Virtualization, Cloud, Infrastructure and all that stuff in-between

My ramblings on the stuff that holds it all together

RBAC required for Granting JIT access to an Azure VM for a standard user

Azure JIT is a great feature for temporary access to Jump boxes that I use in my home lab – Bastion is better, but I’ve not got as far as setting that up because of some constraints on the networks I created.

I like JIT via the Azure portal as it gives you a quick & dirty way to ensure there is MFA (as long as your AAD account is MFA-enabled to access the Azure portal) behind setting up an RDP request to the jump box (and limited by source port and the firewall rule automatically revoked afterwards by JIT) without having to setup brokers, 2FA sources, more complex security arrangements.

I recently had to share one of these machines with someone else in my AAD org, but despite having reader roles at the Azure subscription they got an error when invoking the JIT role or asking for it by leaving your RDP ports open to the entire Internet – note if you’re making the connection on a shared network behind a NAT like a corporate LAN or university everyone else behind that NAT will also get RDP access to this server; so you still need good password-level authentication to the jump box.

So, a custom RBAC assignment was required (it works ok for owners/contributors at the subscription level).

This Microsoft GitHub page has discussion of the roles required (last post where the case is closed) so I had to create a custom role as shown below, note the Microsoft.Network/*/read permission didn’t exist when I tried it, but as my user has reader at the subscription anyway this wasn’t required for me – So your mileage may vary.

Or, if you prefer the JSON

{

    "properties": {

        "roleName": "VINF_NET-Request-JIT-Access",

        "description": "custom role required for non-global admins to invoke JIT",

        "assignableScopes": [

            "/subscriptions/YOUR_SUBS_ID_HERE"

        ],

        "permissions": [

            {

                "actions": [

                    "Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action",

                    "Microsoft.Security/locations/jitNetworkAccessPolicies/read",

                    "Microsoft.Security/policies/read",

                    "Microsoft.Compute/virtualMachines/read"

                ],

                "notActions": [],

                "dataActions": [],

                "notDataActions": []

            }

        ]

    }

}

 

Hope that helps

 

POSH1Liner – Add sequential DNS A records

When setting up a new environment you often need to create a bunch of sequential DNS A records, with reverse look up PTR records.

For example, I do this in my home lab – this 1-liner creates hosts 1..16.

You can adjust the server naming convention by editing the $name variable to suit and editing the -ZoneName parameter to match your environment.

Likewise, you can adjust to fit your IP addressing schema by editing the $ip variable/

To start at a different number (mine start from 1), adjust the $num = 1 statement.

 
for ($num =1; $num -le 16; $num++) { $name="L1-slot" + $num ; $ip = "172.16.10." +$num ; Add-DnsServerResourceRecordA -Name $name -ZoneName "theBORG.int" -AllowUpdateAny -IPv4Address $ip -CreatePTR ; }

 

In my example I’m running this on my lab Windows DC/DNS server (home lab, not production!), if you’re doing it from a different server you can add a -ComputerName “yourDNSserver.local” parameter to point it at your DNS server.

Note the use of the semi-colon ; to pass multiple PowerShell commands on a single line making it easier to cut & paste this command.

If you’re doing this ‘for real’ outside your own lab you can also use the -WhatIf parameter to see what would happen.

Blogged here for the next time I need to do this!

LonVMUG Socially-Distanced Edition Recordings

Due to the current situation (how sick of hearing that are you..?) we had to hold our April 30th London VMUG meeting online, instead of face to face in London.

I was a little skeptical as to how well this would work – but I have to say I was absolutely blown-away by how well it worked, I’m well used to doing Skype, Zoom, WebEx etc. for work meetings – but generally not for a whole day and in a less governed setting and, unlike a lot of work meetings EVERYONE managed to mute themselves when not speaking (my pet peeve!) and we didn’t have to play mute-police.

There was some great banter during the breaks, a majority of people used their video and it was >almost< like one of our normal f2f meetings and at one point we went over 80 participants, which I think was great for our first virtual outing.

We recorded the fun and you can find the video on YouTube here. a write-up from @rimmergram and our very own star-presenter Katherine.

@GarethEdwards86 did a great job helping the 4 of us on the normal London team drive Zoom and ensure the transitions went well (except for the bit where I forgot how Zoom worked) so thanks to Gareth it all went pretty smoothly

Fingers crossed for our next meeting on July 16th – details here

What did you think? do virtual VMUGs work – even post-COVID is it something we should consider doing more often?

Also, vmug.com/London is working again now 🙂

 

Pairing IKEA FLOALT lights with more than one wireless remote controller

I now have a pair of IKEA Floalt LED panel lights in my home office, during winter these add a great amount of natural-ish light (with controllable colour temperature/brightness) to my desk-space when there isn’t much coming in from outside.

The website lists the 30x90cm panels as £115 but I managed to get a pair for £80 each in the Greenwich store – you may have similar luck.

Each panel comes with its own wireless remote (TRADFRI), from the instructions it’s straight forward enough to pair each remote (1:1) with a panel.

If you want a single remote to pair with multiple panels you just rinse and repeat the pairing process with each panel (I found I had to switch them off at the power to make it sync up after pairing)

But, it’s not obvious how you have have the 2 remotes working at the same time to control multiple panels. So, for example you have a control by the door and one on your desk (so you don’t need to get up to change the lights, lazy? yes.. but).

So, to do this you need to follow these steps..

  1. Press the pairing button on the remote 4 times in quick secession, do this on both remotes to be safe as they both need to be un-paired for this to work.
  2. Hold the two remotes next to each other and hold the pairing button for 10 seconds – red light on the remote will come on and then fade – the remotes are now paired with each other
  3. Hold either of the remotes to the first panel and pair as normal (press the pair button for >10 seconds), panel will flash.
  4. Repeat step 3 for the remaining panels that you want to be controlled by these remotes
  5. Now, when you turn on/off dim etc. you can use either remote and all the lights in the set will have the same brightness/colour temperature.

I hope that helps someone, it took me a while to figure out, most of the online articles relate to the smartphone gateway and app which I don’t have.

On the whole, I can’t recommend these panels enough, they’re great.

UKVMUG 2019 Summary and Links

We held the 9th annual UKVMUG in 2019 at the National Space Centre in Leicester recently, it was a fantastic event attended by approximately 400 people enjoying a great mix of community, sponsor and VMware content.

Selected sessions from the Sir Patrick Moore Planetarium were recorded and can be found on our YouTube channel (along with the last couple of years content)

You can also find the slides from most of our presenters at this link

I’ve also uploaded the photos from the event, and you can find them at this link

Hope to see you next year, or at a local VMUG meeting in the meantime..!

 

What to drink when you’re not drinking

I have a problem, it’s not technically with alcohol it’s more that drinking alcohol *really* doesn’t agree with some medication I take for a very painful nerve problem so this isn’t an I’m getting sober post, it’s more I have to be sober, I like(d) drinking.. a lot. So, what do I do to make it suck less?

I generally work in London, a large historic and cosmopolitan city where driving to work is either really expensive, or takes way too long and despite our general genetic predisposition as English people to complain about it we generally have a pretty good public transport system. A side-effect of this is that social drinking after work is commonplace rather than a rarity.

Drinking soft-drinks all evening just isn’t pleasant for me, too much sugar or artificial sweetener, and given I like(d) beer… a lot I’ve tried to find something that still tastes like beer without the dizzy juice bit, you may ask what’s the point? well it still /feels/ like you’re out, being sociable – and if you like(d) the taste of beer that part is self-explanatory

Availability of low (0.5%)/no (0%) alcohol drinks in bars, pubs and clubs in London is very poor, maybe a dusty bottle in the fridge. it has got noticeably better in the last year but products available are generally at the awful end of the scale.

Since my unplanned diversion into sobriety I’ve experimented with many of the alcohol alternatives (in the name of science, obviously dear reader) and here is my top 8 (there are so few I couldn’t even make a top 10 and the last 3 are touch and go!) that you can purchase to drink at home (…or sneak into the pub and consume at your warm :/ leisure), sadly most of these are only available in shops rather than pubs

  1. Adnams Ghost Ship Alcohol free
  2. Infinite Session Ale
  3. Brewdog Nanny State
  4. Estrella FreeDAMM – I’ve only found this in Spain so far but understand Morrisons stock it
  5. Sin – I’ve only seen this in Lidl in Spain
  6. Heineken 0 if it’s the only choice
  7. Peroni Libera – this is where we start scraping the bottom of the barrel, literally
  8. Budweiser Prohibition – about my tolerable limit of drinkable, if I have to.

My Avoid at all costs list – e.g. drink if someone is holding a gun to your head and making you do it..

  • Becks Blue (very common, but disgusting)
  • Cobra Zero (zero taste, dishwater is tastier)
  • San Miguel 0 (to be fair the >with< alcohol version doesn’t taste much better

The only drinkable one I’ve found in pubs that is on my top 8 is Nanny State (v.nice, but not that common) or Heineken (more common, ok-ish) However, never fear.. Brewdog have their own chain of pubs and cafes in the UK – the one in Tower Hill usually has Nanny State on DRAFT… yes DRAFT, cold, cold in a proper pint glass DRAFT. and they do great food too – BrewDog I love you – highly recommended if you’re in the UK

Overall the situation is getting better, but still has a way to go. Given the choice is so poor in post pubs I’ve generally taken to bringing my own, which isn’t really in the spirit of things, warm :/ and I’m sure the pub owner would not be happy with that. So, if you own a pub.. maybe time to widen your horizons for us, the leppers of London post-work society 🙂

If you’ve found something (or somewhere better).. feel free to post it in the comments below, I’d love to hear from you.

Announcing vFACTOR 2019 at UKVMUG

I’m passionate about getting people to come and experience all the great things you can get from a VMUG, whilst the London and UK VMUG are very lucky to have great support from VMware and our sponsors it’s hard to find people in the community who are willing to ‘stand-up’ and talk about their experiences.

 

So, I’d like to announce that we are intending to run our vFACTOR initiative at the UK VMUG in November this year – it’s a whole-day multi-track event held at the National Space Centre (our 2nd year there and I think our 9th UK VMUG event in total) – click here for some videos of previous events for a flavour of what goes on).

In exchange, for you preparing and delivering a short (up to 10min) presentation we are offering the following fantastic prizes..

  • 1st Prize: Ticket & Travel/Hotel to VMworld 2020 (EU/US)

  • 2nd Prize: iPhone X (or whatever latest available model is by Oct 31st)

  • 3rd Prize: £500 Amazon voucher

  • 4th & 5th Prize £100 Amazon voucher

  • The Rules

    • New community presenters who have never presented at a VMUG before
    • Not open to VMware staff or sponsors (although we love you too)
    • 5 slots at UKVMUG on 27th November (Leicester), organising team will shortlist and announce 5 finalists + 1 reserve by 5th October
    • 10 min. slot per entrance
    • Once entrance per person accepted for entry, but feel free to submit multiple sessions
    • Entry via http://tinyurl.com/VMUG-CFP before September 30th (EXTENDED from 15th!)
    • Support, mentoring, preparation are offered from LonVMUG team and we’ll help you through the process of preparation and delivery
  • Winner decided by audience vote on the day

We ran this once before at the London VMUG in 2014 and I have to say since then, all participants have gone on to further their own professional brand and career – one of the winners (@bfd_diplomacy) is now on the VMUG board of directors and helps organise the London & UK VMUGs others have gone on to other subsequent greatness like passing their VCDX.

vFACTOR is intended to encourage, cajole and frankly… bribe! people (in a non-HR or compliance department related sense) to come and share their experiences – I’ve written about this in the past, so please read on if you instantly think you don’t have something to offer.. all we ask for is that spark of imagination..

 

I’m nervous, I’m no Duncan Epping, or Frank Dennemann  I can’t do public speaking

We all have been here, we’re a friendly crowd and it’s an excellent way to learn some important life & professional skills. To help with this, we – the organising committee would like to help, we can help you prepare, dry-run and fine-tune your presentation prior to the event.

I cant think of anything to talk about

We all have great experience from environments small and massive – I’ve personally found the best way to capitalise on this knowledge is to share it with others, having to distil it down to a presentation or blog post is a great way to help you focus on the important facts of what you did and how you did it – I have a tendency to whitter on (if you’ve read this blog for a while you already know this!) and doing this is an excellent tool, especially if you have to explain it to someone outside of your organisation

I work for a 3 man band company, nobody is interested in what I do

Wrong, I started my VMUGging talking about my 1 node home lab, you don’t have to have a data centre the size of the starship enterprise to have something interesting to say. Infact – I’d say from personal experience people from SMB type organisations have much more limited budgets and have to find far more creative ways to get things done

I work in a nuclear bunker, and I have access to your home address and browser history – I can’t talk about what I do

Now I know some of you maybe do work in nuclear bunkers, 3-letter govt. agencies or centres of commercial finance and are unable to talk about what you do for fear of exposing commercial secrets – I understand this, so do I.. My suggestion is that if you want to submit a talk – anonymise what you do – if you work for Goliath National Bank, just say you work for “a major bank”, or “an airline” – this is a VMUG, not Panorama. VMUG attendees are interested in the tech, what you did, how you did it & what could have gone better; not what impact it had on your Q4 financial results.

If you take this approach and remember to say you are not there as a company spokesperson, this is my own opinion etc. this is usually acceptable.

So, in closing I encourage you to submit a proposal and participate, what’s the worst that could happen? oh, and there are some great prizes on-offer!

 

 

UKVMUG December 13th National Space Centre Leicester

Next week, Thursday December 13th sees the next UK-wide VMware User Group (aka #UKVMUG, aka… UserCon{ference}) meeting

Please note we have a new, very cool venue this year – the National Space Centre in Leicester !

Proceedings start the night before (12th) from 7pm with our annual vCurry, register and come along for an informal evening with a light-hearted quiz and great discussions rounded off with a curry all set in the fantastic rocket tower… with an opportunity to press the LAUNCH button (not kidding..!)

TL;DR version: December 13th, National Space Centre Leicester – registration starts from 8.30am, excellent, relevant content, prizes, giveaways and conversations, finishes at 6pm. vCurry the night before (12th) from 7pm – good curry, conversations and a funny quiz.. be there, or miss out – go to https://www.vmug.com/Attend/VMUG-UserCon/2018/UK-VMUG-UserCon-2018 for more details and registration.

 

I thought I’d take this opportunity to show the agenda quickly (click for larger version) and hi-light the amount of community sessions being given, we the committee are all about making sure we put the U into VMUG and this year is no exception – all of the green squares are presentations given by people like you taking time out of their day to share their knowledge and experience. from relative new-comers to all-star VMUG and VMworld presenters.

We also have some excellent content from VMware official speakers, we take great care to work with VMware to ensure we get the best, most relevant technical content – make no mistake, these are no product pitches! if you didn’t make it to VMworld this is the next best thing, we also have super-stars Joe Baguley (EMEA CTO) and Duncan Epping (Chief Technologist, office of the CTO Storage & Availability) delivering keynote exhibitions in the planetarium

See the video below of the planetarium in action, not sure we’ll manage all the full effect of the planetarium however… although how cool would that be?!

We also have an excellent selection of sponsors speaking, platinum & gold sponsors are giving carefully solicited technical presentations, we advise and actively work with vendors to avoid generic sales pitches at our events… (as a long-time techie myself an RoI or Gartner slide is not what I come to a VMUG to see)

Our silver sponsors are joined with the gold & platinium sponsors in our solutions expo – over 30 sponsors showing off their latest & greatest products in the cool setting of the space exhibits and displays

We’ll also have representation from the many excellent VMUG groups around the UK The UK event is currently put on by the London VMUG committee with assistance from VMUG HQ but if you’re looking for a more local group come along and meet them (you can also see your local VMUG group here) there are currently around 7 groups in the UK from north to south.

As you’d expect there are many chances for give-aways, we have a great and eco-friendly VMUG branded cup, passport for prizes, and for one lucky winner there will be a free ticket to VMworld with contribution towards flight & hotel (winner must be present at time of drawing in final session to win).

If you’ve not been before, check out our YouTube channel to see what it’s all about.

If you can’t make it on the day, keep an eye on the #UKVMUG hashtag

Best of all? IT’s TOTALLY FREE

Tap, Tap… is this thing on?

Surveys at recent #LonVMUG events have proven that social media is dead. that, or people have lost the ability to raise their hands… I’ll let you decide.. however..

stay tuned.. blog post coming around 1pm tomorrow (UK time) with the details for next Thursday’s #UKVMUG event, prizes… an agenda in a more readable grid format (1980 called, it want’s its VMUG.com content management system back) prizes, vCurry.. prizes.. did I say prizes, oh, yes and more community content than ever before.

 

POSH1Liner Query Azure Active Directory – AAD from PowerShell

You need to install the module (it’s not installed by default) – full cmdlet list is here https://docs.microsoft.com/en-gb/powershell/module/Azuread/?view=azureadps-2.0

this is the new version, seems to use connect-azureAD rather than the connect-MSOLservice you may have used in the past and will work with MFA accounts as it pops a browser window for credentials

Install-Module AzureAD

For example;

Get-AzureADUser

 

will list out all the users synchronised to your AAD, and if you are wondering how to check how many have sync’d from your on-prem AD to AAD you can do

$data = Get-AzureADUser -All $True

Then checking the contents of the $data.count variable will tell you the total number of users in AAD