSubnetConfig -Name default -VirtualNetwork $vnet
$vmName="pfsense"
$vmSize="Standard_F1"
$vnet = Get-AzureRmVirtualNetwork -Name $vnetname -ResourceGroupName $ResourceGroupName
$pubip = New-AzureRmPublicIpAddress -Name "PFPubIP" -ResourceGroupName $pfresourcegroup -Location $location -AllocationMethod Dynamic
$nic1 = New-AzureRmNetworkInterface -Name "EXPFN1NIC1" -ResourceGroupName $pfresourcegroup -Location $location -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pubip.Id
$nic2 = New-AzureRmNetworkInterface -Name "EXPFN1NIC2" -ResourceGroupName $pfresourcegroup -Location $location -SubnetId $vnet.Subnets[0].Id
$VM = New-AzureRmVMConfig -VMName $vmName -VMSize $vmSize
$VM | Set-AzureRmVMOSDisk `
            -VhdUri https://********.blob.core.windows.net/vhds/pfsensefix.vhd `
            -Name pfsenseos -CreateOption attach -Linux -Caching ReadWrite
$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic1.Id
$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic2.Id
$vm.NetworkProfile.NetworkInterfaces.Item(0).Primary = $true
New-AzureRMVM -ResourceGroupName $pfresourcegroup -Location $locationName -VM $vm -Verbose

Once the VM is created, go to the VM’s blade and scroll down to “Boot diagnostics”. There you can see a screenshot of the VM’s monitor.

Then go to the Networking section and SSH to the Public IP.

and also we can login to the Web Interface of the pfSense

In my case I have added both NICs at the same Subnet, but at a production environment add the LAN interface to the backend subnet and the WAN interface to the DMZ (public) subnet.

Of course more NICs can be added to the VM, one for each Subnet at our environment.

Route external traffic through the pfSense

We cannot change the gateway at an Azure VM, but we can use routing tables to route the traffic through the pfSense.

From the Azure Portal, select New and search for Route table.

We need to configure two things. One is to associate the Route table to a Subnet and the second is to create a Route.

Open the “Route table” and click the “Routes”. Press “Add route” and in order to route all outbound traffic through the pfSense then add for Address prefix “0.0.0.0”, next hop type Virtual appliance” and Net hop address the ip address of the pfSense’s LAN interface IP.

Then go to the “Subnets” and associate the required subnets.

One final thing to do is to enable IP Forwarding at the LAN interface of the pfSense, in order to be able to receive and forward traffic not originated for it.

Pantelis Apostolidis

www.cloudcorner.gr

The post Custom pfSense on Azure Rm | a complete guide appeared first on Apostolidis Cloud Corner.

Create Azure File Shares at your ARM template using PowerShell

Pantelis Apostolidis — Thu, 28 Sep 2017 13:51:43 +0000

Create Azure File Shares at your ARM template using PowerShell

Using Azure Resource Manage template deployment, you can create a Storage account but you cannot create File Shares. Azure File Shares can be created using the Azure Portal, the Azure PowerShell or the Azure Cli.

Mainly, the idea is to run a PowerShell script that will create the File Shares. This script will be invoked inside the ARM Template. In order to use a PowerShell script from a template, the script must be called from a URL. A good way to provide this is using the Git repository. One major thing to consider is the Storage Account key must be provided to the PowerShell script securely, since the PowerShell script is at a public URL.

The PowerShell script will run inside a Virtual Machine and we will use a CustomScriptExtension Extension to provide it. To use this, at the Virtual Machine Resource of the JSON file add a resources section.

The Custom Script Exception is located at the Virtual Machine resource. Lets assume that the last part of the Virtual Machine resource is the “diagnosticsProfile” so after the closure of the “diagnosticsProfile” we can add the “resources”. Inside the “resources” add the “extensions” resource that will add the “CustomScriptExtension”, like below.

The Template Part

This will be the addition at the Virtual Machine resource:

 "diagnosticsProfile": {
          "bootDiagnostics": {
            "enabled": true,
            "storageUri": "[concat(reference(concat('Microsoft.Storage/storageAccounts/', variables('diagnosticStorageAccountName')), '2016-01-01').primaryEndpoints.blob)]"
          }
        }
        },
        "resources": [
          {
            "name": "AzureFileShares",
            "type": "extensions",
            "location": "[variables('location')]",
            "apiVersion": "2016-03-30",
            "dependsOn": [
              "[resourceId('Microsoft.Compute/virtualMachines', parameters('VMName'))]",
              "[variables('AzureFilesStorageId')]"
            ],
            "tags": {
              "displayName": "AzureFileShares"
            },
            "properties": {
              "publisher": "Microsoft.Compute",
              "type": "CustomScriptExtension",
              "typeHandlerVersion": "1.4",
              "autoUpgradeMinorVersion": true,
              "settings": {
                "fileUris": [
                  "https://raw.githubusercontent.com/######/#####/master/azurefiles.ps1"
                ]
              },
              "protectedSettings": {
               "commandToExecute": "[concat('powershell -ExecutionPolicy Unrestricted -File ','azurefiles.ps1 -SAName ',parameters('AzureFilesStorageName'),'  -SAKey ', listKeys(resourceId(variables('AzureFilesStorageAccountResourceGroup'),'Microsoft.Storage/storageAccounts', parameters('AzureFilesStorageName')), '2015-06-15').key1)]" 
             }
            }
          }
        ]
    },

The extension must be depended from the Virtual Machine that will run the script and the Storage Account that will bu used for the file shares.

At the custom script properties add the public RAW url of the PowerShell script.

Next lets see the Storage Account key and execution part. At the connandToExecute section, we will provide a variable that will pass the Storage Account key & Name inside the script for execution. The variable will get the Storage Account key from the Storage Account using the permissions of the Account running the Template Deployment.

Of course to make the template more flexible I have added a variable for the Resource Group and a parameter for the AzureFilesStorageName, so the template will ask for the Storage Account name at the parameters.

The PowerShell

The PowerShell script is tested at Windows Server 2016 VM. You can find it below:

Param (
  [Parameter()]
  [String]$SAKey,
  [String]$SAName
)
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
Install-Module Azure -Confirm:$False
Import-Module Azure
$storageContext = New-AzureStorageContext -StorageAccountName $SAName -StorageAccountKey $SourceSAKey
$storageContext |  New-AzureStorageShare -Name #####

Pantelis Apostolidis

www.cloudcorner.gr

The post Create Azure File Shares at your ARM template using PowerShell appeared first on Apostolidis Cloud Corner.

Add multiple managed disks to Azure RM VM

Pantelis Apostolidis — Fri, 08 Sep 2017 14:29:54 +0000

Add multiple managed disks to Azure RM VM

In this post I have created a PowerShell script to help add multiple managed disks to an Azure RM Virtual Machine.

The script to add multiple managed disks will prompt you to login to an Azure RM account, then it will query the subscriptions and ask you to select the desired. After that it will query the available VMs and promt to select the target VM from the VM list.

At this point I am checking the OS disk and define the storage type of the data disk. If we need to change the storage type we can check the comments at step 4. e.g. If the OS disk is Premium and you want Standard data disks.

The next step is to ask for disk size. You can check the sizes and billing here: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/managed-disks-overview#pricing-and-billing

Finally it will ask for the number of the disk we need to create. After this input the script will create the disks, attach them to the VM and update it.

The Script:

# 1. You need to login to the Azure Rm Account

Login-AzureRmAccount

# 2. The script will query the Subscriptions that the login account has access and will promt the user to select the target Subscription from the drop down list
 
$subscription = Get-AzureRmSubscription | Out-GridView -Title "Select a Subscription" -PassThru
Select-AzureRmSubscription -SubscriptionId $subscription.Id

# 3. The script will query the available VMs and promt to select the target VM from the VM list
 
$vm = Get-AzureRmVM | Out-GridView -Title "Select the Virtual Machine to add Data Disks to" -PassThru

# 4. I set the storage type based on the OS disk. If you want to spesify somehting else you can cahnge this to: $storageType = StandardLRS or PremiumLRS etc.

$storageType = $VM.StorageProfile.OsDisk.ManagedDisk.StorageAccountType

# 5. The script will promt for disk size, in GB

$diskSizeinGB = Read-Host "Enter Size for each Data Disk in GB"

$diskConfig = New-AzureRmDiskConfig -AccountType $storageType -Location $vm.Location -CreateOption Empty -DiskSizeGB $diskSizeinGB

# 6. Enter how many data disks you need to create
 
$diskquantity = Read-Host "How many disks you need to create?"

for($i = 1; $i -le $diskquantity; $i++)
{
$diskName = $vm.Name + "-DataDisk-" + $i.ToString()
$DataDisk = New-AzureRmDisk -DiskName $diskName -Disk $diskConfig -ResourceGroupName $vm.ResourceGroupName
$lun = $i - 1
Add-AzureRmVMDataDisk -VM $vm -Name $DiskName -CreateOption Attach -ManagedDiskId $DataDisk.Id -Lun $lun
}

Update-AzureRmVM -VM $vm -ResourceGroupName $vm.ResourceGroupName

You can download the script from here: AddManagedDisks

Pantelis Apostolidis

www.cloudcorner.gr

The post Add multiple managed disks to Azure RM VM appeared first on Apostolidis Cloud Corner.