Forem: Ola

File accessed using keys and managed identities - Azure Files and Azure Blobs

Ola — Sun, 26 May 2024 02:28:15 +0000

Create the storage account and managed identity

Provide a storage account for the web app.
In the portal, search for and select Storage accounts.
Select + Create.
For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name is unique and meets the naming requirements.
Follow our previous tutorial for the above
Select Review + Create.

Wait for the resource to deploy.

Provide a managed identity for the web app to use.

Search for and select Managed identities.
Select Create.
Select your resource group.

Give your managed identity a name.
Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.
Select the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Job functions roles page, search for and select the Storage Blob Data Reader role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.
Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.
In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Job functions roles page, search for and select the Key Vault Administrator role.
On the Members page, select User, group, or service principal.
Select Select members.
Search for and select your user account. Your user account is shown in the top right of the portal.
Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.
You are now ready to continue with the lab.
Create a key vault to store the access keys.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.
Take the defaults for the rest of the parameters, and Create the key

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.

Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

*Configure the storage account to use the customer managed key in your key vault. *

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.
Select a key vault and key. Select your key vault and key.

Select to confirm your choices.
Ensure the Identity type is User-assigned.
Select an identity.

Select your managed identity then select Add.
Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator

Navigate to your storage account.
In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.
For the Policy type, select time-based retention.
Set the Retention period to 5 days.
Be sure to Save your changes.

Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.
The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.
Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.
Create the encryption scope.

File shares with limited access (corporate virtual networks) - Azure Files and Azure Blobs

Ola — Sun, 26 May 2024 00:31:21 +0000

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files.
In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.
Set the Performance to Premium.
Set the Premium account type to File shares.
Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office.
In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.
Name the new directory finance.

Select Browse and then select the finance directory.
Notice you can Add directory to further organize your file share.

Upload a file of your choosing.

Configure and test snapshots.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Select your file share.
In the Operations section, select the Snapshots blade.
Select + Add snapshot. The comment is optional.
Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.
Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Select the Snapshots blade and then select your snapshot.
Navigate to the file you want to restore

Select the file and the select Restore.
Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.
Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.
Select Go to resource.

In the Settings section, select the Subnets blade.
Select the default subnet.

In the Settings section, select the Subnets blade.
Select the default subnet.
In the Service endpoints section choose Microsoft.Storage in the Services drop-down.
Do not make any other changes.
Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints..

Return to your files storage account.
In the Security + networking section, select the Networking blade.
Change the Public network access to Enabled from selected virtual networks and IP addresses.
In the Virtual networks section, select Add existing virtual network.
Select your virtual network and subnet, select Add.

Be sure to Save your changes.

Nginx WebServer on Ubuntu OS running via EC2 (AWS)

Ola — Sat, 25 May 2024 22:36:29 +0000

Imagine you have a favorite game you like to play on your computer, but sometimes your computer might not be strong enough to run it well. Now, let's pretend there's a super strong computer far away that you can borrow to play your game. You can connect to this super strong computer from your own computer and play your game smoothly.

Ubuntu is like a special game or tool that people use on their computers to do a lot of important things. It's a*_ type of software called an operating system_*, just like how Windows or macOS helps you use your computer.

EC2, which stands for Elastic Compute Cloud, is like that super strong computer you can borrow. It's part of a big service called Amazon Web Services (AWS) that has lots of these strong computers all over the world.

So, when we say "Ubuntu running on EC2,"_ it means we're using that special tool (Ubuntu) on one of those super strong computers (EC2) far away_. This lets people do their important work or run their programs even if their own computer isn't strong enough. It's like playing your favorite game on a super strong computer somewhere else!

Launch aws portal

Search and Select EC2

On EC2 Dashboard, click instance

Give your instance a name and select the appropriate Image

Provide other parameters according to your need.

Create a Key Pair
Ensure that you have a key pair

To run a Nginx webserver, we need to allow HTTP traffic
Then , Launch Instance

Connect to Instance

Select Connect

Access your instance locally
Launch Powershell

Change privilege to root
sudo su
Install Nginx with the code
apt install nginx -y
Verify Nginx is installed
nginx --version

Validate that nginx is running on webserver using Public IP

Private Data / Public Data Backup - Azure Files and Azure Blobs

Ola — Sat, 25 May 2024 03:21:39 +0000

Create a storage account and configure high availability.

Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts.

Select + Create.

Select the Resource group created in the previous lab.
Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.

Select Review, and then Create the storage account.

Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Geo-redundant storage (GRS) is selected.
Refresh the page.
Review the primary and secondary location information.
Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is private.

Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults.
Select Create.
For testing, upload a file to the private container. The type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container.
Select Upload.

Browse to files and select a file.
Upload the file.

Select the uploaded file.
On the Overview tab, copy the URL.

Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

Select your uploaded blob file and move to the Generate SAS tab.

In the Permissions drop-down, ensure the partner has only Read permissions.
Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.

Select Add rule.
Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.

Ensure Last modified is selected.
Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down.
Add the rule.

The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup. Use the default values.

Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.

In the Data management section, select the Object replication blade.
Select Create replication rules.

Set the Destination storage account to the private storage account.
Set the Source container to public and the Destination container to backup.
Create the replication rule.

Optionally, as you have time, upload a file to the public container.

Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.

Working with mission-critical data - Azure Files and Azure Blobs

Ola — Fri, 24 May 2024 08:51:48 +0000

Create a storage account with high availability.

In the portal, search for and select Storage accounts.

Select + Create.

For resource group select new. Give your resource group a name and select OK.
Set the Storage account name to publicwebsite. Make sure the storage account name is unique by adding an identifier.

Select Review and then Create.

Take the defaults for other settings.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Read-access Geo-redundant storage is selected.
_Review the primary and secondary location information.

In the storage account, in the Settings section, select the Configuration blade.
Ensure the Allow blob anonymous access setting is Enabled.
Be sure to Save your changes.

Create a blob storage container with anonymous read access

In your storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is public.
Select Create.

On the Overview blade, select Change access level.
Ensure the Public access level is Blob (anonymous read access for blobs only).
Select OK.

Practice uploading files and testing access.

Ensure you are viewing your container.

Select Upload.

Browse to files and select a file. Browse to a file of your choice.
Select Upload.

Close the upload window, Refresh the page and ensure your file was uploaded.

Select your uploaded file.
On the Overview tab, copy the URL.
Paste the URL into a new browser tab.

If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

Configure soft delete

Go to the Overview blade of the storage account.
On the Properties page, locate the Blob service section.
Select the Blob soft delete setting.

Ensure the Enable soft delete for blobs is checked.
Change the Keep deleted blobs for (in days setting is 21)
Notice you can also Enable soft delete for containers.

Don’t forget to Save your changes.

Navigate to your container where you uploaded a file.
Select the file you uploaded and then select Delete.
Select OK to confirm deleting the file.

On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.

Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

Configure blob versioning

Go to the Overview blade of the storage account.
In the Properties section, locate the Blob service section.
Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.
Notice your options to keep all versions or delete versions after.

Don’t forget to Save your changes.

Upload another version of your container file. This overwrites your existing file.

Your previous file version is listed on Show deleted blobs page.

Working with non-critical data - Azure Files and Azure Blobs

Ola — Fri, 24 May 2024 06:11:57 +0000

Launch portal.azure.com

In the Azure portal, search for and select Resource groups.

Select + Create.

Give your resource group a name. For example, storagerg.
Select a region.

Use this region throughout the project

Select Review and create to validate the resource group.

Select Create to deploy the resource group.

In the Azure portal, search for and select Storage accounts.

Select + Create.

On the Basics tab, select your Resource group.
Provide a Storage account name. The storage account name must be unique in Azure.

Set the Performance to Standard.
Select Review, and then Create.

Wait for the storage account to deploy and then Go to resource.

In your storage account, in the Data management section, select the Redundancy blade.
Select Locally-redundant storage (LRS) in the Redundancy drop-down.

In the Settings section, select the Configuration blade.
Ensure Secure transfer required is Enabled.
Ensure the Minimal TLS version is set to Version 1.2.
Ensure Allow storage account key access is Disabled.

In the Security + networking section, select the Networking blade.
Ensure Public network access is set to Enabled from all networks.

Installing a WebServer on Win Server 2019 VM

Ola — Fri, 24 May 2024 03:48:59 +0000

First and foremost, what is a web server?
Imagine you have a toy box at home where you keep all your favourite toys. Now, let’s say your friend wants to see what toys you have. Instead of coming to your house, they can use a special magic box that lets them see and even play with your toys from their own home. This magic box is connected to your toy box and shows your toys to your friend whenever they ask.

A web server is like that magic box. It keeps a lot of information (like your toys) and when someone on the internet wants to see that information (like your friend), the web server shows it to them. So, it's a special computer that helps share information with other computers.

A web server is a specialized software or hardware system responsible for handling HTTP(S) (Hypertext Transfer Protocol) requests from clients, typically web browsers, and serving them the appropriate web content, such as HTML pages, images, videos, or other resources. The primary functions of a web server include:

Hosting Websites: Web servers store, process, and deliver web pages to users. They manage domain names, manage content, and ensure that web pages are available to users around the clock.
Handling Requests and Responses: When a user enters a URL in their browser, the web server processes the incoming HTTP request, retrieves the requested content, and sends it back to the client as an HTTP response.
Security: Web servers implement various security protocols, such as SSL/TLS, to encrypt data transmitted between the server and clients. They also handle authentication and authorization to protect sensitive data and resources.
Load Balancing and Scalability: Web servers can distribute incoming traffic across multiple servers to ensure efficient resource utilization, high availability, and reliability. They support scalability by adding or removing servers as demand fluctuates.
Logging and Monitoring: Web servers maintain logs of all transactions, which are crucial for analyzing traffic, debugging issues, and monitoring performance.

Popular web server software includes Apache HTTP Server, Nginx, Microsoft Internet Information Services (IIS), and LiteSpeed. Each of these solutions offers unique features and optimizations to cater to different performance, security, and scalability requirements.

In a previous post, we deployed a Win 11 VM. Now, we shall install a webserver on a similar server (Win Server 2019).

Open PowerShell
Click on the Start menu.

Type PowerShell and open Windows PowerShell or Windows PowerShell ISE as an administrator(right-click and select Run as administrator)

Provide your credentials

Install IIS by running this command

Install-WindowsFeature -name Web-Server -IncludeManagementTools

Visit the server/public IP in a browser to validate that it works

Installing a WebServer on Win Server 2019 VM

Ola — Fri, 24 May 2024 03:43:56 +0000

Hosting Websites: Web servers store, process, and deliver web pages to users. They manage domain names, manage content, and ensure that web pages are available to users around the clock.
Handling Requests and Responses: When a user enters a URL in their browser, the web server processes the incoming HTTP request, retrieves the requested content, and sends it back to the client as an HTTP response.
Security: Web servers implement various security protocols, such as SSL/TLS, to encrypt data transmitted between the server and clients. They also handle authentication and authorization to protect sensitive data and resources.
Load Balancing and Scalability: Web servers can distribute incoming traffic across multiple servers to ensure efficient resource utilization, high availability, and reliability. They support scalability by adding or removing servers as demand fluctuates.
Logging and Monitoring: Web servers maintain logs of all transactions, which are crucial for analyzing traffic, debugging issues, and monitoring performance.

In a previous post, we deployed a Win 11 VM. Now, we shall install a webserver on a similar server (Win Server 2019).

Open PowerShell
Click on the Start menu.

Install-WindowsFeature -name Web-Server -IncludeManagementTools

Set Up a Linux VM (Ubuntu), step by step

Ola — Fri, 24 May 2024 03:42:26 +0000

A Linux machine is like a magic book on your computer that can do lots of cool things. Now, a Linux machine is like having a special magic book that's really good at following instructions and can change its story whenever you want.

A Linux machine refers to a computer that is running the Linux operating system. Linux is an open-source operating system, meaning it's free to use and its source code is available for anyone to view, modify, and distribute. It's known for its stability, security, and flexibility, which is why it's widely used in servers, desktops, and even mobile devices.

Key Points:

Open Source: Unlike Windows or macOS, Linux is open-source, so anyone can contribute to its development or customize it for their needs.
Distributions: There are many versions of Linux, called distributions (or distros), such as Ubuntu, Fedora, and Debian. Each distro has its own set of features and tools.
Command Line: While Linux has graphical user interfaces (GUIs), a lot of powerful features are accessed through the command line.
Security and Stability: Linux is less prone to viruses and malware, making it a popular choice for servers and security-sensitive applications.
Flexibility: Linux can run on a wide range of hardware, from old computers to modern servers and smartphones.

For this tut, we shall walk through the installation of Ubuntu on Microsoft Azure Platform.

Navigate to portal.azure.com and select Virtual Machine

Create an Azure virtual machine

Provide details of your virtual machine (Resource group, Virtual machine name, Image)

Here we shall be using SSH for Administrator account
We have provided Username, and Key pair name

Set Inbound port (22)

Now to the Monitoring tab - Disable boot diagnostic
Next, the tags are set for billing purposes

Almost there, go to Review + create

Next, download private key and create the resource

Allow for deployment to be completed

Select your public IP

Modify Idle time and give DNS name label (optional)

Open windows cmd

SSH into the machine

ssh -i /"path name"/KeyPairName.pem azureuser@20.15.105.5
For example;
_ssh -i /"C:\Users\King Fisher\Downloads"/OlaLinuxUbuntu22.pem azureuser@20.15.105.5_

Hurray >> 🍾Working Ubuntu VM

Installing Nginx on Ubuntu VM

Ola — Fri, 24 May 2024 03:41:20 +0000

First, change user to root

Type the command - apt install nginx -y

apt = is the package manager of nginx
install = this is a verb and the action that you want the package manager to perform
nginx = this is what you want to install on the VM
-y = This is a command that prompts the system to automatically accept anything that requires you to accept a yes or no

Confirm installation

Visit the server / public IP in a browser to validate that it works

A Guide to Deploying Windows 11 using Azure Resource (Virtual Machine: Win 11)

Ola — Sat, 18 May 2024 08:40:01 +0000

In this tutorial, we shall explore a method to deploy windows 11 VM on Azure. It is assumed that the user is logged into azure portal. Hence, the following steps are required to successfully deploy a win 11.

Input the resource you intend to create in the search bar and hit enter. The resource will be highlighted in grey, provided the resource is available and can be implemented.
The search bar has a default text of

Search resources, services, and docs (G+/)

Note: In our case, we want to create a Virtual Machine, so we will input "virtual machine"

Click on the grey area to select the Virtual Machine

Click the + icon or Create or the dropdown icon or and select the desired Azure virtual machine

On the Basics tab, there are five main sections to be explored;

Project details
Instance details
Administrator account
Inbound port rules
Licensing

Project details: We can select our subscription type, as well as create a resource group or make a selection from a previously created resource group using the dropdown icon. In this instance, we shall create a new resource group

Click the Create new
Input the name of the resource group you wish to create
Click OK

Instance details: In this section, you must provide the name of the virtual machine you wish to create, Region, Availability zone, Image (OS) and size. Other functionalities available are optional. For this tutorial, we shall create a Windows 11 Pro version 22H2 - x64 Gen2, all other options will be at the default settings.

Administrator account: We shall provide credentials to access this image in this section; username and password.

Inbound port rules: We can configure the VM to either be privately or publicly accessible and indicate the inbound ports in this section. This image is Windows, hence we shall use RDP(3389).

Licensing: We will check this box 😁

Monitoring: There are three key functions under monitoring. We will be disabling boot diagnostics so that the VM does not send reports to Azure and we can have a low footprint.

Tags: We shall create a name/value pair to categorise the azure resources and view consolidated billing

Review + Create : Click the Review and create tab
Select the create button at the bottom of the page

A successful deployment should indicated. Then, we should select Go to resource

Idle Time: Select the Public IP address, input the new idle time and select save

Go to overview and select connect

Now, click Select. After a few minutes, configured would appear in the Native RDP section, then you can download the RDP file

Open the rdp file and click connect

Username should appear in the RDP login screen and you can enter the value if it is not by default. Then, enter the password you created during the VM setup and login.

Select yes in this instance

Select yes and accept in the next screen

Booyah: we have our VM win 11 running

To learn more, follow me on

Easy Steps to Create Microsoft Azure Resource (hamburger menu)

Ola — Sat, 18 May 2024 08:24:03 +0000

Following our initial tutorial in creating Azure resources, we are now exploring another method to achieve the same goal.

To create any Microsoft Azure Resources, you can explore the following steps

Navigate to www.portal.azure.com as seen in the image below.
Login with your Microsoft account credentials (email, phone, or Skype details) by following these steps:

Input your email or phone or Skype detail in the input field provided and click the Next button
Input your password in the password field and click Sign in button

Azure offers a wide array of resources, each designed to serve distinct functions. The selection of Azure resources is driven by the specific solutions or services an organization seeks to implement. In this article, we will utilize the hamburger menu.

Select the hamburger menu, and click Resource groups.

Select Create

Enter the name of the resource group

Select Review + create at the bottom of the page

Now, click create! Boohay 🎊