Highly available domain controller

 1. Deploy VM, change public IP addresses to "Standard".

2. Deploy LB.

resource "azurerm_lb" "lb-services-int" {

  resource_group_name = azurerm_resource_group.resource_group.name

  name                = local.lb_name

  location            = azurerm_resource_group.resource_group.location

  sku                 = "Standard"

  frontend_ip_configuration {

    name      = local.lb_name

    subnet_id = data.azurerm_subnet.eastus-test4.id

  }

  tags = azurerm_resource_group.resource_group.tags

}

resource "azurerm_lb_backend_address_pool" "backend_pool_services" {

  loadbalancer_id = azurerm_lb.lb-services-int.id

  name            = local.lb_backend_name

}

resource "azurerm_lb_probe" "lb_probe-ldap-389-Tcp" {

  #resource_group_name = azurerm_resource_group.resource_group.name

  loadbalancer_id     = azurerm_lb.lb-services-int.id

  name                = "tcpProbe-389-Tcp"

  protocol            = "Tcp"

  port                = 389

  interval_in_seconds = 5

  number_of_probes    = 2

}

resource "azurerm_lb_rule" "lb_rule-int-no-all" {

  loadbalancer_id                = azurerm_lb.lb-services-int.id

  name                           = "LBRule-int-all-tcp"

  protocol                       = "All"

  frontend_port                  = 0

  backend_port                   = 0

  frontend_ip_configuration_name = local.lb_name

  enable_floating_ip             = true

  backend_address_pool_ids        = [azurerm_lb_backend_address_pool.backend_pool_services.id]

  idle_timeout_in_minutes        = 5

  probe_id                       = azurerm_lb_probe.lb_probe-ldap-389-Tcp.id

  depends_on                     = [azurerm_lb_probe.lb_probe-ldap-389-Tcp]

  disable_outbound_snat          = true

}

data "azurerm_network_interface" "int1" {

  name                = "jarek7sndvm-nic"

  resource_group_name = "jareksandbox3-rg"

}

resource "azurerm_network_interface_backend_address_pool_association" "int1" {

  network_interface_id    = data.azurerm_network_interface.int1.id

  ip_configuration_name   = "ipconfiguration-jarek7sndvm"

  backend_address_pool_id = azurerm_lb_backend_address_pool.backend_pool_services.id

}

data "azurerm_network_interface" "int2" {

  name                = "jarek8sndvm-nic"

  resource_group_name = "jareksandbox4-rg"

}

resource "azurerm_network_interface_backend_address_pool_association" "int2" {

  network_interface_id    = data.azurerm_network_interface.int2.id

  ip_configuration_name   = "ipconfiguration-jarek8sndvm"

  backend_address_pool_id = azurerm_lb_backend_address_pool.backend_pool_services.id

}

3. Configure interfaces on VMs.

netsh interface ipv4 set interface "Ethernet" weakhostreceive=enabled

netsh interface ipv4 add addr "Loopback Pseudo-Interface 1" "10.5.2.10" "255.255.255.128"

netsh interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostreceive=enabled  weakhostsend=enabled

4. Install domain controller DSC.

5. Configure DNS:

All AD records are also configured - VIP was added to _sites, _tcp, _udp. This might not be required.

6. Test:

1..20| % {

Get-ADUser test01 -Server jarek8sndvm.contoso.local

Start-Sleep -Seconds 1

}

Get-ADUser test01 -server jarek7sndvm.contoso.local| Remove-ADUser -Confirm:$false;repadmin /syncall jarek7sndvm.contoso.local /AdeP

New-ADUser -Name 'test01' -Server jarek7sndvm.contoso.local;repadmin /syncall jarek7sndvm.contoso.local /AdeP

Troubleshooting network/cert connections

 Check your Chrome/Firefox params:

https://1.1.1.1/help

https://dnsviz.net/d/indysoft.com/dnssec/

https://dnssec-debugger.verisignlabs.com/

install oh-my-posh

 choco install oh-my-posh -y

choco install microsoft-windows-terminal -y

choco install nerd-fonts-3270 -y

choco install nerd-fonts-meslo -y

Add-MpPreference -ExclusionProcess oh-my-posh.exe

Set-Content -Path $profile -Value 'oh-my-posh init pwsh | Invoke-Expression'

Get-Content $profile

Start-BitsTransfer "https://github.com/ryanoasis/nerd-fonts/releases/download/v2.1.0/Meslo.zip" -Destination c:\temp\meslo.zip

Start-BitsTransfer "https://github.com/microsoft/cascadia-code/releases/download/v2111.01/CascadiaCode-2111.01.zip" -Destination c:\temp\CascadiaCode-2111.01.zip

Expand-Archive C:\temp\meslo.zip -DestinationPath C:\temp\Fonts

Expand-Archive C:\temp\CascadiaCode-2111.01.zip -DestinationPath c:\temp\cascadia\

Check what permissions are assigned to Azure SQL database

 

SELECT DP1.name AS DatabaseRoleName,   

    isnull (DP2.name, 'No members') AS DatabaseUserName   

FROM sys.database_role_members AS DRM  

RIGHT OUTER JOIN sys.database_principals AS DP1  

    ON DRM.role_principal_id = DP1.principal_id  

LEFT OUTER JOIN sys.database_principals AS DP2  

    ON DRM.member_principal_id = DP2.principal_id  

WHERE DP1.type = 'R'

ORDER BY DP1.name;

Find what process is listeninig on specific port using Powershell

 get-nettcpconnection | where {($_.State -eq "Listen")} | select LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | ft 

get-nettcpconnection | where {($_.State -eq "Listen") -and ($_.LocalPort -eq "80")}  | select LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | ft

backup and restore of mysql

 #BACKUP

mysqldump  --routines --triggers  --host "hostname" --password --user "mysqladmin@hostname" databasename > /tmp/databasename_dump_27022023

optional:

mysqldump  --column-statistics=0  --routines --triggers  --host "hostname" --password --user "mysqladmin@hostname" databasename > /tmp/databasename_dump_27022023

provide pass

#RESTORE

mysql -u mysqladmin -p  -A -Dnewdatabasename --host newhostname-fqdn < /tmp/databasename_dump_27022023

mysqldump -u... -p... --routines --triggers db1 > /root/db1.sql

login:

mysql  -h hostname.mysql.database.azure.com -u youruser -D yourDB -P 3306 -p -A

Verifying certificate validity with OCSP

 There are couple of ways to verify if OCSP is returning the correct certificate status.

1. GUI. 

    * export certificate to a file, suggested format is base64 encoded file.

    * run: certutil -URL C:\temp\test1.cer

2. CMD: 

certutil -verify -urlfetch C:\temp\test02_04.cer

Check last lines of the output.

3. CMD. Create a folders: certificates and results and copy your certficifate to certificates folder and execute:  

certutil -downloadocsp certificates results downloadonce

then view results with:

certutil .\results\44EAE067772C9DE9AD8CC2ADADB2DBF906305C9D.ocsp