If you ever need to copy NTFS permissions of a folder, there is a quick PowerShell one-liner that will save your day:

Get-Acl C:\SourceFolder| Set-Acl D:\DestinationFolder

Have fun!

Apache Virtual Hosts are great because they let you host multiple websites on the same server. The public IP address can also be re-used – Apache knows, based on the HTTP host header, which website to show.

But have you considered this scenario? website1.com gets compromised and some malicious person has access to the server. What can they do? Most certainly they have access to every other website on the server because, by default, every Virtual Host runs under the same user www-data. Fortunately, there is a module that allows us to use different users for every Apache2 Virtual Host called apache2-mpm-itk.

It is very easy to install:

apt-get install libapache2-mpm-itk

a2enmod mpm_itk

If you face any issues, disable mpm-prefork and try enabling mpm_itk again.

a2dismod mpm_prefork

Now, in the Virtual Host config file, insert these lines (user www-site1 and group www-site1):

<IfModule mpm_itk_module>
AssignUserId www-site1 www-site1
</IfModule>

The user could be added with useradd:

useradd www-site1

Lastly, give owner rights to the new user and no one else.

chown www-site1:www-site1 -R /var/www/site1

Or even better, give the www-site user write rights on the upload folder. Everything else is readable only.

find /var/www/site1/ -type d -exec chmod 0755 {} \; #Change directory permissions rwxr-xr-x

find /var/www/site1/ -type f -exec chmod 0644 {} \; #Change file permissions rwxr-xr-x

chown ajni:ajni -R /var/www/site1/ # Let your useraccount be owner

chown www-site1:www-site1 -R /var/www/site1/uploads/ #Let apache be owner of upload folder

Oh yeah. Don’t forget to restart apache:

service apache2 restart

References:

https://cloudkul.com/blog/apache-virtual-hosting-with-different-users/

Active Directory Certificate Services is the Windows implementation of Public Key Encryption (PKI). ADCS is needed whenever you are hosting a web server that needs to encrypt data over the wire. Instead of buying a public certificate, you implement your own trusted internal Certificate Authority (CA), deploy the Root Certificate to your clients through GPO, and then you can create as many web server certificates as you want.

My deployment consists of two servers with Windows Server 2019. The first server will be the Offline Root Certificate Authority (offline because it will be offline for most of the time) and will not be part of the domain. The second server will be a domain member and will be the Issuing CA.

So on the first server, install the ADCS role on the Workgroup server in Server Manager:

Under Role Services, select Certification Authority.

After the role installation, proceed with the configuration.

This server will be the Standalone Root CA, the domain member will be an Enterprise Subordinate CA.

Create a new private key. SHA256 should be just fine for the hash algorithm with a key length of 2048.

Give the CA a name.

The offline Root CA should be valid for 10 years. The online CA for 5.

Here a recap of the settings we chose.

Before configuring the second server, let’s change the Authority Information Access (AIA) and the CRL Distribution Point (CDP). These must be reachable by clients at any time. Open the properties and head to extensions. Remove all the distribution points on the CDP and create these ones (I am not sure if IDP is needed, please let me know):

http://www.ajni.it/pki/<CaName>.crt

Change the validity period of the Subordinate CA certificate we are just going to issue and the CDP (5 years for the Subordinate CA and one year for the CDP):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\AJNI-Root-CA

Now let’s install and configure the second online CA server. The feature installation wizard is the same as on the first server. The configuration is slightly different.

Like previously mentioned, we are using an Enterprise Subordinate CA.

We are creating a new key. The hash algorithm is also SHA256 with a key size of 2048.

The certificate request will be uploaded to first server and digitally signed by the offline Root CA.

Here is once again the summary of all configured settings.

Now upload the certificate request file to the first CA. Open the Certification Authority MMC on the first server and submit a new request.

Under Pending Request you should see your request (it might take a few seconds). Here you can issue the certificate.

Save the signed certificate to a file as a DER format. Also, copy the Root certificate to the second server and install it in the local certificate store.

On the online CA, start the ADCS service and install the signed certificate from the offline CA.

Select the previously saved file.

You will probably get an error when attempting to start the service because the CDP is not reachable (http://www.ajni.it/pki/…). With pkiview.msc, you can check if the distribution point are reachable and up-to-date:

Now you will need a webserver where these files are going to be hosted. I will install IIS on the same server, but it is highly recommended to host it on a separate server.

Change IIS configuration to respond to requests with the DNS name www.ajni.it:

Create a DNS entry pointing to the server:

Create the CRL file on the offline Root CA and copy them to the IIS root folder (in my case it’s C:\inetpub\wwwroot\pki):

The file will be created under C:\cert. We’ll also need the Root CA file. The file name needs to be Ajni-Root-CA.crt though.

Here the file inside the IIS folder:

On pkiview.msc, everything should be green on the Ajni-Root-CA. When dealing with Delta CRL, IIS might block downloads because of double escaping. To solve that allow double escaping on IIS under Request Filtering:

Now that the CDP is reachable, the Subordinate CA can be started without any issues. Like on the Root CA, we have to change CDP and AIA locations:

file://C:\inetpub\wwwroot\pki\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

http://www.ajni.it/pki/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

With the above configuration, CRL and delta CRL will be automatically published to the IIS root folder.

Publish the first CRL manually (you need to revoke one certificate, otherwise, the list will not be created. Do that through certlm.msc). Afterward, everything should be green in pkiview.msc.

Publish both CRL and Delta CRL.

The files should be created inside C:\inetpub\wwwroot\pki. The Subordinate CA certificate has to be copied manually and named properly. You can ignore the fact that I have 2 Subordinate CA certificates. You should only see one.

Pkiview.msc is also happy:

After everything is set, you can shut down the offline CA. You only have to start it once a year when publishing the CRL.

At last, publish the Root certificate in Active Directory with certutil. This can be also achieved with GPO.

certutil.exe -f -dspublish AJNI-Root-CA.crt RootCA

If you are using Citrix MCS with Azure VMs, you might have noticed that not all the VM SKUs are available to select when creating a new Machine Catalog. With PowerShell, though, you can use any Azure VM SKUs.

If you are using Citrix Cloud, you have to download and install the Citrix Powershell SDK and login with your Citrix credentials. Optionally you could download an API client and authenticate with those credentials.

The secure client can be downloaded under Identity and Access Management > API Access > Create client. The customer id will also be shown on that page.

You authenticate with the API client this way:

Set-XDCredentials -CustomerId “customername” -SecureClientFile “C:\temp\secureclient.csv” -ProfileType CloudAPI

Otherwise, without API credentials, after executing the first command, you will be asked to insert your Citrix credentials:

Now the commands to change the Citrix MCS VM type.

Get-ProvScheme -ProvisioningSchemeName “CatalogName”

Take note of the folder name after XDHYP:\HostingUnits\ under MasterImageVM.

This command will register the virtual drive XDHYP:\ in PowerShell:

Set-HypAdminConnection

Insert that folder name in this command:

Set-ProvScheme –ProvisioningSchemeName “CatalogName” –ServiceOffering “XDHyp:\HostingUnits\Foldername\serviceoffering.folder\Standard_NV4as_v4.serviceoffering”

Delete and re-create the VM. The right VM type will be then used.

Normally, adding an Availability Set after the VM has been deployed is not possible. You would have to delete the VM, leaving the NIC and OS disk intact and then re-creating the VM with the Availability Set. Of course that can be done manually, but there is a PowerShell script that does this all for us.

This can be all done in the Azure Cloud Shell, you do not have to install the PowerShell Module on a Windows Machine.

Install-Module AzureRm.AvailabilitySetManagement

Create an AS before adding the VM to the AS.

New-AzureRmAvailabilitySet -Location “West Europe” -Name “myAs” -ResourceGroupName “myRg” -Sku aligned -PlatformFaultDomainCount 3 -PlatformUpdateDomainCount 5

Now add the VM to the AS:

Add-AzureRmAvSetVmToAvailabilitySet -ResourceGroupName “myRg” -VMName “VM01” -OsType windows -AvailabilitySet “myAs”

This will stop the VM if it is running, delete the VM item (leaving the NIC and OS disk intact) and re-create that with the same VM size inside the newly created Availability Set.

References:

https://pixelrobots.co.uk/2018/02/add-existing-virtual-machine-availability-set-azure/

https://gist.github.com/PixelRobots/3c34027d225c7acb09833840b7258ee9#file-movevmavaset-ps1