Recommended Books for Success Leadership

bts145Leave a comment

SWOT Analysis Example –

Be Focused Be Organized Be Proactive Be Action Oriented

Success isn’t about luck…it’s about preparation. Proactive people stay one step ahead by planning, staying organized, and focusing on what truly matters. (what is important)
Stop reacting. Start leading. What’s one thing you’ll do today to stay ahead?

61 Opportunity Examples for a SWOT Analysis

AWS Learning and HOW TO Links

bts145Leave a comment

https://aws.amazon.com/new/

https://iloveaws.com/

https://awsstash.com/

https://aws.amazon.com/blogs/architecture/

https://github.com/yogendras843/books

https://github.com/aws-samples

Service Catalog Administrator Guide

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/getstarted-template.html

Troubleshooting

https://aws.amazon.com/premiumsupport/knowledge-center/user-data-replace-key-pair-ec2/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking-ena.html#test-enhanced-networking-ena
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-server-refused-our-key/

Renew RADIUS Certificate (NPS Server)

bts145Leave a comment

Steps to renew the certificate:

Login to RADIUS Server

Start → Run → certlm.msc

Under Personal → Certificates, you will see a certificate with Azure AD Tenant ID – and its expiry date

To renew the certificate, Open Powershell as Administrator

Run the following commands:

cd “C:\Program Files\Microsoft\AzureMfa\Config\”
.\AzureMfaNpsExtnConfigSetup.ps1

It will first prompt to install the libraries from PS Gallery, Type A to say “Yes to All” and click enter.

Next it will open up the AD login page for authentication. Enter the username, password and approve the MFA request.

Wait for the script to continue running. It will prompt to check the existing Tenant Id. Ensure the Azure Tenant Id is listed as 59xxx-xxxx-xxxx-xxxxx-xxxxx

At the end of the script, it will try to restart the Network Policy server.

OpenVPN CLI Commands

bts145Leave a comment

OpenVPN CLI Commands – Troubleshooting

less /usr/local/openvpn_as/etc/as.conf

less /etc/openvpn/server/server.conf

root@ip-:/var/log# /usr/local/openvpn_as/scripts/sacli version
2.8.5 (build f4ad562b)

Check the users connected to OpenVPN:

/usr/local/openvpn_as/scripts/sacli VPNStatus

/usr/local/openvpn_as/scripts/sacli VPNSummary

Check the status of OpenVPN:

/usr/local/openvpn_as/scripts/sacli status

List the current server configuration:

/usr/local/openvpn_as/scripts/sacli configquery

List the user and group properties:

/usr/local/openvpn_as/scripts/sacli UserPropGet

Check the Current OpenVPN version

/usr/local/openvpn_as/scripts/sacli version

****Verify the Cert Validity

cd /usr/local/openvpn_as/etc/ssl-api/

openssl x509 -enddate -noout -in client.crt

openssl x509 -enddate -noout -in server.crt

aws s3 cp /var/log/temp/ s3://openvpn-log-analysis/ –recursive

THE DB can be internal or external

/usr/local/openvpn_as/scripts/
1) Download the configuration to a single file (where config.txt is the name of the file):
sacli ConfigQuery > config.txt

2) where is the username / password stored for connecting the db ?

3) what’s inside the db ?
config ,cert, userprop, log

db configuration location*

The DB Configuration is stored in /usr/local/openvpn_as/etc/as.conf

root@ip-10-209-7-166:/etc# grep db /usr/local/openvpn_as/etc/as.conf
certs_db=mysql://admin:xxxx@xxxxx.ap-southeast-2.rds.amazonaws.com:3306/as_certs
user_prop_db=mysql://admin:xxxxx@xxxxxxx.ap-southeast-2.rds.amazonaws.com:3306/as_userprop
config_db=mysql://admin:xxxxxx@xxxxxxx.ap-southeast-2.rds.amazonaws.com:3306/as_config
config_db_local=sqlite:///~/db/config_local.db
cluster_db=mysql://admin:xxxxx@xxxx.ap-southeast-2.rds.amazonaws.com:3306/as_cluster
notification_db=mysql://admin:xxxx@xxxxxxx.ap-southeast-2.rds.amazonaws.com:3306/as_notification
log_db=sqlite:///~/db/log.db

*change config value
/sacli -k auth.module.post_auth_script –value_file=ovpnas_postauth_cr.py ConfigPut
./sacli start

====================
CLI Command to Change Open VPN configure

sudo su
cd /usr/local/openvpn_as/scripts
./sacli -k “auth.radius.0.per_server_timeout” -v “60” ConfigPut
./sacli start

=====================

=======LINKS========
Configure Radius Server
https://openvpn.net/vpn-server-resources/openvpn-access-server-and-active-directory-radius/
https://openvpn.net/vpn-server-resources/keeping-openvpn-access-server-updated/

****Configure settings in cli
https://openvpn.net/vpn-server-resources/managing-settings-for-the-web-services-from-the-command-line/

***Self signed Certificates and import certificate
https://openvpn.net/vpn-server-resources/managing-settings-for-the-web-services-from-the-command-line/

Verify authentication for a user:

cd /usr/local/openvpn_as/scripts
./authcli –user –pass

How to Create list of GCP Instance / service account across all projects

bts145Leave a comment 
Below code to list all instances across GCP Projects

PROJECTS=$(gcloud projects list --format="value(projectId)")

for PROJECT in ${PROJECTS}
do
  echo "Project: ${PROJECT}"
  # Extracts ACCOUNT_ID, EMAIL (==ACCOUNT_ID@...), DISABLED
  #ROBOTS=$(\
  #gcloud compute instances list --project=${PROJECT} --format="csv(name,disks[].guestOsFeatures[0].type[],networkInterfaces.networkIP)"
  gcloud compute instances list --project=${PROJECT}  --format="csv(name,disks.licenses.scope(licenses),networkInterfaces.networkIP,selfLink.scope(projects),status)"

done

The below code is to list all service account in GCP across all Projects

for PROJECT in ${PROJECTS}
do
  echo "Project: ${PROJECT}"
  # Extracts ACCOUNT_ID, EMAIL (==ACCOUNT_ID@...), DISABLED
  ROBOTS=$(\
    gcloud iam service-accounts list \
    --project=${PROJECT} \
    --format="csv[no-heading](displayName.encode(\"base64\"),email,email.split(\"@\").slice(0),disabled)")
  for ROBOT in ${ROBOTS}
  do
    # Parse results
    IFS=, read ENCODED_NAME EMAIL ACCOUNT_ID DISABLED <<< ${ROBOT}
    NAME=$(echo -e ${ENCODED_NAME} | base64 --decode)
    echo "  Service Account: ${NAME}"
    echo "    Disabled: ${DISABLED}"
    echo "    Email: ${EMAIL}"
    # Keys
    # KEYS=$(\
    #    gcloud iam service-accounts keys list \
    #    --iam-account=${EMAIL} \
    #    --project=${PROJECT} \
    #    --format="value(name.scope(keys))")
    #for KEY in ${KEYS}
    #do
    #  echo "    Key: ${KEY}"
    #done
 done
done

SQL Server – Cluster resource ‘IP Address type ‘Ip Address’ in clustered role failed

bts145Leave a comment

The above error might occur when you are not able to failover to secondary replica in a Availability Group.

We need to check the Cluster and Listener Port. Both should be different and verify and its not in use by any other services. Type the below command in Powershell to check the Listener and Cluster Port ,IP

Powershell script to check sql server availability group port and cluster port

Get-ClusterResource | Where-Object {$_.ResourceType.Name -like "IP Address"} | Get-ClusterParameter | Where-Object {($_.Name -like "Network") -or ($_.Name -like "Address") -or ($_.Name -like "ProbePort") -or ($_.Name -like "SubnetMask")}

GCP Find and change the Dataflow service account / Add Project Owner permission to GCP Buckets

bts145Leave a comment

Please follow these below steps –

1.Either you can create a service account [1] or use another service account except the default one. Please make sure that it has the roles/dataflow.admin and roles/dataflow.worker roles.

2.If you want to create a DataFlow Job using the template in the DataFlow console, you need to click on “SHOW OPTIONAL PARAMETERS” once you select the template. After clicking on the “SHOW OPTIONAL PARAMETERS” , there you will find the “Service account email” option where you need to provide your specified service account name.Please go through attachment “template-job-service-account.pdf”.

3.If you want to create DataFlow job using Apache Beam Python API, please follow the below code snippet,

—– Use the –service_account_email option and specify your service account when you run your pipeline job: –service_account_email=your-desired-service-account-name@<project-id>.iam.gserviceaccount.com

4.If you want to create DataFlow job using Apache Beam JAVA API, please follow the below code snippet,

—- Use the –serviceAccount option and specify your service account when you run your pipeline job: –serviceAccount=your-desired-service-account-name@<project-id>.iam.gserviceaccount.com

Find the Service account Used by a Dataflow Job

1.Please go to the Cloud DataFlow.
2.Select the DataFlow Job.
3.Once you select any particular JOB, Job ID will appear in the right side pane. Please take the JobID.
4.Go to Cloud Logging and write the following query
—-protoPayload.methodName=”dataflow.jobs.create”
“2021-06-19_23_43_39-24388466012345644878”
5.Where “2021-06-19_23_43_39-24388466012345644878” is the sample JOB ID. You need give your JobID
6.Once the result will come, please click on it and then click on “expand nested fields”
7.The log will be opened as a JSON and do a check for the “request” part.
It be look like “request”: {
“job_name”: “product-hierarchy-bq-to-gcs-2021620_test”,
“job_id”: “2021-06-19_23_43_39-243884660123456878”,
“serviceAccount”: “777777777-example@developer.gserviceaccount.com”

Adding Project Owner Editor, Viewer Permission to bucket

When the Permission of the bucket is Access Control – Fine Grained

And the bucket doesn’t have Project Owner Editor, Viewer Permission to bucket
a. “gsutil acl set private gs://ibucket name>”
b. “gsutil acl ch -p editors-:O gs://”
c. “gsutil acl ch -p viewers-:O gs://”
project no – The Project number of the project (get it from the dashboard of the project)
bucket name – The Name of the bucket

AWS CLI Commands

bts145Leave a comment 
aws compute-optimizer get-recommendation-summaries --region ap-southeast-1 --query 'recommendationSummaries[?(recommendationResourceType==`Ec2Instance`)].summaries[]' --profile <name>-sing --output text

jq ".Findings[] | (.GeneratorId) + \",\" + (.AwsAccountId) + \",\" + (.CreatedAt|tostring) +\",\" + (.Title) +\",\"+ (.Description)  +\",\"+(.Remediation.Recommendation.Url | tostring)  +\",\" +(.Resources [] | .Type +\",\"+ .Id)" all_finding.json

Command line to find security hub findings 

aws securityhub get-findings --filters "{\"SeverityLabel\":[{\"Value\":\"CRITICAL\",\"Comparison\":\"EQUALS\"}],\"ComplianceStatus\":[{\"Value\":\"FAILED\",\"Comparison\":\"EQUALS\"}],\"WorkflowState\":[{\"Value\":\"NEW\",\"Comparison\":\"EQUALS\"}], \"RecordState\":[{\"Value\":\"ACTIVE\",\"Comparison\":\"EQUALS\"}] }" --max-items 1 --profile audit

AWS Workspace extract report with mail id (AWS Workspace report with username and mail id)

aws workspaces describe-workspaces --profile --region "ap-southeast-2" --query Workspaces[*].[UserName] --output text | Get-ADUser | Select UserPrincipalName,SamAccountName |Export-CSV Files.csv

Mail of Workspace users

Get-ADGroupMember -Identity “Access-AWS” | Get-ADUser | select UserPrincipalName,SamAccountName

====Instance list in the same order of the fields ===

aws ec2 describe-instances --query "Reservations[].Instances[].[PrivateDnsName,InstanceId,ImageId,InstanceType,State.Name,Placement.AvailabilityZone,Tags[?Key=='Name']|[0].Value,KeyName,Monitoring.State,VpcId,SubnetId,Platform,PrivateIpAddress,PublicIpAddress,CpuOptions.CoreCount]" --profile dev --output text

COST OPTIMIZATIION

Workflow for EBS Deletion:
————————–
1.Script to check for all UNattached EBS in an Account
2.Scan for Retain Tag. Ex: Key = Backup:Retain and Value = Do Not Delete
3.If above tag is added then ignore the volume (NOT to delete it)
4.Else Delete the EBS irrespective of any other tags..
5.This script should run at 21:00 hrs AEST on SUNDAYS only.

Print Page from Online Magazine

bts145Leave a comment

Print the page to PDF

The first step is to get a PDF printout of the web page. We use Chrome for this but this can be done in Firefox as well:

  1. Open in a browser: Open Chrome and visit the web page you want to take a screenshot of.
  2. Disable print CSS media: If you try to print the page now, printer only CSS styles will be applied. This usually hides elements and changes colours on the page to make it more printer friendly.To fix this, go to View > Developer > Developer Tools, click the three dots in the top right corner, go to More tools > Rendering and set Emulate CSS media to screen. Keep the developer tools open for now or this setting change will be reverted.
  3. Set screenshot size: By default, printouts will likely be A4 sized in portrait mode with thick margins. You can remove the margins and set a custom page size in pixels for your screenshot by adding this snippet of CSS to your web page, making use of the <code>@page</code> selector :
@media screen {
    @page {
        margin: 0;
        size: 1280px 800px;
    }
}
  1. Print to PDF: To print the page, go to File > Print, make sure background graphics is ticked in the advanced settings so everything is printed, select Save as PDF and save the file somewhere. We’ll use the filename screenshot.pdf here.

Open the PDF in Reader, zoom to 400% Select the using the tools and paste in ms paint save as jpeg

Use the JPG to PDF Freeware utility from http://www.compulsivecode.com/