All posts by Frank Contreras

Uncategorized

Install VirtualBox on Mac Mojave

The developer team identifier or KEXT of the install is not trusted by the operating system. There’s no way to allow an exception through the regular interfaces for the installer to successfully run. One must manually add the developer team identifier so that it can run. This is done in recovery mode. Unless you’re a developer used to hacking your Mac to allow things like this to happen, you’d never get it done.

Many thanks to “rayan a” for providing the solution:

https://forums.virtualbox.org/viewtopic.php?f=8&t=89769


Re: Unable to run on Mojave

Post

by ryan a » 29. Jan 2019, 21:33I was able to get the kernel extensions to load the KEXTs without user approval by adding the VirtualBox Apple Developer Team ID in spctl kext-consent

I used the following command to get the Team ID: codesign -dv --verbose=4 /Applications/VirtualBox.app
Result: TeamIdentifier=VB5E2TV963

  1. Turn on your Mac, then immediately press and hold Command-R to start up from macOS Recovery.
  2. Select Disk Utility from the Utilities window, then click Continue.
  3. From the Disk Utility sidebar, select the volume that you’re using, then choose File > Mount from the menu bar. (If the volume is already mounted, this option is dimmed.)
  4. Then enter your administrator password when prompted.
  5. Quit Disk Utility.
  6. Choose Terminal from the Utilities menu in the menu bar.
  7. Type the command:spctl kext-consent add VB5E2TV963
  8. When done, choose Apple () menu > Restart.
Uncategorized

Get CPU Usage Using PowerShell

So I’m writing a script to do a process dump of IIS CPU utilization goes to 100% and an IIS Worker Process of an app pool is to blame. I’ve done all kinds of searches and it seems many have bits and pieces of the solution, but not the entire thing and in a clean little package.

What we really want is to be able to get all the data that Task Manager produces on on the Process tab, but do it in PowerShell so we can parse the results and act on it.

Here’s the PowerShell script to continuously display the overall percent usage of CPU with a break out of the processes that are actually consuming CPU. I wanted a clean list, so I filtered out all the 0% processes.

Usage:

-Loop switch to continuously loop

-ComputerName to sample remote machine. No parameter assumes localhost.

Param(
    [Parameter(Mandatory=$false)][String]$ComputerName = "localhost",
    [Parameter(Mandatory=$false)][Switch]$Loop
)
function GetTotalCPU {
   $cpu = Get-Counter -ComputerName $ComputerName -Counter "\processor(_total)\% processor time"
   $cpu = [math]::Round($cpu.CounterSamples.CookedValue) 
   return $cpu
}
function GetRawProcessData {
    $Procs = (Get-Counter -ComputerName $ComputerName -Counter "\process(*)\% processor time" -ErrorAction SilentlyContinue).CounterSamples | Where-Object { $_.CookedValue -ne 0}
    $idle = ($Procs | Where-Object {$_.InstanceName -eq "idle"}).CookedValue
    $total = ($Procs | Where-Object {$_.InstanceName -eq "_total"}).CookedValue
    $Procs | ForEach-Object {
        $_.CookedValue = [math]::Round($_.CookedValue/$total*100,1)
        $_.InstanceName = $_.Path.Substring($_.Path.indexof("(")+1)
        $_.InstanceName = $_.InstanceName.Substring(0,$_.InstanceName.indexof(")"))
    }
    return $Procs
}
function GetRefinedProcessData ($Procs) {
    $procsList = @()
    $idProcess = (Get-Counter -ComputerName $ComputerName -Counter "\process(*)\ID Process" -ErrorAction SilentlyContinue).CounterSamples
    foreach ($Proc in $Procs) {
        $procName = $Proc.InstanceName
        $procPID = $idProcess | ? {$_.Path -match $procName } | Select-Object CookedValue
        $procPID = $procPID.CookedValue
        $procCPU = $Proc.CookedValue
        if ($procName -ne "_total") {
            $procsList += New-Object PSObject -Property @{Name = $procName; PID = $procPID; CPU = $procCPU}
        }
    }
    return $procsList
}
do {
    $cpu = GetTotalCPU
    $Procs = GetRawProcessData
    $ProcsList = GetRefinedProcessData $Procs
    clear
    "{0} CPU: {1}%" -f $ComputerName, $cpu
    $ProcsList | Sort-Object CPU -Descending | FT Name, PID, @{Label="CPU"; Expression={"{0}%" -f $_.CPU}}
}
while ($Loop)
Microsoft, Scripting

SSH from PowerShell with Posh-SSH

For more information on Posh-SSH:  https://github.com/darkoperator/Posh-SSH

This module is for Windows PowerShell 3.0 or above. It is compiled for .NET Framework 4.5.

Install-Module -Name Posh-SSH

Here’s a simple script that grabs credentials from a file.  See this other article for more on password management.  It uses the credentials to open a new SSH session to the remote computer and execute the pwd command and returns the results of that command.  Then, it closes the SSH session.

$computerName = "computername.domain.com"
$userId = "myUserId"
$pwd = Get-Content "$PSScriptRoot\$userId.Pw.txt" | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList $userId, $pwd

try {
    "Attempting SSH to $computerName"
    $sshSession = New-SSHSession -ComputerName $computerName -Credential $creds -AcceptKey -ConnectionTimeout 10 -ErrorAction Stop
    $sessionId = $sshSession.SessionId
    "Session $sessionId opened."
    $command = "pwd"
    "Command: {0}" -f $command
    $sshOut = (Invoke-SSHCommand -SessionId $sessionId -Command $command).Output
    "Results: '{0}'" -f $sshOut
    Remove-SSHSession -SessionId $sessionId | Out-Null
    "Session $sessionId closed."
}
catch {$_.exception.Message}
Microsoft, Scripting

Script to set an encrypted password for later use

Periodically passwords on service accounts need to be updated as all information security best practices recommend.  Many shops may not have automated tools that would do this for all their scripts.  Many PowerShell scripts may be set to read an encrypted password file.  Naturally, this would break after a password update.  I needed a quick tool for administrators to quickly update these password files by allowing them to do the input it twice to prevent typos method.  So here it is.  The file is stored in a text file ending with “.Pw.txt”

# Input and validate password and store encrypted in file for later use.

$userId= "myUserID"
$pwFile = "$PSScriptRoot\$userId.Pw.txt"

do {
    $password1 = Read-Host "$tryAgain`Enter $adminId Password: " -AsSecureString
    $password2 = Read-Host "Verify $adminId Password: " -AsSecureString
    $check1 = ([Runtime.InteropServices.Marshal]::SecureStringToBSTR($password1)).ToString()
    $check2 = ([Runtime.InteropServices.Marshal]::SecureStringToBSTR($password2)).ToString()
    if ($check1.SubString(0,($check1.Length)-4) -eq $check2.SubString(0,($check2.Length)-4)) {$pwMatch = $true}
    else {$tryAgain = "Passwords did not match, try again.`n"; $pwMatch = $false}
}
Until ($pwMatch)

$password1 | ConvertFrom-SecureString | Out-File $pwFile -Force

If you really need to make sure the password was properly encrypted, then you can use this script to recover it back into plain text. Use this sparingly and don’t leave the script lying around to be used. One may choose to use NTFS to lock down read to the password file even further. However, here it is:

# get the iLO password and convert to plain text
$userId= "myUserID"
$pwFile = "$PSScriptRoot\$userId.Pw.txt"

$SecurePassword = Get-Content $pwFile | ConvertTo-SecureString
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)
$UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

$UnsecurePassword

Here’s an example to securely pull the password into a credential pair for use in many commandlets as $creds:

$userId= "myUserID"
$pwFile = "$PSScriptRoot\$userId.Pw.txt"
$pwd = Get-Content $pwFile | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList $userId, $pwd
Uncategorized

Build a basic Kubernetes lab

Lab to build one Master and two slave nodes.

Use kubeadm tool to bootstrap the environment. (https://kubernetes.io/docs/tasks/tools/install-kubeadm/)

  1. Build three Linux (ubutnu 14.04.4 LTS) virtual machine as kubernetes hosts.
    1. Install the OS
      1. Select OpenSSH server as an option.
    2. Assign static IP Addresses(10.0.51.0/24) ex. kube-master 10.0.51.10; kube-node1,2,3 10.0.51.11,12,13).  The snippet below is an example config file for the regular Ubuntu 16.04 distribution.  If you’re using Ubuntu on Azure, configure a static IP through the portal or CLI. 
      nano /etc/network/interfaces
# The primary network interface
auto ens32
#iface ens32 inet dhcp
iface ens32 inet static
address 10.0.51.12
netmask 255.255.255.0
gateway 10.0.0.1
dns-nameservers 8.8.8.8
    3. swapoff -a
    4. REM out swap file in /etc/fstab (swap is disabled by default on Azure 16.04 Ubuntu image.)
  1. Install Docker on all three: (https://docs.docker.com/install/linux/docker-ce/ubuntu/#upgrade-docker-ce-1
    https://www.itzgeek.com/how-tos/linux/ubuntu-how-tos/how-to-install-docker-on-ubuntu-16-04.html)

    1. Current (7/2018) Kubernetes release requires 17.03.x
    2. Update repository cache: 
      apt-get update
    3. Install package for https and certificates: 
      apt-get install -y apt-transport-https software-properties-common ca-certificates curl
    4. Add GPG key for Docker repository: 
      wget https://download.docker.com/linux/ubuntu/gpg 
apt-key add gpg
    5. Add the Docker repository: 
      ### Ubuntu 16.04 ###
echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu xenial stable" | sudo tee /etc/apt/sources.list.d/docker.list

### Ubuntu 17.10 ### 
echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu artful stable" | sudo tee /etc/apt/sources.list.d/docker.list

#### Ubuntu 14.04 ###
echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu trusty stable" | sudo tee /etc/apt/sources.list.d/docker.list
    6. Update apt database: 
      apt-get update
    7. If installing from the official Docker repository, you’ll see the desired version.  Ubuntu default repository may not have the desired version.  Run the following to see the list: 
      apt-cache policy docker-ce
    8. Look for the latest 17.03 release: 
      17.03.2~ce-0~ubuntu-xenial 500
  500 https://download.docker.com/linux/ubuntu xenial/stable amd64 Packages
    9. Specifically install Docker 17.03.2: 
      apt-get -y install docker-ce=17.03.2~ce-0~ubuntu-xenial
    10. Verify that 17.03.2-ce is installed: 
      docker version
  2. Install kubeadm on all three (kubeadm, kubelet, kubectl)
    1. Install the apt-transport-https package: 
      apt-get update && apt-get install -y apt-transport-https curl
    2.  Add Google GPG key: 
      curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
    3.  Add the sources list into sources.list and update repository: 
      cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
deb http://apt.kubernetes.io/ kubernetes-xenial main
EOF
apt-get update
    4.  Install kubeadm and related tools: 
      apt-get install -y kubelet kubeadm kubectl
  3. Initialize the master server.  On the kube-master node: 
    kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=10.0.51.10
    1. As a regular user, run the following commands: 
      mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
    2. Collect the kubeadm join command to set things up on the other nodes.  The tokens expire after 24 hours.  If later, you’d like to add another node, one would need to generate another token.  Do this on the master: 
      kubeadm token create

      A new token will be created.  Take the same command that was generated to join and substitute the old token for the new one.

  4. Set up a POD Network (cluster network) for communications between cluster nodes.  On the master node: 
    kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml
    1. Check if CoreDNS pod is running to verify pod network is installed: 
      kubectl get pods --all-namespaces
    2. ensure that kube-dns-* is running before joining worker nodes.
  5. Join worker nodes to the master node
  6. Run the kubeadm join command previously collected on all the worker nodes.
Microsoft, Scripting

Credentials Management in PowerShell

This blog is plagiarized from the best article I’ve ever found on this subject.  Full credit to Kris Powell for this amazing article found here.

Here are my condensed notes for my use.  If you find it useful, give a shout out to Kris Powell.

We now know how to convert a SecureString to an encrypted standard string. We can take any method we like to get a SecureString, convert it to a standard string and then save it to a file. Here is an example of each:

Exporting SecureString from Plain text

"P@ssword1" | `
ConvertTo-SecureString -AsPlainText -Force | `
ConvertFrom-SecureString | `
Out-File "C:\Temp 2\Password.txt"

Exporting SecureString from Get-Credential

(Get-Credential).Password | `
ConvertFrom-SecureString | `
Out-File "C:\Temp 2\Password.txt"

Exporting SecureString from Read-Host

Read-Host "Enter Password" -AsSecureString |  `
ConvertFrom-SecureString | `
Out-File "C:\Temp 2\Password.txt"

Anyone of these examples should provide you with a Password.txt file that has an encrypted standard string the represents the password.

When you need to use this encrypted password, you simply reverse the process by importing the data from your file and use ConvertTo-SecureString. If all you need is a SecureString, you can stop there. You could even take it a step further and create a PSCredential object.

Creating SecureString object

$pass = Get-Content "C:\Temp 2\Password.txt" | ConvertTo-SecureString

Creating PSCredential object

$User = "MyUserName"
$File = "C:\Temp 2\Password.txt"
$MyCredential=New-Object `
-TypeName System.Management.Automation.PSCredential `
-ArgumentList $User,
(Get-Content $File | ConvertTo-SecureString)
Microsoft, Scripting, Uncategorized

Get a certificate with Subject Alternative Names using certreq

If one needs to use certreq to obtain a certificate, but the certificate signing request does not explicitly ask for it, here’s the command to get it anyway:

certreq -f -q -submit -attrib “CertificateTemplate:WebServer\nSAN:dns=<hostname>&dns=<hostname>.mydomain.com&ipaddress=<IP Address>” -config “<Config Name>” <Certificate Request File>.csr <Certificate File>.cer

The key part is in the attrib string following the new line “\n” bit where SAN: is then defined.  In this example, three are defined: the hostname, fully qualified domain name and the IP address.