things from here and there

Large file listing diffs with postgres

2024-01-16T00:00:00+00:00

I recently needed to know what files were missing from a backup (~2 million files). Directory structure aside, I simply needed to know what files were missing from the destination. Once I got a recursive file listing of both source and destination directories, I imported them into unique postgres tables and did a LEFT OUTER JOIN query to see what was present in the source but absent in the destination.

docker postgres

Spin up postgres in Docker leveraging env_file with credentials and an initial database named sample_db.

# postgres.env
POSTGRES_USER="post_user"
POSTGRES_PASSWORD="post_pass"
POSTGRES_DB="sample_db" # default Postgres database

# docker-compose.yaml
version: '3'

services:
  postgres:
    container_name: postgres
    image: postgres:14.1
    restart: always
    ports:
      - 5432:5432
    env_file:
      - ./postgres.env # contains POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB
    volumes:
      - ./postgresql_data:/var/lib/postgresql/data

docker-compose up -d

connect to postgres

Export the following environment variables for psql.

# .envrc
export PGHOSTADDR=127.0.0.1
export PGDATABASE=sample_db
export PGUSER=post_user
export PGPASSWORD=post_pass

Connect with psql. You’ll be dropped into the default Postgres database.

➜ psql
psql (16.1, server 14.1 (Debian 14.1-1.pgdg110+1))
Type "help" for help.

sample_db=#

create tables

From the sample_db=# prompt create two tables with rows named file_name.

CREATE TABLE destination_files (
  file_name TEXT
);
CREATE TABLE source_files (
  file_name TEXT
);

List the tables.

\dt
               List of relations
 Schema |       Name        | Type  |   Owner
--------+-------------------+-------+-----------
 public | destination_files | table | post_user
 public | source_files      | table | post_user
(2 rows)

import data

sample data snippets

Below are snippets from destination_files.txt and source_files.txt.

# source_files.txt
zip
zip
zip
zip
zip
zip
zip
zip

# destination_files.txt
893145.zip
893146.zip
893147.zip
893148.zip
893149.zip
893150.zip
893151.zip
893152.zip

use `psql` to copy the data

Exit from the psql sample_db=# prompt. Use psql -c to copy the data into their respective tables.

➜ psql -c "\COPY source_files (file_name) FROM './source_files.txt'"
COPY 2131354

➜ psql -c "\COPY destination_files (file_name) FROM './destination_files.txt'"
COPY 2131350

diff the data

Connect with psql again. From the sample_db=# prompt run the following query.

SELECT *
FROM source_files
LEFT OUTER JOIN destination_files ON source_files.file_name = destination_files.file_name
WHERE destination_files.file_name IS NULL;

From the output we can see the four files present in the source but absent in the destination.

 file_name | file_name
-----------+-----------
 1344167.zip |
 1310270.zip |
 1420005.zip |
 2033203.zip |
(4 rows)

A Puppet fact for the OU location of a server in Active Directory

2018-10-23T00:00:00+00:00

Drop the fact code wherever you place your facts (e.g. site/profile/facts.d). This will generate a fact named activedirectory_meta with the following JSON formatted data. The fact is pretty useful if you want to scope / target your Puppet code based on the location of the node in Active Directory. Credit to the OneScript Team for some of the System.DirectoryServices.DirectorySearcher logic.

{
  "dn" : "CN=DEN3-NODE-3,OU=puppet-nodes,OU=LabStuff,OU=Servers,DC=ad,DC=piccola,DC=us",
  "ou" : "OU=puppet-nodes,OU=LabStuff,OU=Servers,DC=ad,DC=piccola,DC=us",
  "whenChanged" : "10/22/2018 5:28:37 AM",
  "whenCreated" : "8/30/2018 5:17:09 PM"
}

The fact code.

# get the domain role of the machine
$DomainRole = (Get-WmiObject -Class Win32_ComputerSystem -Property DomainRole).DomainRole
# if the machine is not a Standalone Workstation or a Standalone Server then attempt to query ad
if ($DomainRole -notmatch '^(0|2)') {
    # query ad
    $directorySearcher = New-Object System.DirectoryServices.DirectorySearcher
    $directorySearcher.Filter = "(&(objectCategory=Computer)(Name=$env:ComputerName))"
    $searcherPath = $directorySearcher.FindOne()
    $getDirectoryEntry = $searcherPath.GetDirectoryEntry()

    # make the results pretty
    $dn = $getDirectoryEntry.distinguishedName
    $compobj = [PSCustomObject]@{
        dn          = $getDirectoryEntry.distinguishedName.ToString()
        ou          = $dn.substring(($dn.split(',')[0].length + 1), ($dn.Length - ($dn.split(',')[0].length + 1)))
        whenCreated = $getDirectoryEntry.whenCreated.ToString()
        whenChanged = $getDirectoryEntry.whenChanged.ToString()
    }
    $adobj = [PSCustomObject]@{
        activedirectory_meta = $compobj
    }
    # write it out
    Write-Output ($adobj | ConvertTo-Json)
}

Executing Puppet Tasks with PowerShell via the Puppet Orchestrator API

2018-09-30T00:00:00+00:00

The Hard Way
The Easy Way
The Functions

The Hard Way

Lets begin by writing the code out manually so we understand what’s going on with the URI’s and Invoke-WebRequest. In this example we’ll use the Puppet task powershell_tasks::disablesmbv1. If we look at the task’s metadata file we see what it does via the description and what parameters it allows. To execute this task we’ll make a call to the Puppet Orchestrator’s commands endpoint.

{
    "puppet_task_version": 1,
    "description": "A task to test if SMBv1 is enabled and optionally disable it.",
    "input_method": "powershell",
    "parameters": {
        "action": {
            "description": "Valid actions are get and set.",
            "type": "Enum[get, set]"
        },
        "reboot": {
            "description": "Do we want to reboot the system if changes were made?",
            "type": "Optional[Boolean]"
        },
        "forcereboot": {
            "description": "Do we want to reboot the system regardless if changes were made?",
            "type": "Optional[Boolean]"
        }
    }
}

Lets begin by calling this task with its action parameter and the value of get.

$master = 'puppet.piccola.us'
$token = '***'

$targetNodes = @('den3-node-1.ad.piccola.us','den3-node-3.ad.piccola.us')

$req = [PSCustomObject]@{
    environment = 'production'
    task        = 'powershell_tasks::disablesmbv1'
    params      = [PSCustomOBject]@{
        action = 'get'
    }
    description = 'get smbv1 status'
    scope       = [PSCustomObject]@{
        nodes = $targetNodes
    }
} | ConvertTo-Json

$hoststr = "https://$master`:8143/orchestrator/v1/command/task"
$headers = @{'X-Authentication' = $token}

Invoke-WebRequest -Uri $hoststr -Method Post -Headers $headers -Body $req

The output. From here we can see we successfully executed the task and produced the job ID of 494.

StatusCode        : 202
StatusDescription : Accepted
Content           : {
                      "job" : {
                        "id" : "https://puppet.piccola.us:8143/orchestrator/v1/jobs/494",
                        "name" : "494"
                      }
                    }
RawContent        : HTTP/1.1 202 Accepted
                    Vary: Accept-Encoding, User-Agent
                    Content-Length: 108
                    Content-Type: application/json;charset=utf-8
                    Date: Sun, 30 Sep 2018 17:16:11 GMT
                    Server: Jetty(9.4.z-SNAPSHOT)

                    {
                      "...
Forms             : {}
Headers           : {[Vary, Accept-Encoding, User-Agent], [Content-Length, 108], [Content-Type, application/json;charset=utf-8], [Date, Sun, 30 Sep 2018 17:16:11 GMT]...}
Images            : {}
InputFields       : {}
Links             : {}
ParsedHtml        : mshtml.HTMLDocumentClass
RawContentLength  : 108

That’s great, but lets get the output results from each of the nodes we just ran the task on. To do this we’ll make a call to the Puppet Orchestrator’s jobs endpoint. Lets use the 494 job ID from before.

$master = 'puppet.piccola.us'
$token = '***'

$hoststr = "https://$master`:8143/orchestrator/v1/jobs/494/nodes"
$headers = @{'X-Authentication' = $Token}

$result  = Invoke-WebRequest -Uri $hoststr -Method Get -Headers $headers
$content = $result.content | ConvertFrom-Json

foreach ($item in $content.items) {
    $item | Select-Object name, result
}

The output. Nice, we can see that on our systems we not only have SMBv1 as an enabled protocol but the feature itself is also installed. Lets disable it!

name                      result
----                      ------
den3-node-3.ad.piccola.us @{Enable_SMB1Protocol=True; Installed_SMB1Protocol=True}
den3-node-1.ad.piccola.us @{Enable_SMB1Protocol=True; Installed_SMB1Protocol=True}

From here, lets modify our task parameters to disable SMBv1. We’ve changed our action param to set and also provided the reboot parameter with a value of $true. We want our systems to reboot so they take the SMBv1 changes.

$master = 'puppet.piccola.us'
$token = '***'

$targetNodes = @('den3-node-1.ad.piccola.us','den3-node-3.ad.piccola.us')

$req = [PSCustomObject]@{
    environment = 'production'
    task        = 'powershell_tasks::disablesmbv1'
    params      = [PSCustomOBject]@{
        action = 'set'
        reboot = $true
    }
    description = 'set smbv1 status'
    scope       = [PSCustomObject]@{
        nodes = $targetNodes
    }
} | ConvertTo-Json

$hoststr = "https://$master`:8143/orchestrator/v1/command/task"
$headers = @{'X-Authentication' = $token}

Invoke-WebRequest -Uri $hoststr -Method Post -Headers $headers -Body $req

If we run our task again with get we can see that SMBv1 is disabled and uninstalled. Awesome.

name                      result
----                      ------
den3-node-3.ad.piccola.us @{Enable_SMB1Protocol=False; Installed_SMB1Protocol=False}
den3-node-1.ad.piccola.us @{Enable_SMB1Protocol=False; Installed_SMB1Protocol=False}

The Easy Way

While this has been fun, lets wrap all this PowerShell up into a few functions. Invoke-PuppetTask, Get-PuppetJobNodes, and Get-PuppetJob. Note we added Get-PuppetJob, this function is going to simply get job details from a supplied Job ID. Invoke-PuppetTask will use this function internally to monitor our job’s state. You’ll see this below with Invoke-PuppetTask’s -Wait and -Timeout parameters.

First, lets get the current SMBv1 configurations.

$master = 'puppet.piccola.us'
$token = '***'

$scope = @('den3-node-1.ad.piccola.us','den3-node-5.ad.piccola.us')
$splat = @{
    Token = $Token
    Master = $Master
    Task = 'powershell_tasks::disablesmbv1'
    Environment = 'production'
    Parameters = [PSCustomObject]@{
        action = 'get'
    }
    Description = 'Get SMBv1'
    Scope = $scope
    ScopeType = 'nodes'
}
$taskRunGet = Invoke-PuppetTask @splat -Wait -Timeout 120
Get-PuppetJobNodes -Token $Token -Master $Master -ID $taskRunGet.job.name | select name, result

Output.

name                      result
----                      ------
den3-node-5.ad.piccola.us @{Enable_SMB1Protocol=True; Installed_SMB1Protocol=True}
den3-node-1.ad.piccola.us @{Enable_SMB1Protocol=True; Installed_SMB1Protocol=True}

Second, lets set the SMBv1 configurations.

$master = 'puppet.piccola.us'
$token = '***'

$scope = @('den3-node-1.ad.piccola.us','den3-node-5.ad.piccola.us')
$splat = @{
    Token = $Token
    Master = $Master
    Task = 'powershell_tasks::disablesmbv1'
    Environment = 'production'
    Parameters = [PSCustomObject]@{
        action = 'set'
        reboot = $true
    }
    Description = 'Set SMBv1'
    Scope = $scope
    ScopeType = 'nodes'
}
Invoke-PuppetTask @splat -Wait -Timeout 120

Third, once the systems come back up from rebooting lets get the SMBv1 configurations again.

$master = 'puppet.piccola.us'
$token = '***'

$scope = @('den3-node-1.ad.piccola.us','den3-node-5.ad.piccola.us')
$splat = @{
    Token = $Token
    Master = $Master
    Task = 'powershell_tasks::disablesmbv1'
    Environment = 'production'
    Parameters = [PSCustomObject]@{
        action = 'get'
    }
    Description = 'Get SMBv1'
    Scope = $scope
    ScopeType = 'nodes'
}
$taskRunGet = Invoke-PuppetTask @splat -Wait -Timeout 120
Get-PuppetJobNodes -Token $Token -Master $Master -ID $taskRunGet.job.name | select name, result

Output.

name                      result
----                      ------
den3-node-5.ad.piccola.us @{Enable_SMB1Protocol=False; Installed_SMB1Protocol=False}
den3-node-1.ad.piccola.us @{Enable_SMB1Protocol=False; Installed_SMB1Protocol=False}

Sweet, we’ve successfully executed PowerShell on remote systems via a Puppet Task triggered via the Puppet API.

The Functions

Get-PuppetJobNodes

Function Get-PuppetJobNodes {
    Param(
        [Parameter(Mandatory)]
        [int]$ID,
        [Parameter(Mandatory)]
        [string]$Token,
        [Parameter(Mandatory)]
        [string]$Master
    )

    $hoststr = "https://$master`:8143/orchestrator/v1/jobs/$id/nodes"
    $headers = @{'X-Authentication' = $Token}

    $result  = Invoke-WebRequest -Uri $hoststr -Method Get -Headers $headers
    $content = $result.content | ConvertFrom-Json

    Write-Output $content.items
}

Invoke-PuppetTask

Function Invoke-PuppetTask {
    Param(
        [Parameter(Mandatory)]
        [string]$Token,
        [Parameter(Mandatory)]
        [string]$Master,
        [Parameter(Mandatory)]
        [string]$Task,
        [Parameter()]
        [string]$Environment = 'production',
        [Parameter()]
        [PSCustomObject]$Parameters = @{},
        [Parameter()]
        [string]$Description = '',
        [Parameter(Mandatory)]
        [PSCustomObject[]]$Scope,
        [Parameter(Mandatory)]
        [ValidateSet('nodes')]
        [string]$ScopeType,
        [Parameter()]
        [switch]$Wait,
        [Parameter()]
        [int]$Timeout = 300
    )

    $req = [PSCustomObject]@{
        environment = $Environment
        task        = $Task
        params      = $Parameters
        description = $Description
        scope       = [PSCustomObject]@{
        $ScopeType = $Scope
        }
    } | ConvertTo-Json

    $hoststr = "https://$master`:8143/orchestrator/v1/command/task"
    $headers = @{'X-Authentication' = $Token}

    $result  = Invoke-WebRequest -Uri $hoststr -Method Post -Headers $headers -Body $req
    $content = $result.content | ConvertFrom-Json

    if ($wait) {
        # sleep 5s for the job to register
        Start-Sleep -Seconds 5

        $jobSplat = @{
            token = $Token
            master = $master
            id = $content.job.name
        }

        # create a timespan
        $timespan = New-TimeSpan -Seconds $timeout
        # start a timer
        $stopwatch = [diagnostics.stopwatch]::StartNew()

        # get the job state every 5 seconds until our timeout is met
        while ($stopwatch.elapsed -lt $timespan) {
            # optoins are new, ready, running, stopping, stopped, finished, or failed
            $job = Get-PuppetJob @jobSplat
            if (($job.State -eq 'stopped') -or ($job.State -eq 'finished') -or ($job.State -eq 'failed')) {
                $taskJobContent = [PSCustomObject]@{
                    task = $content
                    job = $job
                }
                Write-Output $taskJobContent
                break
            }
            Start-Sleep -Seconds 5
        }
        if ($stopwatch.elapsed -ge $timespan) {
            Write-Error "Timeout of $Timeout`s has exceeded."
            break
        }
    } else {
        Write-Output $content
    }
}

Get-PuppetJob

Function Get-PuppetJob {
    Param(
        [Parameter(Mandatory)]
        [int]$ID,
        [Parameter(Mandatory)]
        [string]$Token,
        [Parameter(Mandatory)]
        [string]$Master
    )

    $hoststr = "https://$master`:8143/orchestrator/v1/jobs/$id"
    $headers = @{'X-Authentication' = $Token}

    $result  = Invoke-WebRequest -Uri $hoststr -Method Get -Headers $headers
    $content = $result.content | ConvertFrom-Json

    Write-Output $content
}

Adding a certificate to Jenkins on Windows.

2018-09-29T00:00:00+00:00

The following assumes you requested a certificate from a Microsoft CA. The requested certificate was downloaded as base 64 and saved to D:\install_files\cert\jenkins.ad.piccola.us. This certificate was imported into jenkins.ad.piccola.us’s personal cert store and then exported with 1) the private key 2) extended properties, and 3) all certificates in the certification path.

Generate a JKS keystore from the previously exported D:\install_files\cert\jenkins.ad.piccola.us.pfx.

D:\Program Files (x86)\Jenkins\jre\bin>keytool.exe -importkeystore -srckeystore D:\install_files\cert\jenkins.ad.piccola.us.pfx -srcstoretype pkcs12 -destkeystore jenkins.ad.piccola.us.jks -deststoretype JKS
Enter destination keystore password:
Re-enter new password:
Enter source keystore password:
Entry for alias certreq-6008260b-a0d5-4948-b329-9200fad7f20a successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Move the generated JKS file from D:\Program Files (x86)\Jenkins\jre\bin to D:\install_files\cert\jenkins.ad.piccola.us.jks. We do this just to keep track of it.
```
D:\Program Files (x86)\Jenkins\jre\bin>move jenkins.ad.piccola.us.jks d:\install_files\cert
     1 file(s) moved.
```
Copy the genereated JKS file from D:\install_files\cert\jenkins.ad.piccola.us.jks to D:\Program Files (x86)\Jenkins\jenkins.ad.piccola.us.jks (aka JENKINS_HOME).
```
d:\install_files\cert>copy jenkins.ad.piccola.us.jks "d:\Program Files (x86)\Jenkins"
     1 file(s) copied.
```

Update D:\Program Files (x86)\Jenkins\jenkins.xml.

41 | <arguments>-Xrs -Xmx256m -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -jar "%BASE%\jenkins.war" --httpPort=-1 --httpsPort=443 --httpsKeyStore="%JENKINS_HOME%\jenkins.ad.piccola.us.jks" --httpsKeyStorePassword="--REMOVED--" --webroot="%BASE%\war"</arguments>

Files used in this process.

d:\install_files\cert>tree /F
Folder PATH listing for volume Data
Volume serial number is 0C30-53CA
D:.
 jenkins.ad.piccola.us.cer   <-- downloaded cert from web enrollment
 jenkins.ad.piccola.us.csr   <-- certificate signing request (not discussed in this post)
 jenkins.ad.piccola.us.inf   <-- inf file used for certificate signing request (not discussed in this post)
 jenkins.ad.piccola.us.jks   <-- password protected java key store
 jenkins.ad.piccola.us.pfx   <-- password protected exported cert
No subfolders exist

Generating a certificate request with SAN via PowerShell

2018-09-29T00:00:00+00:00

Not the greatest script, but it gets the job done when you need to make a certificate request with SANs.

$name = "ws01.ad.piccola.us"
$san  = "mysite.piccola.us"
$csrPath = Join-Path -Path 'c:\windows\temp' -ChildPath "$name.csr"
$infPath = Join-Path -Path 'c:\windows\temp' -ChildPath "$name.inf"

$infContents =
@"
[Version]
Signature = '$Windows NT$'

[NewRequest]
Subject = "CN=$name"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
HashAlgorithm = SHA256
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=$name&"
_continue_ = "dns=$san&"
"@

$infContents | Out-File -filepath $infPath -force
certreq -new $infPath $csrPath

Adding a certificate to the Puppet Enterprise console.

2018-07-17T00:00:00+00:00

The following discusses how to add a certificate to the Puppet Enterprise Console.

generate a csr puppet.piccola.us.csr and submit it to a CA. in this example a cert request was generated with PowerShell and submitted to a Microsoft CA.
download it puppet.piccola.us.cer in .der format. once downloaded add it to the personal store of a windows machine then export it with keys and extensions as a .pfx (e.g. puppet.piccola.us.pfx).

at this point you should have the following three files.

C:\scripts\puppet_ec_cert\pec> l
 Directory: C:\scripts\puppet_ec_cert\pec
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        6/12/2018   8:17 PM           1224 puppet.piccola.us.cer
-a----        6/12/2018   8:16 PM           1384 puppet.piccola.us.csr
-a----        6/12/2018   8:20 PM           6049 puppet.piccola.us.pfx

install and use openssl to convert pfx to pem.

choco install openssl.light
openssl pkcs12 -in puppet.piccola.us.pfx -clcerts -nokeys -out public-console.cert.pem
Enter Import Password: *****

use openssl to create passphrased private key.

openssl pkcs12 -in puppet.piccola.us.pfx -nocerts -out public-console.private_key_PASSPHRASED_.pem
Enter Import Password: *****
Enter PEM pass phrase: *****

use openssl to remove passphrase from private key.

openssl rsa -in public-console.private_key_PASSPHRASED_.pem -out public-console.private_key.pem
Enter pass phrase for public-console.private_key_PASSPHRASED_.pem: *****
writing RSA key

at this point you should have the following six files.

 C:\scripts\puppet_ec_cert\pec> l
 Directory: C:\scripts\puppet_ec_cert\pec
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        6/12/2018   9:30 PM           2034 public-console.cert.pem
-a----        6/12/2018   9:34 PM           1706 public-console.private_key.pem
-a----        6/12/2018   9:33 PM           2145 public-console.private_key_PASSPHRASED_.pem
-a----        6/12/2018   8:17 PM           1224 puppet.piccola.us.cer
-a----        6/12/2018   8:16 PM           1384 puppet.piccola.us.csr
-a----        6/12/2018   8:20 PM           6049 puppet.piccola.us.pfx

copy public-console.cert.pem and public-console.private_key.pem to /opt/puppetlabs/server/data/console-services/certs on the Puppet server.

root@puppet:/opt/puppetlabs/server/data/console-services/certs# ls -la
total 36
drwx------ 3 pe-console-services pe-console-services 4096 Jun 12 21:40 .
drwxrwx--- 3 pe-console-services pe-console-services 4096 Sep  8  2017 ..
drwxr-xr-x 2 root                root                4096 Jun 12 21:40 old
-rw-r--r-- 1 root                root                2034 Jun 12 20:33 public-console.cert.pem
-rw-r--r-- 1 root                root                1706 Jun 12 20:51 public-console.private_key.pem
-r-------- 1 pe-console-services pe-console-services 2086 Jun 12 21:40 puppet.piccola.us.cert.pem
-r-------- 1 pe-console-services pe-console-services 3243 Jun 12 21:40 puppet.piccola.us.private_key.pem
-r-------- 1 pe-console-services pe-console-services 2374 Jun 12 21:40 puppet.piccola.us.private_key.pk8
-r-------- 1 pe-console-services pe-console-services  800 Jun 12 21:40 puppet.piccola.us.public_key.pem

Use the console to edit the parameters of the puppet_enterprise::profile::console class.
1. Click Classification, and in the PE Infrastructure group, select the PE Console group.
2. On the Configuration tab, in the puppet_enterprise::profile::console class, add the following parameters:

Parameter	Value
`browser_ssl_cert`	`/opt/puppetlabs/server/data/console-services/certs/public-console.cert.pem`
`browser_ssl_private_key`	`/opt/puppetlabs/server/data/console-services/certs/public-console.private_key.pem`

run puppet agent -t on the master.
```
root@puppet:~# puppet agent -t
```

use nmap’s “ssl-cert.nse” script to verify.

c:\> nmap --script=ssl-cert.nse -p 443 puppet.piccola.us
PORT    STATE SERVICE
443/tcp open  https
| ssl-cert: Subject: commonName=puppet.piccola.us
| Subject Alternative Name: DNS:puppet.piccola.us
| Issuer: commonName=Piccola Subordinate CA I
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2018-06-13T02:09:48
| Not valid after:  2020-06-12T02:09:48
| MD5:   e5a6 bb29 8870 b967 49d2 ecf1 0514 c2a2
|_SHA-1: eaf5 df14 db39 d2dc e502 3276 862b 0532 1ce1 557e
MAC Address: 00:50:56:89:9F:17 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 1.45 seconds

A Puppet fact for the Windows Domain Role

2017-07-21T00:00:00+00:00

This is pretty simple. Drop this domainrole.ps1 wherever you place your facts.

switch ((Get-WmiObject -Class Win32_ComputerSystem -Property DomainRole).DomainRole) {
    '0' {
        Write-Output 'domainrole=Standalone Workstation'
    }
    '1' {
        Write-Output 'domainrole=Member Workstation'
    }
    '2' {
        Write-Output 'domainrole=Standalone Server'
    }
    '3' {
        Write-Output 'domainrole=Member Server'
    }
    '4' {
        Write-Output 'domainrole=Backup Domain Controller'
    }
    '5' {
        Write-Output 'domainrole=Primary Domain Controller'
    }
}

Firewalls, AD, & RFC6343 Advisory Guidelines for 6to4 Deployment

2016-04-12T00:00:00+00:00

A few years ago I was pulled into an issue because “AD was slow”. The environment that was having issues was behind a firewall, separated from the AD environment. The firewall was configured to NAT all internal public address to a single public address. Although all necessary pokes were in place to allow communication from inside the firewall to the AD environment outside the firewall, clients still experienced 1-3 minute delays when interacting with AD related services. I’m considering AD related services anything requiring AD to function, from DC locator to Kerberos for authentication (e.g. file share access, print server access, Exchange\Outlook). In the end I found that clients were attempting their initial communication with DCs by tunneling IPv6 traffic within IPv4 (i.e. 6to4). This communication was dropped by the firewall. Once failing back to IPv4 and after the accumulated SYN timer retries (21+ seconds) the clients were able to communicate. Disabling 6to4 on the clients via GPO resolved the issue.

The following details my findings and analysis through a packet capture. I was able to drop a client in the network behind the firewall which allowed me to capture traffic during delays. Delays were viewed during logon, the mapping of drives, and when adding AD users to client local groups. Other symptoms included credential pop-ups in Outlook\Exchange that would not accept credentials and slowness with RSAT (dsa, dssite, gpmc etc).

The screen capture above shows the capture viewed in NetMon. The frames selected in orange show my clients initial attempt to communicate with the domain controller via 6to4 (indicated by the dual protocols pointed out in purple). The frames selected in orange show the expected SYN retry time intervals of 3 6 and 12 seconds. Once 21 seconds (3 attempts) had elapsed the client then attempted without 6to4. This communication is selected in green and shows your typical successful TCP 3-way handshake SYN, ACK-SYN, ACK. Depending on what the client was doing with AD this process (at least in my findings) repeated itself, sometimes causing delays up 3 minutes. This kinda makes sense when you start to think about sessions and each process working it’s way up the stack, unaware of what another session attempted and failed.

So, why does this happen when traversing a firewall? RFC6343 “Advisory Guidelines for 6to4 Deployment” states two possible reasons for this. The first being the use of private IP addresses behind the firewall. This matters because of how the 6to4 IPv6 address that is tunneled/encapsulated in IPv4 is generated. The client IPv6 addressed used by 6to4 is generated from the clients IPv4 address. That said, if that address is private then it’s not necessarily unique. Destination clients receiving the 6to4 communication, once worked up the stack, would be unable to differentiate between one IPv6 session and another. The second possible reason are firewalls blocking protocol 41 either outbound on inbound (destination reply).

In my case they were not using private IP addresses on the inside of the firewall. I’m going with the blocking of protocol 41 as the issue. Protocol 41 is indicated in red via the screen capture above. In a frame not leveraging 6to4 this protocol would be 6 ‘TCP’. To fix this issue I disabled 6to4 via GPO.