Dino9021

2022-09-26

用 DNS Record 驗證 Let's Encrypt 後打包丟給 Web Server 提供下載 Part-1

本系列共三篇:

用 DNS Record 驗證 Let's Encrypt 後打包丟給 Web Server 提供下載 Part-1
用 DNS Record 驗證 Let's Encrypt 後打包丟給 Web Server 提供下載 Part-2
用 DNS Record 驗證 Let's Encrypt 後打包丟給 Web Server 提供下載 Part-3

透過 Microsoft DNS Server 上用 DNS Record 來驗證 Let's Encrypt 的 PowerShell Script 之後
需要將取得的憑證丟給目標伺服器使用，但 DNS Server 本身就不太適合再擔任其他服務腳色，容易因為有漏洞而被攻擊，影響 DNS 服務，進而影響整個 Domain 運作。因此在取得更新的憑證後，先以 7-Zip 打包，再透過加密的方式傳輸到 Web Server 上提供給各伺服器負責人下載使用。

需要在 DNS Server 上執行 PackCert.ps1
Web Server 上的 API 接收後存起來 (API Path 建議做好 Source IP Filter)
使用者再從網頁手動下載或透過 GetCert.ps1 下載

相關動作我將拆成三篇來寫
本篇是 DNS Server 打包丟給 Web Server 儲存的階段

PackCert.ps1 on DNS Server

API Key 必須與 Web API 相同
CertPassword 看申請 Let's Encrypt 憑證的時候用什麼密碼就填什麼
#--------------------------------------------------------------------------------

閱讀全文 »

2022-09-22

GPO to Control Chrome Extensions

圖片來源: 土豪哥

閱讀全文 »

2022-08-15

Enable TLS 1.2 for Azure Virtual Desktop Client on Windows 7

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force

If (-Not (Test-Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319')) {
New-Item 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null;
};
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null;
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null;

If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319')) {
New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null;
};
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null;
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null;

閱讀全文 »

2022-07-15

在 PowerShell 與 PHP 之間交換加密訊息

Powershell:

#----------------

Function myEncrypt {

param (
[String]$Data,
[String]$EncryptKey
);

PROCESS {

$Encode = [System.Text.Encoding]::UTF8;
$DataBytes = $Encode.GetBytes($Data);

$AES = New-Object System.Security.Cryptography.AESManaged;
$AES.BlockSize = 128;
$AES.KeySize = 256;
$AES.Mode = [System.Security.Cryptography.CipherMode]::CBC;
$iv = RandomPassword(($AES.BlockSize / 8));
$AES.IV = $Encode.GetBytes($iv);
$AES.Key = $Encode.GetBytes($EncryptKey);

閱讀全文 »

2022-06-29

MailBox 從 Exchange Online 搬回 On Premise 時因為超過配額而失敗的解決

將 User Account Attribute 的 mDBUseDefaults 這個項目設為 False 就可以搬下來了
搬完記得改回 Not Set

Reference

2022-06-22

Block an Application from accessing Internet with Windows Firewall

$ProgramName = 'ProgramName';
$ProgramPaths = @();
$ProgramPaths += "$env:ProgramFiles\ProgramName";

$BlockIPs = @("1.0.0.0-9.255.255.255", "11.0.0.0-126.255.255.255", "128.0.0.0-172.15.255.255", "172.33.0.0-192.167.255.255", "192.169.0.0-255.255.255.255")

#----------------------------------------------------------

$Remove = New-NetFirewallRule -DisplayName "RemovePrepare" -Group ($ProgramName + 'Block') -Direction Outbound -Program "C:\windows\system32\calc.exe" -Action Block -RemoteAddress $BlockIPs;
Remove-NetFirewallRule -Group ($ProgramName + 'Block') -Confirm:$False;

$ProgramEXEFile = @();
foreach ($ProgramPath in $ProgramPaths) {
$ProgramEXEFile += Get-ChildItem $ProgramPath -Recurse | where {$_.extension -eq ".exe"};
};

閱讀全文 »

2022-06-14

用 GPO 允許 User 安裝印表機驅動程式的設定

GPO

Computer Configuration
- Policies
- Windows Settings
- Security Settings
- Local Policies
- User Rights Assignment
- Load and unload device drivers

Domain Users

Computer Configuration
- Policies
- Windows Settings
- Security Settings
- Local Policies
- Security Options
- Devices: Prevent users from installing printer drivers

Disable

Computer Configuration
- Policies
- Administrative Templates
- System/Device Installation/Device Installation Restrictions
- Allow installation of devices using drivers that match these device setup classes

Computer Configuration
- Policies
- Administrative Templates
- System/Driver Installation
- Allow non-administrators to install drivers for these device setup classes

上面這兩個設定中原本只有以下這兩個:
{4658ee7e-f050-11d1-b6bd-00c04fa372a7}
{4d36e979-e325-11ce-bfc1-08002be10318}

Windows 10 & Windows 11 會一直出現 Driver is unavailable
查到還要再加下面這個就正常了:

閱讀全文 »