Posts on wporter.org

Granting a principal API access to a single SharePoint site with Sites.Selected permissions - Graph API and PowerShell

Wed, 23 Sep 2026 21:00:00 +0000

Introduction

When granting a principal access to anything, it’s best practice to scope that access down as much as possible. As of 2026, the only way to avoid granting full access to every SharePoint site to your application when you need to access some SharePoint data is to use the Sites.Selected Graph permission. Unfortunately, to grant Sites.Selected access to SharePoint Online, you’ll need to make API requests; this permission is not available through the Entra app registration admin interface. You’ll also need to create the read/write permission on the SharePoint site you want the application to have access to (Sites.Selected permissions are an implicit deny; the ’exclusions’ are applied to the SharePoint site and also cannot be modified through the web interface).

Offline domain join - djoin.exe

Wed, 09 Sep 2026 20:00:00 +0000

djoin allows you to join devices to Active Directory with a provisioning blob (a text file) that is generated somewhere with line-of-sight to a DC, then used anywhere (on an online or offline Windows image). This means you can:

skip authentication on the target device
- helps reduce privileges required on the endpoint - no longer need an account with permission to create the computer object to sign into the endpoint
join devices while they’re offline (e.g., at a remote site, or in a staging location without connectivity to the domain)
join devices during provisioning without the need to save credentials capable of many or arbitrary domain joins

An offline domain-joined machine will still require line-of-sight to a domain controller for initial user authentication, Group Policy processing, Kerberos, certificate enrollment, et cetera.

Attach a physical disk to a QEMU VM

Sat, 13 Jun 2026 20:00:00 +0000

My desktop’s Windows install broke today. As I already had a Fedora install on another disk, it was simplest to boot the Windows install as a VM and fix it that way.

Write a Libvirt-format XML device definition, e.g., in the file “nvme1n1.xml”.

Note the bus='sata'. I’m booting a Windows VM from a second disk in the system that doesn’t have VirtIO drivers.

tee nvme1n1.xml << EOT
<disk type='block' device='disk'>
    <driver name='qemu' type='raw'/>
    <source dev='/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S6B0NL0T921654N'/>
    <target dev='vda' bus='sata'/>
</disk>
EOT

Then, attach the disk to the VM:

RHCSA: Pass!

Mon, 25 May 2026 14:30:00 +0000

Been quiet for the past few weeks because I’ve been busy with work and studying for my RHCSA. Took it today, 5/25. Wound up being easier than I thought. PASS, with 300/300. On to the next one!

Managing password aging with /etc/login.defs, passwd, and chage

Mon, 11 May 2026 19:15:00 +0000

We can use the /etc/login.defs file and chage command to manage password aging for users on an EL system.

The /etc/login.defs controls defaults for new users - namely, the PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_MIN_LEN, and PASS_WARN_AGE parameters:

# Password aging controls:
#
#	PASS_MAX_DAYS	Maximum number of days a password may be used.
#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
#	PASS_MIN_LEN	Minimum acceptable password length.
#	PASS_WARN_AGE	Number of days warning given before a password expires.
#
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_WARN_AGE	7

# this is in here too, but is generally ignored & controlled by PAM
PASS_MIN_LEN	8

These values are added to the user’s /etc/shadow entry at creation time.

Determining which filesystems are present on mounted or unmounted volumes

Sat, 09 May 2026 22:30:00 +0000

lsblk

lsblk -f will show you a list of devices, partitions, their corresponding filesystem type, available/used space, and mountpoints.

$ lsblk -f
NAME FSTYPE FSVER LABEL  UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1
│
├─sda2
│    vfat   FAT16        2205-C8D2                               191M     4% /boot/efi
├─sda3
│    xfs                 6df325af-1779-4165-a6cd-78fe83c18aab    745M    22% /boot
└─sda4
     xfs                 99bf1bf0-97c8-472e-9e64-fc4fee387b2b    7.4G    15% /
sr0  iso966 Jolie cidata 2026-04-09-17-29-07-00

file

file --special-files --dereference (-sL) will give you information on a partition/LV’s filesystem or the MBR on a disk. Can be used on mounted or unmounted partitions.

Setting default file permissions with umask

Sat, 09 May 2026 22:30:00 +0000

umask is a shell command that sets the value that controls which file permissions are set by default.

The OS starts with the set of maximum allowed permissions (777 for directories, 666 for files, as the execute bit is required to traverse directories, but is only required to execute files - something you probably don’t want by default) and the umask bitmask is applied to remove permissions.

For example:

The default umask is 022, which means files are created with mode 644 by default (and directories are created with mode 755).

NTP - chrony and timedatectl

Sat, 09 May 2026 20:15:00 +0000

On EL systems, the chrony NTP client and server is used to synchronize the system’s time.

The configuration file is /etc/chrony.conf; the chronyc and timedatectl commands can be used to monitor the chrony daemon and configure the system clock, respectively.

The default configuration typically point chrony at a NTP pool (distro-specific). Pools are defined with the pool configuration line:

$ cat /etc/chrony.conf | grep pool
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (https://www.pool.ntp.org/join.html).
pool 2.almalinux.pool.ntp.org iburst

Servers are defined with the server configuration line instead.

Archival/compression utilities on Linux

Sat, 09 May 2026 20:10:00 +0000

There are five main archival utilities available on most Linux systems:

tar
gzip
xz
bzip2
zip

tar creates uncompressed archives; it was originally intended for use creating tape backups, but now finds usage anywhere you’d like to turn a bunch of files into one file. Files are stored linearly in the tarball, so it’s very cheap (computationally) to work with tar archives.

tar archives are often combined with a compression utility, which is where the tar.xz, tar.gz, tar.bz2 files come from. On *nix platforms we tend to have separate archival utilities (like tar, used for turning a set of files or directory into a single file) and compression utilities (e.g., gzip, bzip2, xz, used to reduce the amount of disk space a file uses), in contrast to the Windows approach of a single tool for both (e.g., zip, rar, 7z).

Working with SELinux (RHCSA-level)

Sat, 09 May 2026 18:15:00 +0000

References

RHCSA v10 EX-200 exam objectives:

Manage security (5 of 8)
- Set enforcing and permissive modes for SELinux
- List and identify SELinux file and process context
- Restore default file contexts
- Manage SELinux port labels
- Use boolean settings to modify system SELinux settings

We’re going to go a bit past this and touch on users, roles, and senstivity in addition to managing file contexts.

Working with journald

Mon, 20 Apr 2026 22:15:00 +0000

Let’s briefly dig into systemd-journald and go over the what, the why, and the how!

What is journald?

systemd-journald is a logging service bundled with systemd. It provides a number of nice extra features past simple plaintext log entries (a la syslog) including, but not limited to:

journald uses binary storage, with fully indexed data for better (much faster) search
supports compression… though it’s per entry, so it’s pretty useless
- per-entry compression is fine for large individual entries, but Linux log messages are typically quite small and small strings don’t compress nearly as well as a large block of text, made up of, say, mostly redundant log entries would.
structured logging is enforced
access control, by default
automatic log rotation

Generally, the output of any systemd unit is sent to the journal.

Links and inodes!

Sun, 19 Apr 2026 19:00:00 +0000

Let’s talk about links!

inodes

But first, we’ll need to go over the concept of inodes. These are an essential data structure Unix filesystems that store the attributes (metadata, permissions) and block locations for a particular file or directory.

These “index” nodes allow the kernel to find the file contents from the inode number - conceptually, think of reading memory from a memory address. An inode contains a “disk address” in an easily parsable data structure, with metadata information slapped on. The kernel can read the inode and quickly figure out where to go to read the contents of a file off the disk.

RHCSA/EL10 - bootloader, initramfs, kernel arguments, resetting the root password, oh my

Sat, 18 Apr 2026 15:00:00 +0000

RHCSA study part 1: the bootloader, initramfs, and the first problem! Let’s reset a root password! Don’t worry. We won’t get too distracted… I promise…

The lab environment used in this post consists of GenericCloud AlmaLinux 10 machine(s) running on a Proxmox VE cluster. For info about the environment, see the build log. To get your hands on the GenericCloud base images, go to repo.almalinux.org. To set up a Proxmox VE template from a GenericCloud base image as I’ve done here, see this post.

Linux md RAID benchmarks on 4 Kioxia PM5s

Sat, 18 Apr 2026 14:30:00 +0000

I had access to some machines with a load of brand new Kioxia PM5 (read-intensive SAS3) SSDs, so after finishing my production benchmarking I decided to grab some academic numbers to follow up on my prior md RAID layouts writeup.

I’ll be benchmarking just four drives here, as the PCIE 3.0x8 HBA they’re hooked up to is a limiting factor for anything wider. These drives really could use a NVME interface (that’s what the CM5 is!)

Linux md RAID layouts

Sat, 11 Apr 2026 21:15:00 +0000

I was working on setting up some big mdadm RAID arrays, so I had to do some reading up on RAID layouts to make sure I was setting them up correctly. The result? This nice (if I say so myself) write-up! Yes, I went a little overboard.

If you’re not familiar with RAID levels, let’s go just deep enough:

RAID 0 = blocks “striped” across all drives for best performance, no redundancy
- Calling this RAID isn’t strictly accurate.. it’s not redundant at all!
- Blocks of data are distributed between all member disks. This means excellent performance (both writes and reads can be highly parallelized).
RAID 1 = blocks “mirrored” between all drives for redundancy
- Mirrors one drive to n replicas. As such, you only get the capacity of a single drive.
- Dumb mirror. Very simple, very fast reads (if you throw enough threads at it, you can read from n drives simultaneously), but writes will never be faster than one drive.
RAID 4 = one dedicated parity (redundancy) drive, data striped between the rest of the drives.
- One drive is reserved for redundancy. Parity data is all kept on one drive.
- Parity bytes are an XOR combination of data bytes (e.g., P = a XOR b XOR c XOR d XOR e - you can figure out what “a” was given b, c, d, e and P) which is how you get redundancy without a mirror. This is called “erasure coding” - you can reconstruct missing data if you know exactly which blocks are gone. If a drive fails, you know which blocks are gone.
- As parity data lives on one dedicated drive, performance of the array is limited by that drive.
- Because RAID4 (and 5, and 6) rely on parity, small I/O is punished. If you write a small chunk, you can’t just write. You have to read the old data block, read the old parity block, XOR old data, new data, old parity to get your new parity value, write the new data block, then write the new parity block.
- Large sequential writes are less affected, because you don’t need to read old data - you can just dump a new set of data blocks and parity block to disk all at once.
RAID 5 = single set of parity data distributed across the array, data striped between all drives.
- The equivalent of one drive’s capacity is reserved for redundancy. Parity data is distributed across the array.
- Like RAID4, but, as the parity blocks are distributed between all members, RAID5 allows more parallelism (all drives store parity and data blocks).
RAID 6 = two sets of parity data distributed across the array, data striped between all drives.
- The equivalent of two drives’ capacity is reserved for redundancy. Parity data is distributed across the array.
- While RAID5 offers just one set of parity blocks, RAID 6 has traditional XOR parity blocks (the “P” parity data) and a second set of parity data that’s reversible with some more advanced algebra (“Q” parity data). If you want to read about how that second set of parity data works, check out Igor Ostrovsky’s blog post on the topic. He does an excellent job at explaining it.
- The result is that your machine can solve for the missing values using the two parity equations and live data, so you can always figure out what bytes you had on the two disks you’re able to lose.
- If two drives are lost and you need to use the Q parity to reconstruct, performance will suffer significantly, as every read will require reading from all surviving drives and doing relatively expensive calculations.
- However, if you only lose one drive and can reconstruct the missing data from the P parity algorithm or live data (e.g., only had one drive failure) the array will continue to perform relatively well.
RAID 10 = striped mirrors = pairs of two drives are mirrored, then the mirrored pairs are all striped together.
- Half of your drives are used for redundancy. Data is mirrored across a configurable number of members of the array (by default, 2). As such, you’ll lose at least 50% of your disk space.
- Simpler than erasure coding. Very fast. Works just like you’d think it does with “near” distribution, which is what is typically used. More on that later.

ZFS and LVM support some other fun things like linear volumes or triple parity, but those are different beasts entirely.

AZ-104: Pass!

Thu, 09 Apr 2026 21:15:00 +0000

Azure!

I’ve been quiet over the last month or so! Caught a bad flu and have been head-down, studying, and working on some projects at $DayJob.

I’ve also passed the AZ-104 earlier this month with a score of ~900. This was a somewhat tricky one. The exam goes in depth into any & all of the objectives. You will need to use the documentation (which, thank goodness, is available) for some questions. I didn’t find any of the questions unfair but I caught at least one error on the test.

An Active Directory security checklist

Tue, 24 Mar 2026 21:45:00 +0000

Use a freely available Active Directory configuration/vulnerability scanner like Purple Knight or PingCastle to get a quick assessment of the environment’s state. Purple Knight is a great tool, PingCastle.. meh.
Keep the Default Domain and Default Domain Controllers policies minimal. Explicitly name your policies and consider targeting them by security group rather than at the OU level. Audit your GPOs regularly.
Consider disabling AAD Connect’s Seamless SSO if you’re not using it (e.g., your machines are all hybrid joined and W10+, so they use PRTs for SSO to Entra ID instead). The SSO computer account is a threat vector.
Apply the freely available Microsoft Security and Compliance Toolkit configuration baselines for your Windows client & server OSes.
- READ. THE. SPREADSHEETS. AND. TEST. BEFORE. PUSHING. TO. PROD.
- Consider applying the baseline for Office, too.
If you’ve got Defender for Endpoint, deploy it. Even if you’re using another EDR agent. Deploy Defender for Endpoint in passive or EDR block mode. Defender for Endpoint is REALLY good.
- Apply Defender Attack Surface Reduction rules, too, while you’re at it. They’re free bits of hardening preconfigured for you.
PATCH!! YOUR!!! STUFF!!!!!!
Remove users from the “Operators” groups. These are often legacy leftovers from a more “consolidated” AD environment (e.g., a DC was a terminal server, and users occasionally had to restart the print spooler, so users were added to the Print Operators and Server Operators groups.. making it trivial for one to elevate to SYSTEM on a DC in the absence of other controls).
DO NOT RUN ANYTHING BUT AD DS (and DHCP) ON A DOMAIN CONTROLLER.
- I’ll repeat that. DO NOT RUN ANYTHING BUT AD DS (and DHCP) ON A DOMAIN CONTROLLER.
- DO NOT USE A DOMAIN CONTROLLER AS A JUMPBOX!!!
- If you think this is good because you’ll save money on a Windows Server license, consider the cost of rebuilding the entire environment after it gets compromised vs $800 for another Server Standard OSE. If you do this and have Server Datacenter licenses I WILL find you and I WILL slap you silly.
- STOP
- RUNNING
- OTHER
- SERVICES
- ON
- DOMAIN
- CONTROLLERS
- Think about how much harder it would be to clean up a compromised domain versus JUST SETTING UP ANOTHER SERVER.
Disable multicast name resolution, including mDNS if your environment is using a .local TLD.
- This means NetBIOS, LLMNR, and mDNS.
- Either disable mDNS and break Spotify/Miracast, rename your domain, or get Responder’d to death. Three options. The first two are preferred.
Phase out RC4 Kerberos encryption.
- RC4 is highly vulnerable to offline attacks (“Kerberoasting”) and will be disabled by default in July 2026.
- Reset the KRBTGT password twice (reset once, wait at least 10H for old tickets to expire, reset again), then audit security events 4768 & 4769 for encryption type 0x17/0x18 (RC4, RC4 with preauth). If you don’t see anything, turn RC4 off!
Enable Kerberos armoring (FAST).
- Encrypts pre-authentication. If in place, an attacker must first compromise a machine account to read pre-auth handshakes (making an offline attack against preauth much less worthwhile).
- Notably provides mutual authentication of the KDC (protecting against a MITM with a spoofed KDC), provides downgrade attack prevention, and protects the TGS exchange.
Ensure host firewalls are enabled. Restrict access to administrative services (e.g., RDP, WSMAN, SMB for the admin shares) to dedicated jump hosts/PAWs.
- Use PAWs on trusted hypervisors or dedicated, modern physical hardware (e.g., with a TPM and supporting hardware virtualization, so you can make use of Credential Guard) for best results. A VM is only as good as the machine hosting it.
- Your 8th - 10th gen Intel machines in the ewaste pile are just begging for a second life!
Sell your customer on PKI. The security benefits are colossal and it’s a prerequisite for a lot of stuff you’ll want to do:
- LDAPS - turn off LDAP, require encryption, without LDAPS your DCs are chatting with other services in plaintext
- Machine cert auth for 802.1X or VPN access (maybe even machine-cert-based AOVPN for your full AD-joined environments with remote workers)
- TLS for your internal services
- SMB over QUIC
- PKINIT - Kerberos pre-authentication with certificates!
  - Replaces the traditional AS-REQ phase. No more password hash on the wire during preauth; instead, use the public key (an X509 cert). Private key stays on your device, as with any other form of keypair auth.
  - You should still use FAST (Kerberos armoring) to encrypt the TGS exchange.
- Foundation for WHfB/passwordless strong authentication (great for the user experience)
- Allows you to start signing internal apps/scripts
- Avoid getting MITM’d when you RDP or SSH around (trusted cert = more of a guarantee that this machine is who it says it is!)
DO NOT EVER log in to a Domain Administrator on a workstation. Add your Domain Admins (and any other privileged roles) to the Protected Users group so that their credentials cannot be cached and reused later.
Adopt LAPS rather than creating a domain-wide admin account for your workstations - even if you “tier” the admin accounts and dedicate one to your workstations, that’s a wide blast radius.
Segment your network.
Treat hypervisors with even more sanctity than you do your DCs. If someone can knock over the server hosting your DC (and you don’t have confidential computing) they can read the memory of your DC and go to town.
SEGMENT YOUR NETWORK!! Use firewall rules! Use deep packet inspection, MITM your traffic (SSL inspection), block all outbound by default! THIS IS A GOOD THING and worth the effort!
Enforce security policy. For example, if you say “don’t sign in to workstations with a Domain Admin account” and your techs still have access to the domain admin password, they WILL sign into workstations with said Domain Admin account. Disable accounts, change passwords, and add the SeDenyLocalLogon privilege to that darn account.
Consider adopting (at least partially adopting) the tiered AD privilege model.
- Your domain controllers are the king in the castle. DO NOT GIVE A DOMAIN ADMIN ACCOUNT AWAY by logging it in to poor old Judy’s workstation. She HAS installed or WILL install SocialSecurity.pdf.exe at some point. Somehow, despite all your efforts.
Enable and enforce SMB encryption. If this means too much overhead, fall back to just enabling SMB signing. Avoid getting MITM’d.
Disable NTLM where possible, or audit and restrict it to the best of your ability.
Audit and remove unnecessary SPNs.
Replace traditional service accounts with MSAs and/or gMSAs for automatic password rotation.
Audit ACLs on privileged AD objects. Don’t let some random account modify properties on your tier zero admin accounts.
Ship your logs somewhere, configure basic alerting. I like to use VictoriaLogs and Grafana, but you can use any SIEM or log store you’d like.
Alert on sensitive group membership changes.
Enable PowerShell Script Block and Module logging.
Disable the print spooler where it’s not needed.
Remove stale AD objects regularly.
Test your AD backup and restore procedure regularly.
Do not synchronize privileged Active Directory identities to Microsoft Entra. ABSOLUTELY DO NOT sync a Domain Admin account to a Global Admin in M365.
If hardware supports it, enable Credential Guard.
- This requires a TPM and hardware virtualization, but protects you against pass-the-hash and pass-the-ticket attacks by sandboxing credentials on your device.
Restrict dynamic DNS updates to authenticated clients to prevent “ADIDNS” (Active Directory-Integrated DNS) spoofing.
- With unauthenticated dynamic updates enabled, anyone can bump a DNS record and either break things or, perhaps worse, redirect connection attempts intended to go to a server to themselves.
- Consider locking this down further to specific principals (e.g., computer accounts and Domain Admins only) so Domain Users can’t make dynamic updates (by default, even with secure updates on, any authenticated user can create new DNS records, including wildcard records).
Restrict DCSync permissions.
- Accounts with “Replicating Directory Changes” and “Replicating Directory Changes All” permissions can steal password hashes by simulating Active Directory replication to a fake DC.
Finally.. consider joining your endpoints to Entra ID rather than Active Directory. Microsoft has made it quite clear that this is their new way forwards. You can still authenticate to on-prem resources with no hassle (see my blog post on the Cloud Kerberos Trust and getting WHfB passwordless auth to both M365 and on-premises resources from an Entra-joined client).

Intro to Azure Functions

Sat, 07 Mar 2026 17:45:00 +0000

Introduction

Azure Functions is a “serverless” PaaS offering like AWS Lambda. Its main draw is allowing you to run event-driven code, rather than containers or virtual machines (though you can still run containers if you’d like). This “serverless” platform effectively abstracts away the underlying virtual machine/compute entirely and allows you to just run your code.

And, as with any Azure product, you pay only for what you use - in this case, that means your event-driven code is only billed when it’s running (per gigabyte of memory used, per second, not VMs billed per minute.. and usually left on 24/7/365). This is in contrast to something like Azure Container Instances, which will bill you for the underlying VMs regardless of actual usage (though you can scale in and scale out, you’re still paying for the VMs).

Configuring the cloud Kerberos trust - Kerberos SSO to domain resources with WHfB for Entra-joined clients

Sat, 07 Mar 2026 17:30:00 +0000

The scenario: I have a hybrid AD environment (identity and password hash synchronization) with Entra-joined endpoints. I’d like to authenticate to both cloud resources and on-premise domain-joined resources (via Kerberos) with my Windows Hello keypair.

Introduction

Entra-joined devices authenticating to domain resources

Right out of the box, an Entra-joined workstation with a user who’s synchronized from the on-premise domain and has signed in with a password will be able to authenticate to domain resources.

Creating a cloud-init VM template for AlmaLinux 10 on Proxmox VE

Thu, 26 Feb 2026 22:30:00 +0000

Just a quick example.

vmid=9001
image_name="AlmaLinux-10-GenericCloud-latest.x86_64.qcow2"
storage="local-lvm"

wget https://repo.almalinux.org/almalinux/10/cloud/x86_64/images/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2 -O $image_name

qemu-img resize $image_name 32G

qm create $vmid --name "almalinux-10-genericcloud" --ostype l26 \
  --memory 2048 \
	--agent 1 \
	--bios ovmf --machine q35 --efidisk0 "$storage":0,pre-enrolled-keys=0 \
	--cpu host --socket 1 --cores 2 \
	--net0 virtio,bridge=bridge0

qm set $vmid --sata0 local-lvm:cloudinit

qm importdisk $vmid $image_name $storage

qm set $vmid --scsihw virtio-scsi-single --scsi0 local-lvm:vm-${vmid}-disk-2,discard=on,cache=writeback,iothread=1,ssd=1

qm set $vmid --boot order=scsi0

qm template $vmid

Regenerating HTTP certs in an Elasticsearch cluster

Mon, 23 Feb 2026 20:35:00 +0000

Docs. This requires the “minimum security setup” to be complete (Elasticsearch security must be running for SSL to be in use). The automatic initialization will do this for you.

By default, initializing an Elasticsearch cluster will automatically generate some certificates for the transport and HTTP components of the Elastic application:

[root@es9-1 elasticsearch]# ls -l certs
total 24
-rw-rw----. 1 root elasticsearch  1939 Dec 12 16:49 http_ca.crt
-rw-rw----. 1 root elasticsearch 10077 Dec 12 16:49 http.p12
-rw-rw----. 1 root elasticsearch  5838 Dec 12 16:49 transport.p12
[root@es9-1 elasticsearch]# pwd
/etc/elasticsearch

After changing a node’s IP (use DNS, gosh darn it!) or hostname, you may need to regenerate its HTTP certificates, or things will permanently cease to function (Elastic uses mTLS for authentication for the cluster’s transport layer and HTTP REST API - no REST API, Elastic is very unhappy).

Performing a partial or full restore of an Elasticsearch cluster from a snapshot

Mon, 23 Feb 2026 20:30:00 +0000

See the docs at elastic.co/docs.

I’m starting with a three-node cluster (see Deploying a three-node HA Elasticsearch 9 cluster on AlmaLinux 9). It consists of:

3x KVM VM (4 vCPU, 16 GiB RAM, 128 GB of SSD)

es9-1
es9-2
es9-3

DNS is working.

I’ve loaded the Flights sample dataset to the cluster with Kibana just to have something to look at.

I’m adding:

1x KVM VM (2 vCPU, 4 GiB RAM, 128 GB of SSD), for a snapshot repository (NFS server):

Building out a test 3-node Elasticsearch 9 cluster on AlmaLinux 9

Mon, 23 Feb 2026 20:00:00 +0000

Intro

We’ll be configuring a (test) three-node Elasticsearch cluster, then installing and joining Kibana, on Alma 9 hosts.

Hardware:

3x KVM VM (4 vCPU, 16 GiB RAM, 128 GB of SSD):

es9-1
es9-2
es9-3

Installing Elasticsearch

Read the docs: installing Elasticsearch, installing Elasticsearch with RPM.

Add the Elastic signing key to your system:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Add the Elasticsearch 9.x repository to the system:

sudo tee /etc/yum.repos.d/elasticsearch.repo > /dev/null << 'EOT'
[elasticsearch]
name=Elasticsearch repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
type=rpm-md
EOT

Note that the repo’s enabled property is set to 0 so you don’t inadvertantly update Elastic.

Migrating Libvirt VMs to Proxmox VE by importing qcow2 disks to Ceph

Sun, 22 Feb 2026 23:00:00 +0000

I’m migrating from a Libvirt hypervisor (AlmaLinux 10) to Proxmox VE.

In my case, my images are backed by a cloud-init template:

[root@3060t0 ~]# qemu-img info --backing-chain /var/lib/libvirt/images/UniFi_OS.qcow2 
image: /var/lib/libvirt/images/UniFi_OS.qcow2
file format: qcow2
virtual size: 32 GiB (34359738368 bytes)
disk size: 5.09 GiB
cluster_size: 65536
backing file: /srv/iso/AlmaLinux-10-GenericCloud-10.0-20250528.0.x86_64.qcow2
backing file format: qcow2
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: true
    refcount bits: 16
    corrupt: false
    extended l2: false
Child node '/file':
    filename: /var/lib/libvirt/images/UniFi_OS.qcow2
    protocol type: file
    file length: 6.51 GiB (6987579392 bytes)
    disk size: 5.09 GiB

image: /srv/iso/AlmaLinux-10-GenericCloud-10.0-20250528.0.x86_64.qcow2
file format: qcow2
virtual size: 10 GiB (10737418240 bytes)
disk size: 439 MiB
cluster_size: 65536
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
    extended l2: false
Child node '/file':
    filename: /srv/iso/AlmaLinux-10-GenericCloud-10.0-20250528.0.x86_64.qcow2
    protocol type: file
    file length: 439 MiB (460062720 bytes)
    disk size: 439 MiB

So, before I move the VMs off this host (with the backing file on it) I had to rebase them (consolidate the backing file and changes to a new QCOW). This can be done by “converting” the current VM disk with qemu-img.

PVE/Ceph hyperconverged cluster build/Ceph performance tuning

Sun, 22 Feb 2026 22:00:00 +0000

Introduction

This is a continuation of (and hopefully the final rebuild for) my “2025 Q4” cluster build project (yeah, I went a little past my deadline there).

Long story short, I’ve been looking to eliminate single points of failure in my infrastructure (at least, where they’re easy to fix), so I wound up with three HP Z2 G4 SFF workstations (LGA 1151) and started trying to build a Proxmox (as I’m now responsible for supporting it professionally and do not have the time to figure out the perfect hypervisor That Is Not Proxmox) cluster out of them.

Failing to build a Proxmox + LINSTOR (DRBD) HCI cluster (ft. RDMA and ewaste!)

Mon, 02 Feb 2026 22:00:00 +0000

Introduction

I had a machine go down the other day. It was my sole “production” hypervisor (an old crappy Optiplex) running all my stuff. Yes, my redundant DNS… on one machine.

So I set about fixing it. I did some reading on distributed storage (because who do you think I am? I’m not going to waste machines on making my own SAN.. at least, I won’t if I have to pay for power), scrounged through the drawers for RAM and SSDs, ordered some modest hardware, and here we are. This is (supposedly) my new production hypervisor cluster!

Flash Mellanox ConnectX-3 Pro firmware (CX314A-BCCT to CX354A-FCCT)

Sat, 31 Jan 2026 19:00:00 +0000

Introduction

The ConnectX-3 Pro (MT27520) was sold in a few different configurations (e.g., dual SFP+, QSFP+, dual QSFP+, Ethernet only, Infiniband and Ethernet). However, all the ASICs are the same, so you can easily cross-flash them (It’s possible to flash VPI firmware to an Ethernet card if you want to unlock Infiniband.)

You can also typically flash OEM cards to stock Mellanox firmware with little hassle.

The most recent batch I purchased are CX314 Ethernet-only cards (about $10 each) so I figure I’ll crossflash them to the VPI cards before pressing them into service as IB HCAs (for that sweet, sweet RDMA).

Using Fluent Bit on Windows to ship event logs to VictoriaLogs

Wed, 14 Jan 2026 23:30:00 +0000

Windows install docs

Windows service setup

Fluent Bit is designed solely as a low-overhead forwarding agent, primarily for logs (though it does have support for metrics as well), and has a wide ecosystem of “input” and “output” plugins that permit it to be used to collect logs or metrics from a wide variety of things, then ship said logs or metrics to a wide variety of data stores (e.g., in our case, it’ll ship via a web request POSTing events to VictoriaLogs).

1, 10, 25, 40 gig NIC shopping list

Wed, 14 Jan 2026 20:50:00 +0000

Gigabit

BCM5719 (quad-port Broadcom PCIe 2.0x4, ~$15, SR-IOV, VMq)
BCM5720 (dual-port Broadcom PCIe 2.0x1, ~$10, SR-IOV, VMq)

Cheap OEM models of Broadcom NICs:

HP 331T (~$10 - 12)
- HP 332T - BCM5720 (<$10, some for ~$5)
Dell 0YGCV4 (not cheap, but included for completeness, ~$15)

Note that the HPE or Dell OEM NICs (especially HPE) you may have to tape off the SMBus pins (B5 and B6, lay the card flat with the rear/ports pointed to your left and go right four, don’t tape the back pins off, label tape, kapton tape, electrical tape will work fine) on the PCI-E finger of the card to get it to boot in things that are not a server. If you do not do this, you may encounter memory errors including failure to POST or missing memory channels.

IBM V7000 Expansion Module 2076-224 24SFF SAS2 disk shelves (Xyratex EB-2425-E6EBD)

Wed, 14 Jan 2026 20:45:00 +0000

I recently decommissioned an IBM V7000 SAN (dual controller, each is commodity Xeon, probably LGA 1366, running what is, as best as I can tell, Linux with a Java webapp for management). Good riddance.

I had a feeling that the disk shelves were just SAS, so I grabbed them for some science. Well, turns out, the Gen 1 IBM V7000 expansion modules are perfectly normal SAS2 disk shelves. Nothing special about them. They are white-labeled Xyratex EB-2425-E6EBD enclosures (as sold by Pure, NetApp, Dell, HPE, Cray, Seagate.. so, if you need parts, they’re very easy to find) and pretty quiet for 24x 600gb 10K spinnies per shelf. I hooked them up to a Dell H200E (LSI 2008) HBA and the disks came right up.

Windows Encrypted File System basics

Sun, 04 Jan 2026 17:45:00 +0000

BitLocker is great, but is primarily useful for preventing tampering when the system is offline. Once your system is online, a sufficiently privileged user could write to or read from anywhere on the disk. The Encrypted File System (EFS) exists to mitigate this.

EFS, a capability of NTFS (since Windows 2000) allows you to mark files or directories for transparent encryption.

This is not to be confused with Windows Personal Data Encryption, an Enterprise-edition feature tied to Windows Hello for Business introduced with Windows 11, version 24H2. PDE is similar, requires Windows 11 Enterprise (e.g., M365 E3/E5) and uses WHfB keypairs rather than user certificates (and thus requires Entra join and Windows Hello logon, and thus doesn’t work via RDP).

accurately generate SELinux policy with audit2allow

Tue, 09 Dec 2025 01:30:00 +0000

audit2allow is a powerful tool to turn a mess of SELinux audit logs into a policy that allows your application to do the stuff it needs to do. You can save time and headaches when attempting to fix SELinux access denial errors with a custom policy generated via audit2allow by:

unmasking “unimportant” events that may be preventing your service from functioning
- semodule -DB
dropping SELinux into passive mode (preferably for just the specific context)
- setenforce 0 or semanage permissive -a mycontext_t
wiping the audit log before a reproduce so you only feed audit2allow what is needed
- > /var/log/audit/audit.log
running the failing action/service/application and capturing a fresh set of events

# disable dontaudit so *every* selinux denial is logged
# some that the policy author thought were unimportant are probably masked
semodule -DB

# set selinux to 'passive' mode (audit but don't enforce MAC violations)
# this will let us log everything it's blocking (what we need to allow)
setenforce 0

# OR set just one context passive
# semanage permissive -a examplecontext_t
# to later set this "examplecontext_t" context back to enforcing:
# semanage permissive -d examplecontext_t

# clear the audit log so extra stuff doesn't find its way into our generated policy
> /var/log/audit/audit.log

# create audit events - run whatever is failing, e.g., systemd service 'mybrokenservice.service'
systemctl restart mybrokenservice

# capture all deny avc events into a policy template
cat /var/log/audit/audit.log | audit2allow -m mypolicy > mypolicy.te

# set SELinux back to 'enforcing' mode since we've probably collected our events now
setenforce 1
# OR if you just set one context: semanage permissive -d examplecontext_t

# reenable dontaudit so the log isn't filled with junk being intentionally blocked
semodule -B

Audit the generated *.te file (e.g., mypolicy.te) to confirm you’re not allowing too much access.

smartd > {eml,ntfy} on Alma 9 & 10, PVE 9

Mon, 08 Dec 2025 01:30:00 +0000

AlmaLinux 10.1 6.12.0 on amd64 (host “3060t0”) with smartmontools 7.4

Proxmox VE 9.1.1 6.17.2-1-pve on amd64 (host “800g4m0”) with smartmontools 7.4

See smartd.conf(5).

You probably want to know when a disk fails. smartd (typically included with the smartmontools package) can tell you.

If you don’t have smartmontools, get it:

sudo dnf install -y smartmontools

Confirm the smartd service is running:

$ systemctl status smartd
○ smartd.service - Self Monitoring and Reporting Technology (SMART) Daemon
     Loaded: loaded (/usr/lib/systemd/system/smartd.service; enabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:smartd(8)
             man:smartd.conf(5)

If needed, enable and start it:

systemd-journal-upload on AlmaLinux

Mon, 08 Dec 2025 01:00:00 +0000

See systemd-journal-remote(8), journal-remote.conf(5) for detailed setup instructions. Consider this a minimal config example. See this in my NixOS configuration.

AlmaLinux 10

Install the systemd-journal-remote package:

sudo dnf install -y systemd-journal-remote

Populate the configuration file. Adjust to fit. I’m pulling all of my logs into a VictoriaLogs instance; you can use another machine running journal-remote or any other log server that takes the journal-upload format.

If you intend to use port 443, you’ll need to modify SELinux policy. I’ve made my VictoriaLogs server listen on the default port (19532) for systemd-journal-upload instead.

basic Postfix config

Mon, 08 Dec 2025 00:30:00 +0000

AlmaLinux 10.1 6.12.0 on amd64 (host “3060t0”) with Postfix 3.8.5-8.el10

Postfix is a Mail Transfer Agent (MTA) - the component of a “mail server” that primarily handles routing and relaying email between mail servers. In other words, it is a lightweight utility capable of routing (and sending) mail.

Postfix does:

Send mail
Receive mail
Route mail between systems
Queue messages for delivery
Retry failed deliveries
Relay outbound mail

Postfix doesn’t:

NixOS root on (mirrored) ZFS

Sun, 30 Nov 2025 11:31:00 +0000

NixOS 25.05 6.12.55 8b9e30f on amd64 (host “6028a”)

Be sure to boot live media with the LTS kernel for ZFS support.

For more detail about partitioning & ZFS params, review this post, derived from the NixOS wiki, where I go into more depth.

Partitioning

Desired layout:

SSD #0
│─ /boot0 1G vfat
└─ rpool 1G 100% ZFS

SSD #1
│─ /boot1 1G vfat
└─ rpool 1G 100% ZFS

Fetch the ZFS package:

NixOS root on (natively encrypted) ZFS

Sun, 30 Nov 2025 11:30:00 +0000

NixOS 25.05 6.12.55 8b9e30f on amd64 (hosts = [ “p1g4” “t14g2a” ])

This is derived from the content on the NixOS wiki, with a few additions for personal ease-of-use. See wiki/ZFS.

I’ll be installing NixOS 25.05 on ZFS with native encryption (passkey at boot).

I’ve downloaded a standard 25.05 live image from nixos.org and booted the LTS kernel (if you do not do this, you won’t have ZFS support! you can probably manually build a live image with a newer kernel and ZFS, but the live:latest images don’t have ZFS!)

NixOS root on (plain) XFS

Sun, 30 Nov 2025 11:29:00 +0000

NixOS 25.05 6.12.55 8b9e30f on amd64 (host “xps9380”)

Example of lazy single / partition setup. You could run a smaller ESP that is not also /boot and lump /boot into / if desired, but I like to be consistent.

Disk layout:

SSD #0
│─ boot 1G vfat (ESP, kernel)
│─ swap 1G 17G (16G) swapdevice
└─ root 17G 100% XFS

sudo -i
# partition disk
parted /dev/nvme0n1 -- mklabel gpt
parted /dev/nvme0n1 -- mkpart ESP fat32 1MB 1G
parted /dev/nvme0n1 -- set 1 esp on
parted /dev/nvme0n1 -- mkpart swap linux-swap 1G 17G
parted /dev/nvme0n1 -- mkpart root 17G 100%
# helper vars for easier copypaste
boot="/dev/disk/by-id/nvme-Samsung_SSD_960_EVO_250GB-part1"
swap="/dev/disk/by-id/nvme-Samsung_SSD_960_EVO_250GB-part2"
root="/dev/disk/by-id/nvme-Samsung_SSD_960_EVO_250GB-part3"
# enable swap
mkswap -L swap "$swap"
swapon "$swap"
# format root part
mkfs.xfs "$root"
mkdir /mnt
mount "$root" /mnt
# format boot part
mkfs.fat -F 32 -n boot "$boot"
mkdir /mnt/boot
mount "$boot" /mnt/boot
# gen config, if needed
nixos-generate-config --root /mnt
# if not needed, now is a great time to clone/copy over your config
nixos-install --root /mnt
# set the root password when prompted, then reboot to your new system

Relevant bits of hardware configuration:

Point PVE system at a custom loopback interface to allow dynamic IPs without dependencies

Sat, 29 Nov 2025 11:30:00 +0000

PVE 9.1.1 6.17.2-2 (2025-11-26T12:33Z) on amd64

Proxmox VE’s cluster services heavily rely on DNS (they need the node to resolve its hostname to a non-loopback IP address), even in a single-node scenario. This is just a byproduct of its “always-clustered”, multi-master design. This poses a problem if you’d like a self-contained, portable PVE system without dependencies on external DNS or a static network configuration (e.g., a static entry in /etc/hosts, which is the default behavior).

Migrating guests between incompatible versions of QEMU

Sat, 29 Nov 2025 01:30:00 +0000

You cannot live-migrate Libvirt VMs between different QEMU versions over SSH (sadly, since that feature is awesome). You can, however, easily perform an offline migration.

I was migrating from Alma 10 to Fedora 43; your QEMU machine types may vary.

First, stop the VM on the source server.

Dump the configuration for the domain:

root@machine0:~# virsh dumpxml file-pub-0.lab.wporter.org > file-pub-0-cfg.xml

Copy the VHD over (typically to /var/lib/libvirt/images), and copy the config over somewhere easily accessible (it’s just going to be used to define the VM in the new spot). scp is nice and easy to use for this (and means your traffic is going over the wire encrypted).

Proxying the Proxmox VE & Backup Server web UIs with NGINX

Fri, 28 Nov 2025 22:30:00 +0000

PVE 9.1.1 6.17.2-2 (2025-11-26T12:33Z), PBS 4.1.0 6.17.2-1 (2025-10-21T11:55Z) on amd64

See docs (pve.proxmox.com).

For more info on using the built-in ACME certificate renewal utilities, see this other post on that subject (wporter.org).

PVE

Simpler (maybe) - reuse the proxmox-acme script

If you want to use the built-in /usr/share/proxmox-acme ‘requester’ (managed with pvenode or the web UI), omit a HTTP redirect/ACME block so NGINX doesn’t eat port 80 and just point NGINX at the /etc/pve/nodes/hostname/pveproxy-ssl.pem certificate.

Proxmox VE & Backup Server built-in ACME cert renewal

Fri, 28 Nov 2025 21:30:00 +0000

PVE 9.1.1 6.17.2-2 (2025-11-26T12:33Z), PBS 4.1.0 6.17.2-1 (2025-10-21T11:55Z) on amd64

Relevant docs: Proxmox VE docs - Certificate Management, Proxmox BS docs - HTTPS Certificate Configuration, pvenode(1), proxmox-backup-manager(1).

If you’re using a custom ACME responder with a private (not publicly trusted) certificate, be sure to install your root cert and update-ca-certificates before trying to connect to the CA via HTTPS to request a cert.

PVE

Create an ACME account on the PVE box:

Renaming a standalone Proxmox node with guests

Fri, 28 Nov 2025 21:30:00 +0000

PVE 9.1.1 6.17.2-2 (2025-11-26T12:33Z) on amd64

Reference docs, this forum post.

I would really recommend shutting down your guests before doing this.

Modify /etc/hosts (OR your DNS record, if you’re not using the hosts file), /etc/hostname, /etc/mailname (if applicable), /etc/postfix/main.cf:

sed -i 's/oldname/newname/g' /etc/{hosts,hostname,/postfix/main.cf}

Then, it’s simplest to stop the cluster filesystem and edit the backing database to rename the /etc/pve/nodes directory for the server.

Yes, really, though fighting the cluster FS and moving, not copying, the files in mounted /etc/pve/nodes/old to /etc/pve/nodes/new (directory by directory - you cannot move/rename a non-empty directory on the pmxcfs, so you will have to move /old/qemu-server/*, etc) should also work if this makes you squeamish.

Install a root certificate on Proxmox VE, BS, DM

Fri, 28 Nov 2025 20:30:00 +0000

Proxmox uses the system certificate store, so install your certs the same way you would on any other Debian system:

scp root-ca-a.crt root@proxmox:~
ssh root@proxmox
mv root-ca-a.crt /usr/local/share/ca-certificates/
update-ca-certificates

ipmitool

Sun, 23 Nov 2025 20:30:00 +0000

TL;DR

Configure networking:

sudo dnf install -y ipmitool || nix-shell -p ipmitool
sudo ipmitool lan set 1 ipsrc static
sudo ipmitool lan set 1 netmask 255.255.255.0
sudo ipmitool lan set 1 defgw ipaddr 0.0.0.0
sudo ipmitool lan set 1 ipaddr 192.0.2.10
sudo ipmitool mc reset warm

List users:

sudo ipmitool user list

Set a password:

read -s password
sudo ipmitool user set password 1 "$password"

Get network info:

sudo ipmitool lan6 print
sudo ipmitool lan print

Get reported power consumption:

ipmitool is a utility for interacting with system BMC/IPMI controllers/management interfaces.

Testing and stressing spinning drives

Fri, 21 Nov 2025 20:30:00 +0000

Intro

When purchasing spinning drives from eBay, you’ll usually want to run a torture test on them (so if they’re going to die, they die during your return window).

I like to use two utilities for this:

badblocks(8) is a utility to “search a device for bad blocks”.
smartmontools allows you to send commands to supported drives, e.g., to request that they perform a self-test.

badblocks isn’t perfect for its original intended use case - e.g., it can’t tell if your drives decide to use their massive reallocation areas and have fixed bad blocks themselves, which they often will - but it does give you an easy way to generate quite a lot of I/O (of course, you could do the same thing with fio if you so please.)

USB-C laptop docks

Wed, 29 Oct 2025 20:30:00 +0000

What a mess. I miss old port replicators.

TL;DR

New laptop with Thunderbolt or USB4 + want 3+ high-res displays? Dell WD22TB4 or Lenovo 40B0

AMD without USB4? Lenovo 40AS, Dell WD19TB or WD19s

Mac? Caldigit/OWC, or 40AS/WD19TB/WD22TB4 to save a buck. Desperate for screens? DisplayLink. It’s complicated

Cheap? Dell WD19TB/Lenovo 40AC

Standards

USB-C w/ DisplayPort alt mode and power delivery: your laptop almost certainly has this, unless it is quite literally the cheapest thing on the planet.

Azure Container Instances fundamentals & quick lab

Sun, 26 Oct 2025 20:30:00 +0000

Let’s wrap a basic Python script in a Docker container and run it in Azure Container Instances. Additionally, we’ll set up Azure Monitor to alert us when the container fails. Pretty simple!

This will target the following areas of the AZ-104 study guide:

Create and configure storage accounts
Provision and manage containers
- Create and manage an Azure container registry
- Provision a container using Azure Container Instances

The benefits of using Azure Container Instances are many:

Registering Azure resource providers

Sun, 26 Oct 2025 16:30:00 +0000

You must enable resource providers to use parts of Azure with a subscription. This helps protect you from compromise by making it more difficult for a malicious user with lesser privileges to activate new services in a subscription, according to Microsoft.

This is usually done automagically if you have the adequate permissions (to perform the /register/action operation) and try to create a resource that requires a currently-inactive provider, but you can certainly go ahead and toggle these manually.

Notes on adding Trusted Locations via registry/rant about M365 Business

Tue, 21 Oct 2025 23:30:00 +0000

My example will be Excel, but this applies to any Office apps.

If you have Office for Business (e.g., M365 Business Premium), your apps don’t support ADMX anymore (thanks, Microsoft). This is an “Office for Enterprise” (E3/E5) or Office LTSC feature only.

Sometimes, the Office admin center (config.office.com) will apply policy, but it’s very unreliable and very difficult to troubleshoot - even in environments with hybrid Azure AD join configured, you’ll only get a handful of your installations calling home. Don’t waste your time with it. You will need to set the applicable options in the registry. This can be done through Group Policy or your preferred RMM/logon script (easy!) or Intune (perhaps as a remediation).

Quick thoughts on M3 15" Mac Air

Mon, 20 Oct 2025 23:30:00 +0000

Imagine a picture of a Mac here. I was too lazy to take one.

Backstory

Short version:

I broke the embedded DisplayPort connector on my ThinkPad P1 G4 (too much use?) and wound up buying a MacBook Air after briefly going back to Linux (and remembering how much I don’t like Windows desktops).

Long version:

I swapped too many motherboards in and out of my P1 Gen 4. The embedded DP connector on my original (and only working) board, with a RTX A2000/i7-11800H, stopped holding the cable in properly. After some tape didn’t really fix the issue and my screen kept flickering like mad, I switched to a T14s Gen 1 AMD that I’ve had on backup duty for a little while. It’s far too slow to run Windows 11, so I wound up running Fedora 42 with the GNOME desktop environment.

Custom Google Search string to not show AI overview

Mon, 20 Oct 2025 23:00:00 +0000

I hate this AI overview thing. If I wanted to use a LLM, I would go use a LLM.

To get rid of it, you can create a custom search engine in your preferred browser with the following search string:

{google:baseURL}/search?udm=14&q=%s

udm=14 takes you to the “web” results area immediately (not the primary one with AI garbage on it).

To add a new search engine (search string) in Chrome, navigate to chrome://settings/searchEngines, scroll down to “Site Search Engines”, click Add, then click the three dots next to your new “search engine” and set it as the default.

Mellanox SX6036 basics (setup, licensing, noise, power, VPI)

Mon, 20 Oct 2025 22:00:00 +0000

Intro

The Mellanox SX6036 is a 36-port 56 Gb/s FDR Infiniband/Ethernet switch. Its forwarding is handled by the Mellanox SwitchX-2 switch chip, and its management plane is a Big Endian PowerPC chip running MLNX-OS (Linux).

The SX6036 is interesting because:

it supports both Infiniband and Ethernet simultaneously, including Ethernet routing (with a very little bit of effort to enable the required licenses)
it’s around $90 off eBay
it has a friendly, Cisco-like CLI
it runs Linux and you can get shell access pretty easily
perhaps most importantly, because the SwitchX-2 (despite being nearly 15 years old) is rather efficient - 50w at idle with stock fans and no active connections. With DACs, this power figure only slightly increases.

As for supporting hardware, QSFP 40/50 GBe Mellanox ConnectX-4 LX Ethernet NICs are about $20 all day at the time of writing, and the switch isn’t particularly picky about who made the optics or DACs that you plug into it (though Mellanox DACs are quite cheap - I picked up a buttload of 1M and 3M 40/100GBe DACs and some breakouts for about $100).

Sending mail with Python via the Microsoft Graph API

Wed, 24 Sep 2025 22:00:00 +0000

You can use the application Mail.Send permission and the https://graph.microsoft.com/v1.0/users/user/sendMail Graph API endpoint to send mail from a script or program via Microsoft 365. Pretty straightforward - the only slightly complicated part is restricting the scope of your Mail.Send permissions to a specific inbox or group of inboxes, which is an Exchange Online-ism.

Let’s go through a quick Python example of sending an email. We’ll get the app registration created, then scope down access to members of a security group. Then, we’ll send a message with a basic example, before getting everything running in a Podman container.

Azure Application Gateway (HTTP load balancer) lab

Sun, 21 Sep 2025 22:00:00 +0000

Relevant MS Learn training module here.

Just dumping some notes here so it doesn’t look totally dead.. I’ve been busy doing work & study things that are not particularly bloggable this month.

Review of docs

Azure App Gateway is a regional, web-specific load balancer that processes traffic to web apps hosted by a pool of web servers. It can load balance HTTP traffic, offload SSL from your web servers, and inspect traffic (serving as a WAF - e.g., filtering SQL injection or XSS attempts).

PowerShell Core (Microsoft Graph and Az) in a toolbox container on your Linux box

Sun, 24 Aug 2025 22:00:00 +0000

If you’re like me (god, for your sake I hope you aren’t) you love PowerShell and use Linux.

I’m also super lazy. And I don’t like Microsoft adding 5,000 repositories to my system to keep PowerShell updated. The solution? A container!

Toolbox lets you very easily jump into a podman container for a development environment. In this container, you can typically install whatever you’d need as if it was on a bare metal install - no special anything required. Since all I need is PowerShell, we’ll keep things simple.

Microsoft MD-102 (Endpoint Administrator): Pass!

Sat, 23 Aug 2025 12:00:00 +0000

My thoughts on the certification

I passed the Intune test!

It’s been about a year since I started working at a shop that uses Intune (a bit - for iOS and Macs), so on a whim I decided I should get the cert. It took me about three weekends, plus a few hours of study during the week.

I had a decent bit of experience with Intune, but don’t use it daily.

Configuring silent OneDrive sign-in and Known Folders sync

Sun, 17 Aug 2025 17:00:00 +0000

MS Learn link here.

You can do this via Group Policy or Intune, depending on how your environment is configured, but the policies are the same.

Deploying silent OneDrive sync with Intune

For successful, silent sync, you MUST configure these three policies:

Silently move known folders to OneDrive
Silently sign users in to OneDrive with their Windows credentials
Enable Files on Demand

Here is an example of this minimal configuration in Intune. Choose just these settings from the Settings Catalog and enable them:

Onboarding Microsoft Defender for Endpoint with Intune

Sun, 17 Aug 2025 16:45:00 +0000

Licensing Prerequisites

Your tenant requires a license for Defender for Endpoint - either a Microsoft Defender for Endpoint P1 or P2, Microsoft Defender for Server, or Microsoft Defender for Business (“P1.5” edition for SMBs included with Microsoft 365 Business Premium).

Without one of these licenses, you will not see the Assets > Devices tab or the Settings > Endpoints menu, and cannot onboard devices to MDE.

It may take up to 24 hours for your Defender tenant to be provisioned once you have purchased and assigned the required licensing. Your admin account does not need to be licensed.

Microsoft Intune Assignment Filters

Sun, 17 Aug 2025 16:30:00 +0000

For info on designing filters for performance and manageability, see MS docs.

Device assignment filters allow you to select what devices a policy assigned to users will apply to, and let you select what devices in a device group are eligible for a policy.

App assignment filters allow you to select what devices specific app protection policies apply to.

They’re both useful tools for scoping down your Intune configuration policies. Let’s have a look at them!

Notes on managing Android devices with Microsoft Intune

Sat, 09 Aug 2025 17:30:00 +0000

This isn’t super polished, but should give you a good idea of how using Intune to manage Android devices works if you’ve dealt with Windows or iOS management in the past. Notes made while prepping for the Microsoft MD-102.

Prerequisites

Managed Google Play account setup

Before getting started, we’ll need to get a managed Google Play account set up.

Navigate to the Intune admin center (intune.microsoft.com), then click on Devices > Android > Enrollment. Select the “Managed Google Play” option under “Prerequisites”:

Deploying Windows LAPS for client PCs with Microsoft Intune

Sat, 09 Aug 2025 16:35:00 +0000

Introduction

The Windows Local Administrator Password Solution (LAPS) allows administrators to configure a randomized, automatically rotated administrative password for Windows devices. This is a distinct feature from macOS LAPS.

Windows LAPS, integrated with Entra ID, replaces the older ’legacy’ Microsoft LAPS solution as of Windows 11 23H2. Microsoft is no longer updating ’legacy’ LAPS and its .msi package will be blocked from installing on Windows 11 24H2, Server 2025, and newer OSes.

Configuring Firefox via policy (registry)

Sun, 13 Jul 2025 21:00:00 +0000

Firefox supports a JSON configuration file on all platforms. If you’re only working with Firefox and are dealing with a number of different platforms, this would probably be the preferred way to go about setting policy, since it’s pretty easy to use.

However, since I’m primarily dealing with Windows desktops, we’ll just use the registry. Mozilla’s docs list the registry path as “GPO” for some reason, but they do show the registry path for all of their policies, so yay. Firefox policy works the same way as Chromium. Extensions are a bit different, but we’ll get to that.

Hardening and customizing Google Chrome via policy (registry)

Sun, 13 Jul 2025 17:35:00 +0000

Quick one here. Just going to list some policies, discuss setting them, and link to the docs and a script for setting them.

We can manage Chrome via MDM (like Intune), Group Policy (if the machine is joined to an Active Directory domain and you’ve imported the relevant ADMX), via ‘preferences’ JSON config files (Mac or Linux), or via the Windows registry (my preferred option since it applies to any Windows PC, regardless of management infrastructure, and is easy to script).

Setting up Cockpit with Certbot and a private CA with an ACME endpoint

Wed, 09 Jul 2025 21:35:00 +0000

This is an excerpt from my step-ca post that I felt is useful enough to have its own post.

I have a server running Cockpit that I’d like to use a valid SSL certificate from my CA. I’d like it to renew its own certificate. Let’s do that.

First, be sure to install the root certificate on the system. Since this is a machine running AlmaLinux 10, that looks something like this:

Building out a signing certificate authority that supports ACME with step-ca and an OpenSSL root

Sun, 06 Jul 2025 21:35:00 +0000

This is part two of a multi-part series. Today, I’ll be configuring an intermediate CA under the root CA I set up in this article.

step-ca is a modern online CA for automated certificate management. It’s got reasonable defaults and is fairly easy to use as an intermediate CA for smaller environments.

To learn more about step-ca itself I recommend a trip over to the step-ca docs at smallstep.com, but the highlights are the simple nature of the tool and the variety of built-in automated provisioners you can use (like OIDC SSO tokens, ACME challenges, identity documents, and JWK tokens). It’s also a decent SSH CA.

Using OpenSSL to generate a root certificate (using OpenSSL on a Linux server as a root certificate authority)

Wed, 02 Jul 2025 21:35:00 +0000

Introduction

Certificates are often viewed as “black magic” - and, as with any cryptographic topic, that’s entirely true! Cryptography is great.

Thankfully, you don’t need to be a cryptographer to use public key infrastructure (PKI) to establish trust between systems.

If you’ve ever created an SSH key pair, you’re already familiar with the fundamentals! SSH key pairs and SSL certificates are extremely similar.

In a typical PKI setup, certificate authorities (CAs) act as the trust anchors. You can think of a certificate like an SSH public key: you distribute your public key, and devices that have it can verify that you - holding the corresponding private key - are who you say you are.

Why doesn't Windows support modern cryptography?

Tue, 01 Jul 2025 19:35:00 +0000

Try to feed Windows a certificate with an Ed25519 signature somewhere in the chain and it’ll just FALL OVER because CNG doesn’t support Ed25519 AT ALL?

This is an operating system that is ‘modern’ and ‘current’ and ‘has AI’.

Here! Watch it fall over when I try to do anything with a cert:

God forbid you want to use something with an Ed25519 signature in the chain:

Installing Wiki.js (PostgreSQL, NGINX) on AlmaLinux 10

Mon, 30 Jun 2025 19:35:00 +0000

This guide demonstrates installing Wiki.js, the NGINX reverse proxy, Certbot (an ACME client that we’ll use for automated SSL certificate renewal), a backing PostgreSQL database, and a supporting Elasticsearch container on an AlmaLinux 10 server.

Wiki.js is a Node.js application that relies on a database - we’ll be using PostgreSQL.

We’ll put a NGINX reverse proxy in front of the Wiki.js web application to handle SSL, and configure Wiki.js to listen on only localhost (127.0.0.1:3000) so that only NGINX is exposed to the outside world.

Fixing duplicate artist names in local FLAC files played by Spotify

Sun, 29 Jun 2025 19:35:00 +0000

Spotify has a bug where it’ll duplicate artist names if they’re listed more than once in the metadata of a FLAC file (e.g., in the Artist and Album Artist fields). See below:

This has been a problem since at least 2022 - see this Spotify Community post by yule from 2022-11-09 - so I doubt it’s going to be fixed. This bug doesn’t occur with MP3s; only FLAC files.

Using Grafana Alloy on Windows to export (push) metrics (from Prometheus) and logs (from Loki)

Sun, 29 Jun 2025 19:30:00 +0000

Grafana Alloy is a multi-use exporter that we can run on our hosts to expose metrics for Prometheus. It also does other stuff, like send logs to Loki. It’s got a lot of features - you can read more it at grafana.com/docs.

Essentially, Grafana Alloy is an Open Telemetry-compatible collector that serves as a unified telemetry agent for popular services like Loki and Prometheus.

Some relevant points about Alloy:

We can replace the Prometheus Windows Exporter with Alloy, as Alloy for Windows has the Prometheus Windows Exporter built in.
We can use Alloy as a collector/forwarder to push metrics to Prometheus (rather than the default pull) which may be desirable, depending on your specific environment and firewalling
Grafana Alloy replaced the older Grafana Agent.
Alloy allows us collect and push logs to Loki in addition to collecting and pushing metrics to Prometheus.
Alloy has a considerable memory footprint compared to the much leaner Windows Exporter, but is necessary if you would like to push metrics to Prometheus. I’ve noticed Alloy consuming an order of magnitude (20x, in this case) more memory than the standalone Exporter (~370 mb vs ~20 mb).

Installing Alloy on Windows

There is not yet a Winget package for Grafana Alloy (thought there was, but couldn’t find it). You can download and (silently) install it with the following PowerShell:

Passing a function to a PowerShell subprocess (without making a terrible, terrible mess)

Thu, 26 Jun 2025 19:30:00 +0000

This took a bit of experimenting. I’m still not completely certain that this is the most reasonable way to go about this, but I’ve already lost a few hours of my life to it, so oh well. It works.

I had a script, we’ll call it Charles.

Charles has functions.

I need to run some of Charles’s functions in a subprocess, so I can be sure all of Charles’s son’s handles are closed and collected by the GC.

Enumerating user profiles on a device with PowerShell

Wed, 25 Jun 2025 13:30:00 +0000

I was working on a script to set values in all existing profiles’ HKEY_USER hives (more on that soon) and wound up coming up with a quick function to enumerate all the users that have a profile on a computer.

It would probably be fairly simple to compare the profiles for which no SID to name mapping was possible and delete their C:\Users directories to free up disk, but I won’t be doing that just yet.

Quick thoughts on & power consumption of Supermicro 6028 with X10DRU-TR4T+

Mon, 23 Jun 2025 15:30:00 +0000

I got a pair of these for storage servers. Still haven’t used them for more than some quick tinkering yet. Bit of a waste.

Some findings

You can drop a peripheral (Molex) to SATA power cable and SFF 8087 to SATA breakout cable in these to shove some SATA drives in the back of the box. I’ve done this with both of mine.

By combining this with some U.2 risers you could feasibly fit eight internal SATA drives, twelve spinners in the front, and twelve more NVMEs in PCI-E slots. Since the system has a quartet of built-in Intel X540 10gbe NICs, you could actually consider using all of the remaining PCI-E for drives.

Using the Dell Command | Update CLI to update drivers from PowerShell

Mon, 23 Jun 2025 14:30:00 +0000

Dell Command | Update is the only piece of Dell software that I intentionally put on machines. It’s one of the two useful Dell apps, alongside the Power Manager applet. It’s a driver manager that can be used to fetch the most recent drivers validated and published for a piece of Dell hardware, and it’s a nice utility to have.

It’s better (in my opinion) than HP and Lenovo’s options (Support Assistant and Commercial Vantage, respectively) because it’s available via the Winget packages Dell.CommandUpdate (Classic, v4.6) and Dell.CommandUpdate.Universal (.NET 8, v5.5), and it has a usable CLI interface that can be used to configure the software with PowerShell!

Dell Latitude 7320 Detachable (PC tablet) review - hardware, Windows 11, Fedora 42

Sun, 22 Jun 2025 14:30:00 +0000

Introduction
Hardware
- Display
- Build
- Peripherals
Performance
Windows (11 24H2 LTSC)
Linux (Fedora 42, with GNOME)

Introduction

I’ve always liked the idea of a modern Windows tablet. It can double as a desktop, connected to a Thunderbolt dock, do the job of a laptop, with a (hopefully) decent keyboard and a kickstand, and do the job of a tablet - either for entertainment, or for a portable drawing pad. It would be perfect! See, I really don’t want to throw a locked-down iPad into my mix of devices, and I really don’t want a buggy, slow Android tablet, either. And if you don’t like Windows, GNOME provides a pretty decent tablet interface, too!

Removing lingering VMware PowerShell modules

Sun, 08 Jun 2025 14:30:00 +0000

Problem

After removing VMware PowerShell modules with Get-Module | Where Name -like VMware* | Uninstall-Module, VMware cmdlets are lingering around:

Administrator in ~
❯ get-module

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     0.0                   Copy-PubKey
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-It…
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Ob…
Script     2.3.6                 PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption, …


Administrator in ~
❯ get-vmhost
WARNING: Please consider joining the VMware Customer Experience Improvement Program, so you can help us make PowerCLI a better product. You can join using the following command:

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $true

VMware's Customer Experience Improvement Program ("CEIP") provides VMware with information that enables VMware to improve its products and services, to fix problems, and to advise you on how best to deploy and use our products.  As part of the CEIP, VMware collects technical information about your organization’s use of VMware products and services on a regular basis in association with your organization’s VMware license key(s).  This information does not personally identify any individual.

For more details: type "help about_ceip" to see the related help article.

To disable this warning and set your preference use the following command and restart PowerShell:
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $true or $false.
Get-VMHost: 6/8/2025 12:32:42 PM        Get-VMHost              You are not currently connected to any servers. Please connect first using a Connect cmdlet.

Solution

Use the Get-InstalledModule cmdlet instead of the Get-Module cmdlet:

Administrator in ~
❯ get-installedmodule | where Name -like VMware*

Version              Name                                Repository           Description
-------              ----                                ----------           -----------
13.3.0.24145081      VMware.CloudServices                PSGallery            PowerShell module that contains command …
13.3.0.24145081      VMware.DeployAutomation             PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.ImageBuilder                 PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.PowerCLI                     PSGallery            This Windows PowerShell module contains …
13.3.0.24145081      VMware.PowerCLI.Sdk                 PSGallery            Product agnostic types definitions for t…
13.3.0.24145081      VMware.PowerCLI.Sdk.Types           PSGallery            Types definitions for the VMware.PowerCL…
13.3.0.24145081      VMware.PowerCLI.VCenter             PSGallery            Modules for automating and managing VMwa…
13.3.0.24145081      VMware.PowerCLI.VCenter.Types.Appl… PSGallery            Types definitions for the VMware.PowerCL…
13.3.0.24145081      VMware.PowerCLI.VCenter.Types.Cert… PSGallery            Types definitions for the VMware.PowerCL…
13.3.0.24145081      VMware.Sdk.Nsx.Policy               PSGallery            This PowerShell module contains cmdlets …
1.0.2099.24145081    VMware.Sdk.Runtime                  PSGallery            This PowerShell module contains PowerShe…
13.3.0.24145081      VMware.Sdk.Srm                      PSGallery            This PowerShell module contains cmdlets …
13.3.0.24145081      VMware.Sdk.Vcf.CloudBuilder         PSGallery            This PowerShell module contains cmdlets …
13.3.0.24145081      VMware.Sdk.Vcf.SddcManager          PSGallery            This PowerShell module contains cmdlets …
13.3.0.24145081      VMware.Sdk.Vr                       PSGallery            This PowerShell module contains cmdlets …
13.3.2099.24145081   VMware.Sdk.vSphere                  PSGallery            This PowerShell module is a parent modul…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance        PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Access PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Health PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Infra… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Local… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Loggi… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Netwo… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Recov… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Suppo… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.System PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Tls    PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Appliance.Update PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Cis              PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Cis.Tagging      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Content          PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.ContentLibrary   PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Esx.Hcl          PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Esx.Hosts        PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.Esx.Settings     PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.SnapService      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.VAPI.Metadata    PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter          PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Authent… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Authori… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.CertMan… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Consump… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Content  PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Datasto… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Deploym… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Guest    PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.HVC      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Identity PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Invento… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.ISO      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.LCM      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Namespa… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Namespa… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.OVF      PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Services PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Storage  PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.SystemC… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Tagging  PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Topology PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Trusted… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.VCHA     PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.Vm       PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vCenter.VmTempl… PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphere.vStats           PSGallery            This PowerShell module contains PowerShe…
8.0.2099.24145081    VMware.Sdk.vSphereRuntime           PSGallery            This PowerShell module contains PowerShe…
8.3.0.24145081       VMware.Vim                          PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Cis.Core       PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Cloud          PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Common         PSGallery            This PowerShell module contains function…
13.3.0.24145081      VMware.VimAutomation.Core           PSGallery            This PowerShell module contains Windows …
13.3.0.24145081      VMware.VimAutomation.Hcx            PSGallery            This Windows PowerShell module contains …
13.3.0.24145081      VMware.VimAutomation.License        PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Nsxt           PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Sdk            PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Security       PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Srm            PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Storage        PSGallery            This Windows PowerShell module contains …
1.6.0.0              VMware.VimAutomation.StorageUtility PSGallery            This Windows PowerShell module contains …
13.3.0.24145081      VMware.VimAutomation.Vds            PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.Vmc            PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.vROps          PSGallery            This PowerShell module contains PowerCLI…
13.3.0.24145081      VMware.VimAutomation.WorkloadManag… PSGallery            PowerShell commands for automation of wo…
13.3.0.24145081      VMware.VumAutomation                PSGallery            This PowerShell module contains PowerCLI…

Remove all of these modules:

Changing a Linux username

Sat, 07 Jun 2025 20:30:00 +0000

Super easy:

First, call usermod -l (change login) with the -d (home) and -m (move home) args. This changes the username, moves the old home directory to the new home directory:

sudo usermod -l new_name -d /home/new_name -m old_name

Next, call groupmod –new-name to rename the user’s group.

sudo groupmod --new-name new_group_name old_group_name

Annd.. you’re done! See? Super easy.

Performing an in-place upgrade from Alma 9 to Alma 10 with LEAPP and ELevate

Sat, 07 Jun 2025 20:00:00 +0000

That time of year again! Time to break all my stuff!

x86-64-v2 systems

Quick aside about x86-64-v2 systems (generally these are processors Ivy Bridge and earlier - 3000 series Intel, E3/E5/E7 v2 or older).

EL10 does NOT normally support older processors that do not implement AVX2.

Most notably, this excludes some fairly recent embedded/low power SKUs (any Intel “small cores” prior to Gracemont, introduced in 2021, like Tremont in the Lakefield or Jasper Lake products that were sold until quite recently) and Ivy Bridge (the Intel Core 3rd generation SKUs, or Xeon E3/E5/E7 v2 chips like the E5-2680 v2) processors.

Updating the osinfo database on a Linux hypervisor

Sat, 07 Jun 2025 17:00:00 +0000

The osinfo database provides “all the information about an operating system that is required in order to provision and manage it in a virtualized environment.” (libosinfo.org)

In a nutshell, it’s metadata about guest OSes for use by hypervisors. I haven’t poked at it more than this, but I like it when my guest OSes are recognized, there are two that I now use commonly that are not recognized: Windows Server 2025 and AlmaLinux 10.

SSH agent forwarding

Tue, 03 Jun 2025 19:00:00 +0000

SSH agent forwarding allows you to use a local SSH agent (your local keys, 1Password, etc) on a remote machine.

You can use this to “pass” authentication requests made by you on a remote session back to your local machine, or “delegate” authentication requests from your workstation to a jumpbox, depending on how you look at it.

To enable agent forwarding to a remote host, all you have to do is edit your local ~/.ssh/config (or ~\.ssh\config) file on your workstation with the keys, and add a Host declaration:

Listing and removing RPM GPG (PGP) keys

Tue, 03 Jun 2025 18:30:00 +0000

List keys

Our first goal will be to list the installed PGP public keys in the format we need, with a human-readable summary, as follows:

# structure:
gpg-pubkey-version-release My Organization <email@address.org> public key
# ex:
gpg-pubkey-105ef944-65ca83d1 Fedora (42) <fedora-42-primary@fedoraproject.org> public key

To do so, you can use the rpm command with arguments ‘--query --queryformat’ (this may be abbreviated to ‘-q --qf’).

We’ll be querying RPM for gpg-pubkey(s), and we’ll need to specify a queryformat that will get us the rpm-format shorthand identifier for a key:

Configuring a Server 2008 R2 domain

Sun, 25 May 2025 16:30:00 +0000

Why are you doing this?

Fun!

Goal

DNS, DHCP and AD DS installed and working for a FL 2008 AD domain that we can then join physical Hyper-V Server 2008 R2 machines to.

I’ll be installing a couple of VMs on my desktop/main Windows server running 24H2 (Windows 11 Enterprise LTSC and Windows Server 2025). These have an i9-12900KS and a pair of E5-2698 v3 CPUs, respectively, which are both x86-64-v3 (this is a newer 12900 without AVX512). Then, we’ll think about standing up a Hyper-V Server 2008R2 machine.. or a cluster of them.. in another post.

Setting up a Windows 7 box in mid 2025

Fri, 23 May 2025 16:30:00 +0000

Why on earth would you want to do that?

Windows 7 is great and I would love it if the whole world knew what kind of Content I watch. More seriously, I wanted to briefly play an old Command & Conquer game and didn’t feel like tinkering with my Windows 11 box. Plus, nostalgia.

Hardware

I will be using relatively appropriate hardware.

I briefly tried a NUC7, but it doesn’t really have any USB 2 ports, so getting through setup is annoying.

Lazy PowerShell ssh-copy-id for Windows with SSH keys stored in 1Password

Sun, 11 May 2025 16:30:00 +0000

Introduction

The version of OpenSSH bundled with Windows does not include the ssh-copy-id utility for quickly copying a SSH key to a remote machine.

I use 1Password’s SSH agent, and store my SSH key in 1Password, so I can unlock it with biometrics (Windows Hello) instead of a passphrase, easily synchronize it between my machines, and avoid storing it on local disks. However, this means I can’t just copy my id_ed25519.pub from one of my boxes using the 1Password SSH agent (because that file isn’t created!)

Configuring LACP bonds & VLAN bridges with nmcli

Sat, 03 May 2025 18:30:00 +0000

LACP is awesome if you’re not terminating L3 on your servers. It’s also super easy to configure bonds with NetworkManager.

Configuring LACP (802.3ad) bonds with nmcli

To configure a bond, you’ll need to:

Create the bond interface
Assign connections as slaves to the bond
Bring the bond up

This is pretty simple:

[liam@t3 ~]$ nmcli con add type bond con-name bond0 ifname bond0 bond.options "mode=802.3ad"

This will create a bond0 device, and a bond0 connection - you can see them in the output of nmcli con or nmcli dev:

Installing Ninja Remote (NinjaRMM remote session utility) on Linux with Wine

Sat, 26 Apr 2025 18:30:00 +0000

~~NinjaRMM sucks. Here’s how to run its terrible little connection tool on a proper OS.~~

Update: as of August 2026, NinjaOne have released a native Linux “Ninja Remote” connection utility. This is no longer needed! Yay!

First, install a user-agent spoofer in your preferred browser - Ninja’s site won’t even show the connection button without this nowadays. Set it to Windows something.

Here are links to a user agent spoofer-manager thing:

Poking at the Intel Management Engine (vPro Enterprise, AMT) for IPMI-like remote access on a M920q

Wed, 23 Apr 2025 18:30:00 +0000

I’m sure that if you’re reading this post on my backwards sysadmin blog, you’re at least vaguely familiar with the Intel Management Engine. For shoots and giggles, let’s chat about it anyway.

Essentially, it’s a tiny embedded computer (like your good old ASpeed BMC) that’s tightly integrated with almost any recent (2008+) Intel Platform Controller Hubs (PCHs - the chipset on a modern Intel board) or on the SoC itself (for Atom mobile processors - these have an integrated Security Engine). It has the potential to give you full remote access to the system at a hardware level (potentially far greater access than a separate BMC). The ME runs its own operating system (MINIX, in this generation, though this changes every so often). It runs its own applications that do.. stuff - its full scope of access/functionality is not documented, but extra fun features have been used by malware in the past.

Quick and dirty - install KB5002623 fix for Office 2016 crashing after KB5002700 installation via executable patch

Thu, 10 Apr 2025 18:30:00 +0000

Really dirty quick fix to install Microsoft’s executable April 10, 2025 patch for Office 2016, KB5002623 that resolves a number of crashes caused by the KB5002700 security fix from April 8, 2025.

While it is not especially pretty, it works. Replace the $Fileserver variable with a parent directory that has the four executables for KB5002700 and KB5002623 (64 and 32-bit) as children, like so:

[liam@server ~]$ sudo ls -l /srv/www/files
-rw-r--r--. 1 nginx nginx 262752112 Apr 11 00:15 mso2016-kb5002700-fullfile-x64-glb.exe
-rw-r--r--. 1 nginx nginx 134911608 Apr 11 00:15 mso2016-kb5002700-fullfile-x86-glb.exe
-rw-r--r--. 1 nginx nginx   3556192 Apr 10 21:17 msodll202016-kb5002623-fullfile-x64-glb.exe
-rw-r--r--. 1 nginx nginx   3556144 Apr 10 22:10 msodll202016-kb5002623-fullfile-x86-glb.exe

And, without further ado, here’s the script:

Cleaning up ghost Saved-Critical Hyper-V VMs after nuking all their files

Sun, 06 Apr 2025 00:30:59 +0000

So, I decided to upgrade my laptop. Part of that upgrade was the very caring removal of my D: drive, since the new board only had a single M.2 slot. My D: drive happened to be a second SSD with.. my Hyper-V config and VM disk directories.

Once I’d powered the machine back on and jumped back in to try and get rid of my ghost VMs via PowerShell, I was greeted with a pleasant sight:

Maxxing out my P1 Gen 4 with an RTX A5000 16gb and an i9-11950H (for science)

Sat, 05 Apr 2025 12:12:59 +0000

Update

That wonderful 16g of VRAM was on its way out. Back to the baby GPU for me.

Introduction

My P1 Gen 4 is just about my favorite laptop. It’s got a big, bright, reasonably high resolution 16" screen (2560x1600, 400 nits, 100% sRGB, 60hz.. more on this Soon™ - there are some real nice 4K 120hz 16" panels for cheap), no number pad, lots of memory, a nice glass trackpad, and it has a TrackPoint.

Looking at filesystem types on disks from Linux

Sun, 30 Mar 2025 12:13:59 +0000

Not sure why I went through so many ways to do this. But I did. Was slightly curious about how I might go about this.. guess I’m happy now.

Unmounted

parted

parted /device print will give you a nice list of partitions, name, and filesystem.

[liam@800g4m0 ~]$ sudo parted /dev/sda print
Model: ATA WDC WDS100T2B0A (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start   End     Size    File system  Name                          Flags
 1      1049kB  274MB   273MB   fat32        EFI system partition          boot, esp
 2      274MB   290MB   16.8MB               Microsoft reserved partition  msftres
 3      290MB   1000GB  999GB   ntfs         Basic data partition          msftdata
 4      1000GB  1000GB  631MB   ntfs                                       hidden, diag

You can also parted /device print all to get parted to look at every disk.

The setuid, setgid, and sticky special file permissions bits

Sun, 30 Mar 2025 12:12:59 +0000

Red Hat blog

These are the leading zero!

The setuid and setgid properties are used to allow a trusted executable to be run with elevated permissions (either can do this - as user, or as group respectively) or to control the group assigned to newly created children of a directory (setgid).

The setuid and setgid bits can be set with either chmod (u|g)+s or a leading digit, when using three-digit-style permissions (possibly platform-dependent).

Adventures with secedit.exe and PowerShell, pt. 1

Thu, 27 Mar 2025 12:13:59 +0000

I have a problem

Secedit is a bit confusing to use at first, so let’s build a PowerShell wrapper to do our bidding!

First, how do we use this darn thing?

After a brief detour to MS Learn and some poking around…

Secedit is funky! It wants you to treat it with care and take it on long walks. No slamming random SIDs at it and making it figure the hard stuff out (at least, not yet)!

Writing something like free in PowerShell

Sun, 23 Mar 2025 12:13:59 +0000

The free utility is great - just look at it!

[liam@m920q-1 ~]$ free -h
               total        used        free      shared  buff/cache   available
Mem:            30Gi       2.9Gi        11Gi       9.0Mi        17Gi        28Gi
Swap:           31Gi          0B        31Gi

Yeah! Woo!! Doesn’t that look great?

But getting at it generally requires us to use a proper OS. Boo!! Not great!!

The Linux sysadmins are going to give us crap for not having this wonderful, amazing tool! How do we ~~copy it~~ create ~~the same thing~~ an even better tool on our lovely NT machines?

ReFS sucks and you shouldn't use it, but here's how you can configure ReFS deduplication and compression (if you really want to do this to yourself)

Sat, 22 Mar 2025 12:13:59 +0000

Microsoft’s ReFS is their (terrible) answer to ZFS - a “modern” filesystem with fancy features like deduplication and checksumming.

While the implementation of said features (specifically deduplication) frankly sucks, and I have not found it to be anywhere near production-ready, I have set ReFS up on my own machines to save some disk space when I’m being cheap and need Windows.

If at all possible, you should switch to Linux and use ZFS or BTRFS instead. You will most likely have a bad time with ReFS.

Updating multiple M365 mailboxes' autoreply settings

Thu, 20 Mar 2025 12:13:59 +0000

Quick one for a personal reminder.

You can also schedule an autoreply by setting State to Scheduled, and providing a StartTime and EndTime.

# set autoreply for multiple users

$Message = @"
This mailbox is no longer monitored.<br>
<br>
If you require assistance, please contact so-and-so in the Doing Stuff office.<br>
<br>
Thank you,<br>
IT
"@

@('user1@domain.net','user2@domain.net') | % { 
    Set-MailboxAutoReplyConfiguration `
        -Identity $_ `
        -AutoReplyState Enabled `
        -ExternalMessage $Message `
        -InternalMessage $Message `
        -ExternalAudience All
}

Resolving ESXi 8.0 esxcli software profile MemoryError with hostupdate depot

Sun, 16 Mar 2025 11:13:59 +0000

Problem

VMware ESXi 8 host fails to query the hostupdate (hostupdate.broadcom.com) depot’s contents with a MemoryError when an esxcli software profile update command is issued.

This also prevents ESXi from being updated (does not just affect querying the depot).

[root@vmware:~] esxcli software profile update -p ESXi-8.0U3c-24414501-standard -d https://hostupdate.broadcom.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
 [MemoryError]
 Please refer to the log file for more details.

Verify

Search the /usr/lib/vmware/esxcli-software file for the mem= argument being passed to the Python interpreter. The default 300 Mb is insufficient for querying the chunky ESXi 8 hostupdate depot, though 7.0 and 6.7 will still work fine.

vCenter Server Appliance - regen certs, recover PWs, other tips and tricks

Sun, 16 Mar 2025 11:12:59 +0000

Enabling SSH

Consider this a prerequisite for everything that follows.

If SSH was not enabled while you set up the VCSA (it’s a toggle labeled “Enable SSH” with a tooltip about being required for HA - you probably left it off) you can enable it via the vCenter Server Management UI at port 5480.

Log on to the management UI. In the left menu, select “Access”.

Click “Edit” in the top right of the screen, toggle “Activate SSH Login”, then click “OK”.

Changing vCenter Server DHCP address

Sun, 16 Mar 2025 10:12:59 +0000

Problem

You would like to change the IP address for a vCenter Server appliance that is currently configured with DHCP by modifying the reservation.

Doing this the way you might first think of (by changing the reservation then forcing the VCSA to get a new IP) fails, because you must regenerate certificates afterwards and cannot do so when the SSO authentication service is not working (after an IP change).

Solution

Tested with a VCSA ver 8.0.3.00000 on 16 Mar 2025. Fresh install, not a neglected appliance!

Updating standalone VMware ESXi hosts from the online hostupdate depot with esxcli

Sat, 08 Mar 2025 10:12:59 +0000

Problem

You have a standalone VMware ESXi server, or a non-clustered (no vCenter available) set of servers that need to be updated.

Solution

Before starting:

Verify that your IPMI/BMC is plugged in! If it is not, you will not have a good time if your sole ESXi server fails to write the bootloader and wipes its config at a site three hours away. Make sure it’s accessible somehow.
Check your server’s DNS settings! Name resolution won’t work once you suspend VMs if the server is pointed at a guest it’s running.

Cisco 3850 ignoring startup-config on boot, config-register stuck at 0x142

Sat, 22 Feb 2025 10:12:59 +0000

Problem

This appears to be Cisco bug CSCui54490.

After a write erase (or, I believe, a format flash: or a PW recovery in this case?) a 3850 will ignore its startup-config and always boot a blank configuration.

My switch is running IOS-XE 16.12.11 (Gibraltar), date Sun 31-Mar-24 12:30 (a minor version behind at the time of writing), though this seems to be a long-standing issue.

show version output suggests config register is 0x142.

Revisited: Working with Hyper-V NAT switches

Sat, 01 Feb 2025 10:12:59 +0000

Foreword

This is an update to a similar post from back in October 2024.

I’ve been going through and cleaning up a lot of my setup scripts and the like in pursuit of ~~SCIENCE~~ easier to use and quickly reproducible testing environments.

Occasionally, I want to configure NAT switches for small-scale, self-contained environments. I didn’t have anything that made this process nice, so I decided to fix something up.

Of course, before I knew it I’d wound up redoing the original post linked above - so I’d might as well post it!

Snippet: branch and merge a detached head with main

Sat, 25 Jan 2025 10:12:59 +0000

I keep doing this. But I keep doing it infrequently enough that I need to look up the solution every darn time. So I’m putting it here.

I think VSCode’s source control integration does this somehow when I make changes in a submodule and main project, then commit the main project changes first, though I have no idea why this is the case.

The following is probably the easiest way to fix up a detached head and get back to work:

Getting started with Cloud-init on Hyper-V

Fri, 24 Jan 2025 10:10:10 +0000

Intro

This will go over setting up an environment to build Cloud-init nocloud data drives (ISO, not vfat), converting nocloud disk images to VHDX, and then using those to hands-off provision VMs on Hyper-V hosts that can then be configured with Ansible.

More specifically, this will demonstrate using Cloud-init and the Alma Linux genericcloud image to stand up an Alma Linux VM on a Server 2025 host.

What is Cloud-init?

Cloud-init is a Canonical project that’s become the defacto standard for touchless configuration of Linux VMs over the years. Cloud-init is a package that can be installed on a Linux or Unix system that will read configuration files and provision a template VM on first boot for its environment.

Enabling Hyper-V in Windows Home editions

Sat, 11 Jan 2025 10:10:10 +0000

There’s a batch script floating around that does this, but I was curious to see if it still worked and wanted to rewrite it in PowerShell.

Tested and working with a Media Creation Tool version of Windows 10 Home Single Language 22H2 and Windows 11 Home 24H2.

PowerShell:

Function Enable-HyperVOnWinHome {
    [CmdletBinding()]
    param ()
    $ssp = "$($env:SystemRoot)\Servicing\Packages"
    Get-ChildItem -Path $ssp |
    Where-Object Name -like "*Hyper-V*.mum" |
    ForEach-Object { & dism.exe /online /norestart /add-package:$ssp\$_ }

    & dism.exe /online /enable-feature /featurename:Microsoft-Hyper-V /all
}

# this is not required, but you might want to enable the VM Platform while you're here
# if it's missing, WSL won't work.

& dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Proof:

JNCIA lab: simple route redistribution in Junos

Mon, 06 Jan 2025 10:10:10 +0000

Topology:

Images used:

IOSv L2 15.2 (as dumb hosts) IOSv L3 15.9 JOSv (vMX) 23.2R1.15

Configure interfaces’ addressing as shown.

Configure a mesh of four routers in an OSPF area: JR1, JR2, JR3 and CR1

OSPF should advertise these four routers’ loopback addresses. Any interface not facing another OSPF router should be declared passive.

Configure RIP on JR3 and JR4. Modify the default export policy so they can talk. Redistribute the RIP routes to 169.254.0.16/30 and 192.51.100.0/24 into the OSPF area. Redistribute JR3’s OSPF routes into RIP on JR3 and JR4. Make sure CS1 can ping any of the loopback addresses in the topology with just a default route configured to JR4.

Windows Hello fingerprint 'too similar to one that's already registered' with no fingerprints registered

Sun, 05 Jan 2025 10:10:10 +0000

Problem

Windows Hello fingerprint/face broke themselves after a hardware change (reenabling iGPU.) Not sure why. Fingerprint still working in UEFI (as supervisor authentication.) Able to easily reregister Hello face ID. Not able to reregister Hello fingerprint ID with error “this fingerprint is too similar to one that’s already registered” when I attempt to register any fingerprint. Fingerprint is NOT cleared from the TPM (still usable for power on/supervisor authentication.)

Device: ThinkPad P1 Gen 4 w/ Synaptics UWP WBDI fingerprint reader (synaumdf.cat, WUDFRd.sys, AuthenticateFAM_SecureFP.dll) using 6.0.45.1136 driver (1/30/24)

The Bitlocker Script

Mon, 16 Dec 2024 10:10:10 +0000

Problem

Needed to enable BitLocker on lots of machines with varying configurations.

Really didn’t want to do it manually, especially since this problem will not go away.

Solution

Uhh. Couple hours of PowerShell.

It works OK. Couple things I could still improve. I’ve run this probably a couple thousand times by now. It should be more or less idempotent and plays nicely with common edge cases (does not catastrophically fail.) It will happily encrypt my USB disks since they’re just exposed to the system as fixed NVMEs, but that’s not the script’s fault… as annoying as it can be.

Snippet: unlock a SSH key for use with Ansible

Sun, 15 Dec 2024 12:34:56 +0000

Pulled out of a readme.md, since it’s easier for me to keep it in one place (here.)

To unlock a protected SSH key for use by Ansible:

$ eval "$(ssh-agent -s)"
Agent pid 5695
$ ssh-add
Enter passphrase for /home/user/.ssh/id_ed25519:
Identity added: /home/user/.ssh/id_ed25519 (/home/user/.ssh/id_ed25519)

ansible-playbook -i host configure.yaml

Hide 'sign into all apps' pop-up in Microsoft apps

Tue, 10 Dec 2024 12:34:56 +0000

Problem

Users, when signing into Teams or Office, are prompted to “sign into all apps on this device” (Entra join a machine), which then fails with error “Your account was not set up on this device because device management could not be enabled” with code 80192EE7 (server msg: 0x80192ee7.)

We don’t want users getting this prompt at all.

Solution

Luckily, there’s a way to do just that (block our users from getting this prompt.) It’s only possible to do this directly from the registry, with key and value:

Snippet: one-liners to install all RSAT utilities

Mon, 02 Dec 2024 12:34:56 +0000

Server 2025

Get-WindowsFeature | Where Name -like "*RSAT*" | Install-WindowsFeature

Windows 11

Get-WindowsCapability -Online | Where Name -like "*RSAT*" | Add-WindowsCapability -Online

Requiring multiple, different factors for Windows Hello console authentication

Sun, 01 Dec 2024 12:34:56 +0000

NOTE: this works with normal Windows Hello without any backing infrastructure if you just want to require two Hello factors to sign on to a machine - this is how I use it (make a convenience PIN more secure.) NOTE: yes, Hello for Biz is MFA on its own, kind of.

By setting up first factor to be biometric or a PIN, then setting the second factor to be proximity or a PIN, I can make sure that I’m able to sign in with Hello when my phone is dead by passing biometric authentication and then entering my PIN.

Snippet: Disable max vCPUs eq phys. threads restriction in Proxmox VE 8.3

Wed, 27 Nov 2024 12:34:56 +0000

Source:

jknight comment on Proxmox forums

Problem:

Needed to assign more than 64 threads to a VM for testing (just needed more than 64 threads, don’t care about performance or lack of it.)

This was helpful and took a little bit of digging to find.

Solution:

Open /usr/share/perl5/PVE/QemuServer.pm with your favorite text editor.

Remove lines 3772 - 3776 (if you’re /ing around afterwards or have an otherwise modified config file, this will be right after line 3770: my $vcpus = $conf->{vcpus} ? $conf->{vcpus} : maxcpus;)

Snippet: enabling forwarding between Hyper-V NAT vSwitches (WSL & int. NAT)

Tue, 26 Nov 2024 12:34:56 +0000

https://superuser.com/a/1764704

In my case, with NAT switch ‘vlab0-natswitch’ and the default WSL NAT switch (so I can run Ansible playbooks against VMs behind a different NAT switch) the following one-liner does the trick. Adjust interfacealias values to suit.

get-netipinterface | where {$_.interfacealias -eq 'vEthernet (vlab0-natswitch)' -or $_.interfacealias -eq 'vEthernet (WSL (Hyper-V firewall))'} | set-netipinterface -forwarding Enabled -verbose

Works!

liam@liam-p1g4i-0:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:b7:bc:42 brd ff:ff:ff:ff:ff:ff
    inet 172.28.133.19/20 brd 172.28.143.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:feb7:bc42/64 scope link
       valid_lft forever preferred_lft forever
liam@liam-p1g4i-0:~$ uname -r
5.15.167.4-microsoft-standard-WSL2
liam@liam-p1g4i-0:~$ ping 192.0.2.10
PING 192.0.2.10 (192.0.2.10) 56(84) bytes of data.
64 bytes from 192.0.2.10: icmp_seq=1 ttl=127 time=1.41 ms

Snippet: using Winget from system context (NinjaRMM scripts)

Fri, 22 Nov 2024 12:34:56 +0000

Yes, NinjaRMM has features for Winget package management. No, I didn’t look it up, and it wasn’t enabled in our tenant.

$WingetPath = Resolve-Path "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller*\winget.exe"

if (-not $WingetPath){

	Write-Error -Message "Winget path not found. Failure. Exiting."
	return 1
	
}

$WingetPath = Split-Path -Path $WingetPath -Parent

Set-Location $WingetPath

.\winget.exe install --exact --id Microsoft.Teams --silent --accept-package-agreements --accept-source-agreements

Renaming domain member detaches Computer Object

Wed, 20 Nov 2024 12:34:56 +0000

If renaming a domain member succeeds but the corresponding computer object is not updated, the trust relationship between the domain and the computer will break, preventing you from logging in, among other things.

Luckily, the fix is just modifying the Name, SamAccountName (mandatory) and DNSHostName (optional) properties of the computer object:

Get-ADComputer -Filter * | Where Name -eq 'OLDNAME' | Rename-ADObject -NewName 'NEWNAME' -PassThru | Set-ADComputer -SamAccountName 'NEWNAME$'

I’d probably rename the machine again afterwards in an attempt to get it to clean any remaining bits of itself up. You can do this once the computer account name and AD object name have been updated.

Snippet: setting up nested virt for Juniper (GNS3)

Sun, 20 Oct 2024 12:34:56 +0000

vJunos-switch deployment guide - 5g, 4 cores

Juniper VMs nest the control plane inside a Linux VM emulating forwarding plane - for this reason, running virtualized Juniper devices in a VM can be problematic

I’d recommend not trying to do the above and using something dedicated

This is probably from an Ubuntu Server install:

See if nested virtualization is enabled

grep -cw vmx /proc/cpuinfo

Enable nested virtualization

echo "options kvm-intel nested=1" >> /etc/modprobe.d/kvm.conf modprobe -r kvm && modprobe kvm systemctl restart libvirtd

PowerShell: some commands for working with disks, volumes, VGs

Tue, 15 Oct 2024 12:34:56 +0000

One-liner to format a new disk as a single NTFS partition:

Get-Disk $DiskId | Initialize-Disk | New-Partition -UseMaximumSize | Format-Volume -Filesystem "NTFS" -AsJob -DriveLetter "Z"

Get-Partition will get you volumes (code block is missing MSR & EFI for brevity):

PS C:\Users\liam\Documents\tftp> get-partition | fl

UniqueId             : {00000000-0000-0000-0000-000100000000}eui.0000000001000000E4D25CA7DB4F5501
AccessPaths          : {D:\, \\?\Volume{aa409295-7d41-48b2-82e9-2154277448e5}\}
DiskNumber           : 1
DiskPath             : \\?\scsi#disk&ven_nvme&prod_intel_ssdpeknu01#5&159106e5&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
DriveLetter          : D
Guid                 : {aa409295-7d41-48b2-82e9-2154277448e5}
IsActive             : False
IsBoot               : False
IsHidden             : False
IsOffline            : False
IsReadOnly           : False
IsShadowCopy         : False
IsDAX                : False
IsSystem             : False
NoDefaultDriveLetter : False
Offset               : 16777216
OperationalStatus    : Online
PartitionNumber      : 2
Size                 : 953.85 GB
Type                 : Basic

UniqueId             : {00000000-0000-0000-0000-501100000000}eui.002538BA11B7787A
AccessPaths          : {C:\, \\?\Volume{ebf986f5-f46c-4e19-81fc-7a27c989a895}\}
DiskNumber           : 0
DiskPath             : \\?\scsi#disk&ven_nvme&prod_samsung_mzvl21t0#5&27c54347&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
DriveLetter          : C
Guid                 : {ebf986f5-f46c-4e19-81fc-7a27c989a895}
IsActive             : False
IsBoot               : True
IsHidden             : False
IsOffline            : False
IsReadOnly           : False
IsShadowCopy         : False
IsDAX                : False
IsSystem             : False
NoDefaultDriveLetter : False
Offset               : 290455552
OperationalStatus    : Online
PartitionNumber      : 3
Size                 : 953.01 GB
Type                 : Basic

Get-PhysicalDisk will give you serial numbers (the actual disks, if you can believe that)

Create a vSwitch and a NetNat object to avoid Default Switch DHCP

Mon, 07 Oct 2024 12:34:56 +0000

Problem: Need a more controlled local testing environment, double NAT/routing hijinks are a bit much

Solution: This plus DHCP running on an internal DC works for now

Tested on: Windows 11 24H2 Ent LTSC with PS 7.4.5

# create the switch
$SwitchAndNatName = "internal-nat"
$Switch = New-VMSwitch -SwitchName $SwitchAndNatName -SwitchType Internal

# configure addressing for the gateway/hypervisor
$IPAddress = "192.0.2.1"
$PrefixLength = 24
$NetAdapter = Get-NetAdapter | Where Name -eq "vEthernet ($($Switch.Name))"

New-NetIPAddress -InterfaceIndex $NetAdapter.ifIndex -IPAddress $IPAddress -PrefixLength $PrefixLength

# create a new NAT object
New-NetNat -Name $SwitchAndNatName -InternalIPInterfaceAddressPrefix "$($IPAddress)/$($PrefixLength)"

POST an Intune app registration to the Microsoft Graph API

Thu, 03 Oct 2024 12:34:56 +0000

Problem: “The selected app does not have a latest package version” error preventing app registration in Intune/Endpoint Admin Center

Attempting to register Adobe Acrobat Reader DC (XPDP273C0XHQH2) as an Intune app of type Windows Store (New) results in a “The selected app does not have a latest package version” error. Intune admin center says that “This app is not supported in preview.”

This seems to be a version error that seems to be caused by PackageVersion: Unknown, according to Sander Rozemuller, a M365 blogger. Speaking of them, thanks to Sander Rozemuller’s blog post on the topic for showing me that I can get around this. Without that post I would probably have stayed lost.

Updating ESXi 8 hosts from a depot file

Fri, 05 Jul 2024 12:34:56 +0000

Personal notes - I usually use Lifecycle Manager because it’s easy.

Download the depot file from somewhere (of course I mean the Broadcom portal, you dirty pirate.)

Upload the depot file to a host datastore of some kind, either through the web UI browser or with SCP.

user@pc:~$ scp VMware-ESXi-8.0U3-24022510-depot.zip user@hv0.mydomain.internal:/vmfs/volumes/<datastore>

You can either use esxcli remotely, or ssh into the host.

Determine which profiles are available from the depot with esxcli once it’s on accessible storage.

T14s Gen 1 AMD + Windows 11

Sat, 29 Jun 2024 12:34:56 +0000

New laptop! Well, not really.

This machine isn’t exactly new to me (or new at all, really.) It’s been doing a lot of heavy lifting for me over the past few months, so I thought I’d take a moment to appreciate it a bit and give it a writeup.

This was a $300 eBay find that I used to replace a Latitude 3540 (to get myself a centered keyboard, TrackPoint, smaller device, and more cores/memory/disk) as my primary machine at my day job.

Removing ghost SipAddress and SipAddressProxy values from M365 user accounts

Fri, 28 Jun 2024 12:34:56 +0000

Ran into this problem while attempting to remove a domain from a Microsoft tenant. Stale mailboxes that no longer had licenses were showing that they were still associated with a problem domain (as reported by Get-MsolUser -DomainName "domain.tld" and the Admin Center domain menu). Specifically, they had an “IM Address” associated with the domain, despite having all aliases cleared - I could find nothing in the GUI relating to this.

Disabling systemd-resolved and letting NetworkManager control /etc/resolv.conf on Fedora 40

Sun, 23 Jun 2024 12:34:56 +0000

Resolved regularly fails to resolve things properly for no apparent reason, and was kind of a pain to troubleshoot when I first tried to do so.

Here is how to disable it and allow NetworkManager to manage the /etc/resolv.conf file instead. Shockingly, things stop randomly breaking once this is done.

Reconfigure NetworkManager to permit it to manage DNS resolvers
Stop and mask the resolved service
Remove /etc/resolv.conf to clear out existing contents
Restart NetworkManager to apply the configuration change

First, allow NetworkManager to configure the system’s DNS resolvers by editing the /etc/NetworkManager/NetworkManager.conf file.

Configuring SSH clients for use with IOS 15.0(2)SE11 on a Cisco 3750x

Sat, 15 Jun 2024 12:34:56 +0000

Intro

The 3750x is a very old switch. It does not support newfangled things like ‘secure cryptographic algorithms.’

I’m not going to throw away a perfectly adequate gigabit L3 switch (IP Services!) and I would like to be able to use SSH to manage it (instead of squatting on the floor in the basement next to it with a mini USB cable every time I need to modify the config.)

Deleting messages org-wide with Exchange Online PowerShell

Mon, 10 Jun 2024 12:34:56 +0000

Why

Don’t have Defender P2 (so you can’t Threat Explore or manually delete messages) and need to get rid of some phishing messages batched out to your users? Not a problem (while Exchange Online PowerShell is around.)

How

PowerShell 7.4.2
$sender = "sender@domain.com"
$upn = "exchangeadmin@company.com"
$searchname = "${sender} spam"

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName $upn
Connect-IPPSSession -UserPrincipalName $upn

New-ComplianceSearch -Name $searchname -ExchangeLocation All -ContentMatchQuery "(From:${sender})"
Start-ComplianceSearch -Identity $searchname
New-ComplianceSearchAction -SearchName $searchname -Purge -PurgeType harddelete

Optionally, block the sender’s address:

New-TenantAllowBlockListItems -ListType Sender -Block -Entries $sender -NoExpiration

Sources

MS Learn - Search for and Delete Email Messages

MS Learn - New-ComplianceSearch

Setting up Vagrant with libvirt (Fedora 40)

Wed, 05 Jun 2024 12:34:56 +0000

Hi! This is personal documentation (also known as ‘my notes.’) Quality is.. not guaranteed. WIP as of 6/10/24. I keep getting distracted by PowerShell and SQL

Adapted on 6/5/24 from:

Quickstart

Install packages

# dnf install qemu-kvm libvirt libguestfs-tools virt-install rsync vagrant
# systemctl enable libvirtd && sudo systemctl start libvirtd
# vagrant plugin install vagrant-libvirt

Download a box

$ vagrant box add fedora/40-cloud-base --provider=libvirt

Hey! Are you from the future? Is Fedora 40 old now?

Windows DRIVE$ shares

Thu, 11 Apr 2024 12:34:56 +0000

C$

There are hidden ‘administrative’ drive shares on every Windows installation. You can view a list of configured shares with the net share command:

C:\Users\liam>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
C$           C:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\Windows                      Remote Admin

You can make use of these for stuff. Some of that stuff is a good idea.

I use this primarily for (fairly) direct filesystem access to guest VMs from my workstations (over an internal network).

ESXi 8 - ignoring a TSC mismatch PSOD

Tue, 09 Apr 2024 12:34:56 +0000

Problem

Both of my Dell T5810s fail to boot ESXi 8.0U2 - they quickly meet a PSOD that calls out a TSC sync error.

The CPUs in these machines are an E5-2660 v4 and E5-2690 v4 (both the 14-core Broadwell die, incidentally.)

The TSC is off by same value every boot, and both machines experience no instability with Win/Linux (or ESXi after the counter error is bypassed.) YMMV with bypassing this yourself.

CCNA Complete!

Fri, 15 Mar 2024 10:10:10 +0000

Done. Finally.

Took a month and a bit at around ~3 hrs a day, longer than expected because of inefficient study (working on it) and a handful of personal things (stuff happens). Learned a decent amount thanks to hands-on practice (mostly self-made labs in GNS3).

I enjoyed playing with routers and switches much more than just reading about WLC configuration or Cisco SDA. Looking forward to dumping some time into ENARSI study, though that’ll probably wait until next year at the earliest (more like ‘in two years, after ENCOR and some work experience’) unless networking becomes my ’thing’.

Fedora 39 + T14 Gen 2 AMD

Wed, 31 Jan 2024 01:30:00 -0500

Introduction

This is about my “new” laptop (I’ve had it for around a year now, and I bought it used) but there’s some minor config shenanigans that are essential to get it performing as well as it should on Linux. And I like to talk about hardware.

Use Case

I wanted a laptop that I can get away with using as a desktop (so I don’t have to deal with syncing half my user directory anymore), and so I can work on whatever VM or local project wherever I am, even if I forgot to push something to Github.

Brief Look at CLNS & CLNP

Wed, 24 Jan 2024 20:00:00 +0000

CLNS & CLNP - The ‘Future Network’, other tidbits

Exploring some old standards and the pieces they left behind

This post will likely grow over time. I’ll make this site’s repository public once it’s cleaned up a bit so diffs are accessible, and I will update this introductory paragraph to reflect any changes. I don’t intend to keep looking into CLNS at the moment, but I expect to pick it back up at some point.

Power Consumption

Sun, 07 Jan 2024 10:10:10 +0000

This is a writeup of some testing I did on C422/Skylake-W, dual socket (2S) C602/Ivy Bridge-EP, single socket (1S) C612/Broadwell-EP, 2S C612/Broadwell-EP and H87/Haswell-S prebuilt desktops, RDNA and Polaris GPUs, i350-t4 and SFN7122F NICs for power consumption.

So.. my power is in the $0.25/kwh range. Which sucks. I wanted to figure out how much my heaps of sand in nice metal cases cost me so I can make more informed decisions before replacing everything with more E5-2690 v4s.

CompTIA Net+ Retrospective

Sat, 30 Dec 2023 19:14:24 +0000

Updated post-CCNA, 3/2024. Lines preceded by a ‘+’ are new additions.

Introduction

I took and passed my N+ with around an 800 on 12/21/2023. I spent about thirty hours explicitly studying for the Net+ and taking practice tests, over the course of about a week. Here’s what I thought of it, and what I learned.

Study Material

I used Jason Dion’s practice tests and made flashcards. I was able to pass the Net+ with basic knowledge that I already had. No official study material and I didn’t follow a prep book.