Apply IP restrictions to an Azure Storage Account

A Storage Account in Azure has two account keys which can be used to access the Storage Account. These keys give complete permission to the Storage Account so it is very important to keep these keys private.

Another way to assign permissions to a Storage Account is to use Shared Access Signatures (SAS). SAS is a powerful way to grant limited access to a storage account to other clients, without having to expose your account key.

It is also possible to configure specific options for a SAS to, for example:

• Expiry Time
• IP addresses
• Start Time
• Protocol (HttpsOnly or HttpsOrHttp)

To generate SAS keys, access to the Azure PowerShell modules (http://aka.ms/webpi-azps) is required. When ready, the following PowerShell command can be used to generate a SAS key. It uses the following options:

• The permission is rdwl (read, delete, write, list).
• Access is granted on Services, Containers and Objects.
• Only clients connecting from the IP addresses 154.132.123.212-154.132.123.218 can connect.
• The service is set to Blob (options are Blob, File, Queue, Table).
• The expiry time is long because by default it is a few hours before the key becomes invalid.

Get-AzureRmStorageAccount `
-StorageAccountName mystorageaccountname `
-ResourceGroupName myresourcegroup | `

New-AzureStorageAccountSASToken `
-Permission rwdl `
-ResourceType Service,Container,Object `
-Service blob `
-IPAddressOrRange 154.132.123.212-154.132.123.218 `
-ExpiryTime 1/1/2099

The output is a SAS key, like this:

?sv=2015-04-05&sig=9mS7XDJU%2Fajbq4D0gCDqb8NJsc7ztbu%2BubSuS
nnYqkQ%3D&spr=https%2Chttp&sip=154.132.123.212-154.132.123.2
18&se=2016-07-11T12%3A14%3A36Z&srt=sco&ss=b&sp=rwdl

This key can be given to a client to use it.

For example, to upload a file you can use this SAS key in combination with AzCopy (the tool from Microsoft to copy files to a Storage Account).

1. Download AzCopy from here.
2. Open a Command Prompt and run the command:

“C:\Program Files\Microsoft SDKs\Azure\AzCopy\AzCopy.exe” /source:C:\Fol\ /dest:https://<storageaccount&gt;.blob.core.windows.net/<container> /destsas:”?sv=2015-04-05&sig=9mS7XDJU%2Fajbq4D0gCDqb8NJsc7ztbu%2
BubSuSnnYqkQ%3D&spr=https%2Chttp&sip=154.132.12
3.212-154.132.123.218&se=2016-07-11T12%3A14%3A36Z&srt=sco&ss=b&sp=rwdl” /s

This Command Line will upload the files in the folder C:\Fol to an Azure Storage Account Container using the SAS key.

Manage network access to a HDInsight Cluster

Azure HDInsight is an Apache Hadoop distribution powered by the cloud. This means that it handles any amount of data, scaling from terabytes to petabytes on demand. Spin up any number of nodes at any time.

Since HDInsight is a PaaS offering, it is by default publicly accessable from any internet connection. The cluster contains often valuable data of customers. These customers also have requirements how to securely connect to this data, for example using IP restrictions so only their block of IP addresses can connect to the cluster.

In this article we are going to secure the HDInsight cluster so only IP adresses that we specify can connect to it.

1. Log in to Azure using http://portal.azure.com
2. You must have a Virtual Network (vNet) to continue, if you don’t have a vNet yet, create one.  This is mandatory.
3. Click on +New
   
4. Search for HDInsight
   
   
5. Select the HDInsight Cluster
   
   
6. Click on Create
   
   
7. Give the HDInsight Cluster a name
   
8. Select the correct Cluster Type and Version

   

9. Enter the correct credentials
   
10. Give the Storage Account and the Container a name
    
11. Select the correct sizing of your cluster.
    Be aware that there is a default quota of 60 cores for a Subscription. This can be increased by raising a Support Request.
    See https://azure.microsoft.com/en-us/blog/azure-limits-quotas-increase-requests/ for more information about quotas.
    
12. Click on Optional Configuration and select Virtual Network
13. Select the correct vNet:
    
14. Select the correct Subscription
15. Click on Create and wait 30 minutes:

    

16. Now that the HDInsight Cluster is created it is accessible from the public internet. This is something many customers want to prevent, so we need to secure it.
    Since HDInsight is connected to a Private Network, we can assign a Network Security Group (NSG) and then create Inbound Security Rules to allow (not deny) traffic.

    Microsoft requires access from some IP adresses for managebility.  They provide a PowerShell script to create the Network Security Group and give these addresses access to access the cluster. This script can be downloaded here.
    The adjusted script for the environment above, can be seen here.

17. It is necessary to modify the script and run it. It will create the Network Security Group and have the Microsoft address as inbound rules.
    Note: you cannot set Outbound Security Rules  on the Network Security Group.
    
18. Add your own public address, like your datacenter, home IP or office WiFi ip addresses as Inbound Security Rule
    

 

Now the HDInsight cluster is only available from the addresses and ports that you specified in the Inbound Security Rules.

TFS / NuGet error–Missing package

Error:

S:\Program Files\Microsoft Team Foundation Server 12.0\Tools\nuget.exe restore “S:\Build\8\<name>\<name>\src\<name>.sln” -NonInteractive

WARNING: Unable to connect to the remote server

WARNING: Unable to connect to the remote server

Unable to find version ‘1.2.2’ of package ‘elmah’.

Unable to find version ‘1.2.2’ of package ‘elmah.corelibrary’

 

Solution:

0. Connect to the internet

1. Open Visual Studio

2. Open the Project

3. Open Tools, NuGet Package Manager, Package Manager Console.

4. Enter: Get-Package -ListAvailable -Filter <name of package>
for example Get-Package -ListAvailable -Filter elmah

 

5. Enter Install-Package <name>
For example: Install-Package elmah

Repeat for each missing package.

6. In Source Control Explorer, right click on the Packages folder of the Project.

7. Click on Add Items to Folder, add the new folders in the local Packages folder.

8. In Source Control Explorer, right click on the Packages folder of the Project.

9. Click on Check in Pending Changes

 

Rebuild the solution.

Error presenting PowerPoint file in Skype for Business

“<filename>.pptx couldn’t be converted to presentation because Visual Basic for Application (VBA) is not installed on this computer. Please install VBA and try again”

1. Open Add or Remove Programs in Control Panel, select Microsoft Office (Professional Plus) 2013 client and click Change

2. Select Add or Remove Features and click on Continue

3. Expand Office Shared Features and check if Visual Basic for Application has been installed.

4. Click on Continue

5. Restart Skype for Business and re-try  to present the PowerPoint file.

SQL error “Property Owner is not available for Database

Run the following command to set a new owner, in this example DBO. The database name in this example is newtraders.

use NEWTRADERS go sp_changedbowner @loginame = ‘dbo’ go

SQL Server Scheduled Job fails to execute

SQL Server Scheduled Job ‘MessageBox_Message_ManageRefCountLog_BizTalkMsgBoxDb’ (0x9550CE8A82FC08489D1CCDE01A38C057) – Status: Failed – Invoked on: 2016-01-25 15:16:00 – Message: The job failed.  Unable to determine if the owner (DOMAIN\ACCOUNT) of job MessageBox_Message_ManageRefCountLog_BizTalkMsgBoxDb has server access (reason: Could not obtain information about Windows NT group/user DOMAIN\SAACCOUNT, error code 0x5. [SQLSTATE 42000] (Error 15404)).

This is due to the fact that the SQL Server Agent is running under a local account that cannot read the domain account permissions. Change the job to a local account or change the SQL Server Agent Service to a domain account.

Login failed for user

 

Login failed for user ‘NT AUTHORITY\SYSTEM’. Reason: Failed to open the explicitly specified database ‘model’. [CLIENT: X.X.X.X]

Give the user access to the database.