Using a batch script to query NTP servers to extract current time from them for troubleshooting purposes.

Use the following code snippet and save the same as "ntpq.bat" . 

This is essentially useful for those who have a locked down laptop, where they can not introduce third party tools.

@echo off
if not "%1"=="" w32tm /stripchart /computer:%1 /dataonly /samples:3 %2 %3 & goto eof
:noparm
echo Syntax: ntp ^<pool.ntp.org^>
echo         ntp ^<pool.ntp.org^> /packetinfo
:eof

Set the correct path and invoke the query as follows:

ntpq time.windows.com

Alternatively you can use the following command to query an NTP server:

w32tm /stripchart /computer:us.pool.ntp.org /dataonly /samples:5

A fine article on how to set Windows Server act as NTP server can be found here:

https://icookservers.blog/2014/09/12/windows-ntp-server-cookbook/

Read More

What is the difference between Azure Application Gateway and Load Balancer?

Azure Application Gateway has the following capabilities:

• URL path-based routing.
  
• Host header support.
  
• Session cookie affinity.
  
• SSL/TLS termination.
  
• End-to-end SSL encryption.
  
• Web application firewall.
  
• Cross-region load balancing.
  
• Visual end-to-end diagnostics.
  

 

 

Whereas Load balancer has only capability to do the load balancing on the basis of IP Address and Port. 

There is this concept of HA ports in LB, which allows to forward all ports to a set of back-ends, rather placing individual rules for each port.

 

 

Read More

Azure Private DNS zone, Virtual Network Links, Recordsets and it's general usecases.

Azure Private DNS Zones:

Azure Private DNS manages and resolves domain names in the virtual network without the need to configure a custom DNS solution. By using private DNS zones, you can use your own custom domain name instead of the Azure-provided names during deployment.
 
Private zones work along with virtual networks. You use them to manage domains for virtual machines or other resources within and across virtual networks. Internet connectivity isn't required for name resolution.
 
To resolve the records of a private DNS zone from your virtual network, you must link the virtual network with the zone. Linked virtual networks have full access and can resolve all DNS records published in the private zone. You can also enable auto-registration on a virtual network link. When you enable auto-registration on a virtual network link, the DNS records for the virtual machines in that virtual network are registered in the private zone. When auto-registration gets enabled, Azure DNS will update the zone record whenever a virtual machine gets created, changes its' IP address, or gets deleted.

Azure DNS Private Zones enables you to create and manage private DNS zones for your Azure resources. These private zones are accessible only within your virtual network (VNET) or through peering connections and are not publicly visible on the internet.
 

This service is particularly useful for scenarios where you are hosting internal resources and need DNS for internal communication within a private network.

 

To resolve the records of a private DNS zone from your virtual network, you must link the virtual network with the zone. Linked virtual networks have full access and can resolve all DNS records published in the private zone. You can also enable autoregistration on a virtual network link. When you enable autoregistration on a virtual network link, the DNS records for the virtual machines in that virtual network are registered in the private zone. When autoregistration gets enabled, Azure DNS will update the zone record whenever a virtual machine gets created, changes its' IP address, or gets deleted.

Azure Private DNS has the following limitations:

• A specific virtual network can be linked to only one private zone if automatic registration of VM DNS records is enabled. You can however link multiple virtual networks to a single DNS zone.
• Reverse DNS works only for private IP space in the linked virtual network
• Reverse DNS for a private IP address in linked virtual network will return internal.cloudapp.net as the default suffix for the virtual machine. For virtual networks that are linked to a private zone with auto-registration enabled, reverse DNS for a private IP address returns two FQDNs: one with default the suffix internal.cloudapp.net and another with the private zone suffix.
• Conditional forwarding is supported using Azure DNS Private Resolver. 

After you create a private DNS zone in Azure, you'll need to link a virtual network to it. Once linked, VMs hosted in that virtual network can access the private DNS zone. 

Integration creation with code
User who is creating the integration with code needs next permission to Private DNS Zones.
 
Microsoft.Network/privateDnsZones/join/action
Permission is enough if private endpoints are created through the code.
 
Integration creation through the portal
User who is creating the integration through Azure portal, she needs also read permissions to zones (to be able to select zones in wizard, you can’t specify the resourceId of DNS zone in portal wizard). Give next permissions for user if they are creating the integration through the portal:
 
Microsoft.Network/privateDnsZones/join/action
Microsoft.Network/privateDnsZones/read.

- DNS ZONES 

A DNS zone is used to host the DNS records for a particular domain. To start hosting your domain in Azure DNS, you need to create a DNS zone for that domain name. Each DNS record for your domain is then created inside this DNS zone.
 
For example, the domain 'contoso.com' may contain several DNS records, such as 'mail.contoso.com' (for a mail server) and 'www.contoso.com' (for a web site).
Azure DNS supports all common DNS record types: A, AAAA, CAA, CNAME, MX, NS, PTR,

Azure DNS is a public DNS service that allows you to manage DNS zones for public domains. With Azure DNS, you can create and manage public DNS records for your domains, making them globally accessible through public DNS servers.
Typically, Azure DNS is used when hosting public internet services and when your domains need to be accessible over the internet. SOA, SRV, and TXT.

- In summary:  

Azure DNS is for public domains and global internet access.
Azure DNS Private Zones is for private domains and internal communication within Azure networks.

Read More

Setting up internal self-signed RootCA using OpenSSL on Windows/Linux. Create self-signed SSL certificates.

1. Generate the "root" key: 

openssl ecparam -out root.key -name prime256v1 -genkey

2. Generate the "root" CSR:

openssl req -new -sha256 -key root.key -out root.csr

3. Generate the "root" cert and self sign it:

openssl x509 -req -sha256 -days 365 -in root.csr -signkey root.key -out root.crt

4. Create the server private key and CSR for the domain "sohammitra.co.in": 

openssl ecparam -out sohammitra.co.in.key -name prime256v1 -genkey

openssl req -new -sha256 -key sohammitra.co.in.key -out sohammitra.co.in.csr

5. Sign the CSR with "root" CA key:

openssl x509 -req -in xyz.com.csr -CA  root.crt -CAkey root.key -CAcreateserial -out xyz.com.crt -days 3650 -sha256

** How to add SAN while generating the CSR?

Create the following txt file in the same folder where you want to generate the CSR: san_config.txt

[req]

distinguished_name = req_distinguished_name

req_extensions = req_ext

prompt = no

[req_distinguished_name]

C   = IN

ST  = West Bengal

L   = Kolkata

O   = Soham's Company Pvt. Ltd.

OU  = NOC

CN  = www.sohammitra.co.in

[req_ext]

subjectAltName = @alt_names

[alt_names]

DNS.1 = sohammitra.in

DNS.1 = www.sohammitra.in

Execute the following command with the "-config" flag as shown below:

openssl req -new -key sohammitra.co.in.key -out sohammitra.co.in.csr -config san_config.txt

** Sample Virtual Host configuration for Apache HTTPD:

<VirtualHost sohammitra.co.in:443>

      DocumentRoot /var/www/sohammitra.co.in

      ServerName sohammitra.co.in

      SSLEngine on

      SSLCertificateFile /home/user/sslcerts/sohammitra.co.in.crt

      SSLCertificateKeyFile /home/user/sslcerts/server.key

</VirtualHost>

** To verify the certs whether installed correctly and being served by Apache HTTPD:

openssl s_client -connect xyz.com:443 -servername xyz.com -showcerts

** How to validate the password against a *.key file?

openssl rsa -in private.key

(If you typed in the correct password, then you’ll see the decrypted key file and If you typed in the wrong password, then you will see unable to load Private Key.)

** How to look into a .cer file to see the content in plain text?

openssl x509 -in CERTIFICATE_XYZ.cer -text

Read More