Blog Marcina Bojko

Linux,Windows,serwer, i tak dalej ;)

Posts Tagged ‘foreman

Petya(notPetya) ransomware attack and how to (quickly) vaccinate lot’s of machines

There was a lot of nice summary articles about latest „ransomware” attack caused by Petya. Soon, researchers started to claim almost permanent vaccine for this type of worm.

https://www.bleepingcomputer.com/news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak/

Even patched OS won’t save you from infection as one infected machine quickly spreads the infection using other protocols like WinRM.

So, how should one on its vast server farm vaccinate hundrets of machines?

For example, like this 🙂

win_manage:
  dsc_file:    
    petya_vaccine1:
      dsc_destinationpath: C:\Windows\perfc
      dsc_type: file
      dsc_attributes: readonly
      dsc_contents: ""
    petya_vaccine2:
      dsc_destinationpath: C:\Windows\perfc.dat
      dsc_type: file
      dsc_attributes: readonly
      dsc_contents: ""
    petya_vaccine3:
      dsc_destinationpath: C:\Windows\perfc.dll
      dsc_type: file
      dsc_attributes: readonly
      dsc_contents: ""

 

Written by marcinbojko

Lipiec 1, 2017 at 11:14

Does Foreman speak SQL? It does ;)

So, the question is – how to deploy and maintain farm of Microsoft SQL Servers? With different domains, install sources, roles, features. Should we create unattended installers for every single instance?

No, we shouldn’t.

We should use Powershell DSC – https://github.com/PowerShell/xSQLServer
With Foreman/Puppet and win_manage, we have something like:

The simplest way:

instance1:
  dsc_instancename: MSSQLSERVER
  dsc_sourcepath: "\\our.server.com\ourshare"
  dsc_sourcecredential:
    user: anonymous
    password: anonymous
  dsc_setupcredential:
    user: DOMAIN\someuser
    password: somepassword

Or, more sophisticated:

instance1:
  dsc_instancename: MSSQLSERVER
  dsc_sourcepath: "\\our.server.com\ourshare"
  dsc_sourcecredential:
    user: anonymous
    password: anonymous
  dsc_setupcredential:
    user: DOMAIN\someuser
    password: somepassword
  dsc_features: SQLENGINE
  dsc_forcereboot: true
  dsc_agtsvcaccount:
    user: DOMAIN\scvaccount
    password: somepassword
  dsc_sqlsvcaccount:
    user: DOMAIN\sqlaccount
    password: somepassword
  dsc_sqlcollation: SQL_Latin1_General_CP1_CI_AS
  dsc_sqlsysadminaccounts:
    - DOMAIN\someadmin
    - DOMAIN\someotheradmin
  dsc_securitymode: SQL
  dsc_sapwd:
  user: sa
  password: paaaswordisverysecure
  dsc_sqluserdbdir: D:\MSSQL\Data
  dsc_sqluserdblogdir: E:\MSSQL\Data
  dsc_browsersvcstartuptype: Disabled

Whole install from local source takes aprox. 400 seconds (with other OS related settings) to finish.

Written by marcinbojko

Styczeń 22, 2017 at 21:11

Hyper-V Integration Services en masse ;)

Yes, we all „love” the way Microsoft gives us new stuff (like forced updates in Windows 10). As we usually know better what and when should be applied, let’s say it is time to upgrade our guest integration services to the latest version.
I usually  express strong conviction that HV integration services should be kept up to date, the thing most sysadmins disregards. Those tools are responsible for keeping your VMs in shape, maintain communication between them and host services, so they SHOULD be always updates. Of course, as with almost everything TEST it before applying on any important environment.
As on 2016-12-31, the latest HV Integration Services version is 6.3.9600.18398

Let’s say – we would like to upgrade all our Windows machines (those BEFORE Windows 10 and Windows 2016) . We can do it manually (not cool, not cool at all), semi-automatic (no reboot) or almost … magical way – fully automatic 😉

Let’s start we have proper source added to Chocolatey:

choco source add -n=public -s"https://www.myget.org/F/public-choco" --priority=10
  • semi automatic (RDP, psexec, powershell)
    choco install hvintegrationservices -y
  • fully automatic (with reboot) using The Foreman and win_manage

    win_manage:
        chocolatey_packages:
          hvintegrationservices:
            ensure: 6.3.9600.18398
        dsc_reboot:
          dsc_reboot:
            message: Machine requested a reboot
            when: pending

 

Written by marcinbojko

Grudzień 31, 2016 at 15:14

Change local Administrator passwords. Oh … and unlock them :) On 10k+ machines :)

Administrator:
  dsc_username: Administrator
  dsc_disabled: false
  dsc_password:
    user: NT AUTHORITY\\SYSTEM
    password: P@$$w0rd

Written by marcinbojko

Listopad 26, 2016 at 13:52

Napisane w work

Tagged with , , , , , ,

Raw, unedited The Foreman/Puppet + Win_manage.

Written by marcinbojko

Październik 29, 2016 at 17:25

Napisane w Uncategorized, work

Tagged with , , , ,

Puppet & The Foreman & Powershell DSC – Windows Updates: Neverending story.

Nobody likes Windows Updates even Microsoft itself. But sometimes one should make sure, you have perks your system needs. But, we co do it old fashion way: check, update, reboot, repeat. Boring, and completly not in a way DevOps do.

Again, Win_manage to the rescue.

First we make sure what we want to do:

dsc_xwindowsupdateagent_schedule

first:
  dsc_dayofweek: sunday
  dsc_afterhour: 11
  dsc_usenotify: true


dsc_xwindowsupdateagent

security:
  dsc_updatenow: 'true'
  dsc_category: security
important:
  dsc_updatenow: 'true'
  dsc_category: important
optional:
  dsc_updatenow: 'true'
  dsc_category: optional

dsc_reboot

dsc_reboot:
  message: Machine requested a reboot
  when: pending

But what does it do? First, we should prepare update schedule: let’s say, we can start auto-updates on Sunday, after 11 AM (remember 11 AM = 11:00, and 11:00 PM=23:00)

Second: we want to install 3 type of updates: security, important and optional.

Third: we want to auto-reboot our machine (dsc_reboot) and notify us about pending updates count BEFORE and AFTER update patch set (dsc_usenotify: true)

So, we can switch from:

selection_426

to

selection_427

in a time needed to get some music 🙂

Written by marcinbojko

Październik 9, 2016 at 18:36

Puppet & The Foreman & Powershell DSC – The Road So Far.

During last few weeks I was able to push and heavy test puppet-dsc code in a lots of environments and setups.

We had sysprepped Windows Server 2012 R2 images (different versions, builds and setups), a lots of Windows 10 Professional Workstations (Original, 1511, 1607 builds), few Windows 8.1 Pro – really great statistic sample.

As for now:

  • Windows Server 2012 and Windows 2012 R2 – fully supported
  • Windows 8.1/10 (original)/10 (1511) – fully supported
  • Windows Server 2016/Windows 10 (1607) – unsupported due to parsing bug in Powershell 5.1 – Work in progress
  • Windows 7/8 – not tested
  • Windows 2008 R2 – not tested

Implemented modules:

  • Chocolatey – with features and sources support (adding, removing, modyfing)
  • DSC_WindowsFeature
  • DSC_WindowsOptionalFeature
  • DSC_Service
  • DSC_Environment
  • DSC_Group
  • DSC_xFirewall
  • DSC_Reboot

More code is coming, but this fine set allows you to deploy and manage a lots of types of servers and workstations.

Written by marcinbojko

Październik 7, 2016 at 19:47

%d blogerów lubi to: