Windows on Ricky

Windows SSH Setup

Tue, 03 Jan 2023 12:36:00 +0800

The default shell is cmd. The docs say to change the ansible_shell_type variable if needed. This should be set as a host variable in inventory: ansible_shell_type, with value cmd or powershell.
Add the ansible_connection host variable in inventory to indicate SSH connections. (192.168.192.11 ansible_user=Administrator ansible_connection=ssh ansible_shell_type=cmd )
You may need to add remote_tmp in ansible.cfg and set it to C:\TEMP.
In playbooks, use modules prefixed with win_, or use the raw module.

WSL 2 .wslconfig configuration explained

Wed, 30 Dec 2020 21:24:12 +0800

Steps to install WSL 2:

Join the Windows Insider Program (required)
Enable required WSL components
Install a Linux distribution
Set the Linux distribution to use WSL 2
WSL 2 troubleshooting: compressed virtual disk files cannot be converted to the WSL 2 architecture
Install and start Docker
Install Docker Desktop v2.2.1.0

# Enable required WSL components
dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

# Set the Linux distribution to WSL 2
wsl --set-version ubuntu 2
wsl --set-default-version 2

Edit %UserProfile%\.wslconfig

Style PowerShell with oh-my-posh

Thu, 10 Dec 2020 13:15:59 +0800

Style PowerShell with oh-my-posh

# This downloads and installs the posh-git and oh-my-posh modules from PowerShell Gallery.
# The former shows Git info in the prompt, and the latter provides the themes.
Install-Module posh-git -Scope CurrentUser
Install-Module oh-my-posh -Scope CurrentUser


# Next, edit the PowerShell profile loaded at startup. In PowerShell, $PROFILE shows the current
# user's profile path. The file may not exist; run the commands below to create it and open it.
if (!(Test-Path -Path $PROFILE )) { New-Item -Type File -Path $PROFILE -Force }
notepad $PROFILE

Add the following commands to the profile file:

Provisioning a Windows Server Vagrant box with IIS, .NET 4.5 and Octopus Deploy

Thu, 03 Dec 2020 12:39:01 +0800

Deploying OpenVPN with AD domain authentication

Thu, 17 Sep 2020 13:15:33 +0800

# Install OpenVPN
yum install openvpn -y
yum -y install openssl openssl-devel -y
yum -y install lzo lzo-devel -y
yum install -y libgcrypt libgpg-error libgcrypt-devel

# Install OpenVPN auth plugin
yum install openvpn-auth-ldap -y

# Install easy-rsa
# Since openvpn 2.3 removed easy-rsa from the package, install it separately.
yum install easy-rsa
cp -rf /usr/share/easy-rsa/2.0 /etc/opevpn/

# Generate OpenVPN keys and certificates
# Edit `/opt/openvpn/etc/easy-rsa/2.0/vars` parameters
export KEY_COUNTRY="CN" # Country
export KEY_PROVINCE="ZJ" # Province
export KEY_CITY="NingBo" # City
export KEY_ORG="TEST-VPN" # Organization
exportKEY_EMAIL="81367070@qq.com" # Email
export KEY_OU="baidu" # Unit

source vars
./clean-all
./build-ca
./build-dh
./build-key-server server
./build-key client1


# Edit the OpenVPN server config: `/etc/openvpn/server.conf`
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh2048.pem
server 10.8.0.0 255.255.255.0 // client IP pool
push "route 192.168.1.0 255.255.255.0" // push route to clients
push "redirect-gateway" // change client gateway to route VPN traffic
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf"
client-cert-not-required
username-as-common-name
log /var/log/openvpn.log


# Edit openvpn-ldap-auth config: `/etc/openvpn/auth/ldap.conf`
# /etc/openvpn/auth/ldap.conf

<LDAP>
 # LDAP server URL
 # Change to the AD server IP
 URL ldap://172.16.76.238:389

 # Bind DN (If your LDAP server doesn't support anonymous binds)
 # BindDN uid=Manager,ou=People,dc=example,dc=com
 # Change to the domain admin DN; you can query it with ldapsearch
 # Replace the IP in -h with the server IP, -D with the admin DN, -b with the base DN, and * for all
 # ldapsearch -LLL -x -h 172.16.76.238 -D "administrator@xx.com" -W -b "dc=xx,dc=com" "*"
 BindDN "cn=administrator,cn=Users,dc=xx,dc=com"

 # Bind Password
 # Password SecretPassword
 # Domain admin password
 Password passwd

 # Network timeout (in seconds)
 Timeout 15

 # Enable Start TLS
 TLSEnable no

 # Follow LDAP Referrals (anonymously)
 FollowReferrals no

 # TLS CA Certificate File
 # TLSCACertFile /usr/local/etc/ssl/ca.pem

 # TLS CA Certificate Directory
 # TLSCACertDir /etc/ssl/certs

 # Client Certificate and key
 # If TLS client authentication is required
 # TLSCertFile /usr/local/etc/ssl/client-cert.pem
 # TLSKeyFile /usr/local/etc/ssl/client-key.pem

 # Cipher Suite
 # The defaults are usually fine here
 # TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
 # Base DN
 # Base DN for auth search
 BaseDN "dc=boqii-inc,dc=com"

 # User Search Filter
 # SearchFilter "(&(uid=%u)(accountStatus=active))"
 # sAMAccountName=%u uses the sAMAccountName value as the username,
 # and "memberof=CN=myvpn,DC=xx,DC=com" points to the VPN user group to authenticate,
 # so any user can use VPN once they are in this group.
 SearchFilter "(&(sAMAccountName=%u)(memberof=CN=myvpn,DC=boqii-inc,DC=com))"

 # Require Group Membership
 RequireGroup false

 # Add non-group members to a PF table (disabled)
 # PFTable ips_vpn_users

 <Group>
 # BaseDN "ou=Groups,dc=example,dc=com"
 # SearchFilter "(|(cn=developers)(cn=artists))"
 # MemberAttribute uniqueMember
 # Add group members to a PF table (disabled)
 # PFTable ips_vpn_eng

 BaseDN "ou=vpn,dc=boqii-inc,dc=com"
 SearchFilter "(cn=openvpn)"
 MemberAttribute "member"
 </Group>
</Authorization>

Copy the ca.crt certificate under /etc/openvpn/key for client use.