Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Archives for September 2019

Step-by-Step Guide to Encrypt Azure Linux VM (PowerShell Guide)

Last Updated on September 29, 2019 by Dishan M. Francis

Disk encryption is a basic data protection method for physical & virtual hard disks. In one of my previous posts, I explained how we can encrypt Azure Windows VM using Azure Key Vault & BitLocker. This post can access via https://www.rebeladmin.com/2019/09/step-step-guide-encrypt-azure-windows-vm-using-bitlocker-powershell-guide/ . Similarly, we also can encrypt Azure Linux VM by using Azure Key Vault & dm-crypt. In this post, I am going to demonstrate how we can encrypt Azure Linux VM. 

Things to Consider

Before we move forward, make sure your Azure VM configurations comply with following, 

• Azure disk encryption for Linux VM is only going to work if you are running Azure-endorsed Linux distribution such as,

Ubuntu 14.04.5, 16.04, 18.04

RHEL 6.7, 6.8, 7.2, 7.3, 7.4, 7.5, 7.6

CentOS 6.8, 7.2n, 7.3, 7.4, 7.5, 7.6

openSUSE 42.3

SLES 12-SP3, 12-SP4

• If you encrypting OS & Data volume in Linux VM and its root (/) file system usage is 4GB or less you need a minimum of 8GB Ram. Also, if root (/) file system usage is more than 4GB, it needs 2 * (/root file system usage). This is only required during the initial encryption process. 

• Azure Linux VM must have dm-crypt & vfat modules running. 

• Data disks of Linux VM (which required encryption) must be listed under /etc/fstab correctly. 

In this demo, I will be using PowerShell. Therefore, please make sure you have Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

Setup Resource Group

The first step of the configuration is to create a new resource group. 

To do that, 

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create a new resource group using, 

New-AzResourceGroup -Name REBELRG1 -Location "East US"

In the above, REBELRG1 is the resource group name and East US is the resource group location.

[Read more…] about Step-by-Step Guide to Encrypt Azure Linux VM (PowerShell Guide)

Step-by-Step Guide to enable BitLocker for cloud-managed Windows 10 Devices (Using Microsoft Intune)

Last Updated on September 22, 2019 by Dishan M. Francis

Data encryption is one of the basic requirements when it comes to data protection. Using Windows BitLocker, we can easily encrypt virtual and physical disks. We normally use group policies and system center configuration manager (SCCM) to centrally manage/configure BitLocker. 

We also can use Microsoft Intune to manage BitLocker on Azure AD joined Windows 10 devices. This is done by using Microsoft Intune Device configuration Profiles. I previously wrote an article about configuration profiles and explained how we can use it to standardize device configurations on Azure AD join devices. I highly recommend you to go through it before we continue further with this blog post as it explains the basics about configuration profiles. This aforementioned blog post can access using https://www.rebeladmin.com/2019/09/step-step-guide-standardize-desktop-devices-using-microsoft-intune-device-configuration-profiles/

In this demo, I am going to demonstrate how to manage BitLocker using Microsoft Intune. Before we start, we need to have devices enrolled with Intune. You can find more info about device enrollment using my previous blog posts https://www.rebeladmin.com/2018/11/step-step-guide-enroll-windows-10-devices-microsoft-intune-using-autopilot/

In my demo environment, I have Azure AD joined & Intune enrolled windows 10 device called W2007.

Let's go ahead and setup the relevant device configuration profile. 

To do that, 

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator and go to All services | Intune or else log in to Intune device management portal directly via https://devicemanagement.microsoft.com  

2. Then click on Device configuration | Profiles

3. In the profiles page, click on + Create profile

[Read more…] about Step-by-Step Guide to enable BitLocker for cloud-managed Windows 10 Devices (Using Microsoft Intune)

Step-by-Step Guide to Encrypt Azure Windows VM using BitLocker (PowerShell Guide)

Last Updated on September 14, 2019 by Dishan M. Francis

Disk encryption is a basic data protection method for physical & virtual hard disks. It falls under physical data security and it prevents data breaches from stolen hard disks (physical & virtual). If it is a Windows machine, we can simply use BitLocker for disk encryption. Also, there are other third-party vendors such as Thales e-Security which provides disk encryption solutions for organizations. 

Similar to on-premises Windows servers and computers, we can use BitLocker to encrypt Windows VM running on Azure. For Linux VMs, we can use DM-Crypt to encrypt virtual disks. More details about BitLocker is available on https://docs.microsoft.com/en-gb/windows/security/information-protection/bitlocker/bitlocker-overview. Azure VM encryption uses the Azure Key Vault to store encryption keys and secrets. 

In this demo, I am going to demonstrate how to encrypt Azure VM using BitLocker. For the configuration process, I will be using PowerShell. Therefore, please make sure you have Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0 

Setup Resource Group

The first step of the configuration is to create a new resource group. 

To do that, 

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create a new resource group using, 

New-AzResourceGroup -Name REBELRG1 -Location "East US"

 In the above, REBELRG1 is the resource group name and East US is the resource group location. 

Configure Azure Key Vault

Next, we need to create a new key vault and encryption key. 

1. As the first step, let's go ahead and enable Azure Key Vault provider within the subscription by using, 

Register-AzResourceProvider -ProviderNamespace "Microsoft.KeyVault"

2. Then, we go ahead with Azure Vault setup,

New-AzKeyVault -Location "East US" -ResourceGroupName REBELRG1 -VaultName REBELVMKV1 -EnabledForDiskEncryption

In the above, REBELVMKV1 is the key vault name and it is created under REBELRG1 resource group which we created in the previous step. -EnabledForDiskEncryption is used to prepare the key vault to use with disk encryption. 

[Read more…] about Step-by-Step Guide to Encrypt Azure Windows VM using BitLocker (PowerShell Guide)

Step-by-Step Guide to setup Azure VNet-to-VNet VPN Gateway Connection (PowerShell Guide)

Last Updated on September 8, 2019 by Dishan M. Francis

If we need to set up a connection between two independent networks (not between VLANs), we have to use a virtual private network (VPN) connections. In Azure, we use VNets to create private networks. If we need to communicate between two VNets, we have to use one of the following methods,

• VNet-to-VNet Connection – The communication happens between two VPN gateways. This is easy to set up, compare to the site-to-site VPN method.

• Site-to-Site VPN – This is similar to creating VPN connection to the on-premises network. It also uses VPN gateway, but it gives more control over the local network gateway. 

• VNet Peering – This method doesn't use VPN gateways and it routes the traffic via Microsoft backend infrastructure. More information about VNet peering is available on https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

In this demo, I am going to demonstrate how to create a VNet-to-VNet connection. These types of connections can establish between,

• Virtual Networks in the same region

• Virtual Networks in different regions

• Virtual Networks in different subscriptions

In this demo, I am going to create a VNet-to-VNet VPN connection between two virtual networks in two different regions. 

According to the above diagram, EUSVnet1 virtual network will be running on East US Azure region and UKSVnet1 virtual network will be running on UK South Azure region. Let's see how we can establish a VPN gateway connection between these two networks. Before start, please make sure you have the following in place. 

• Valid Azure Subscription – You can also use free azure subscription for testing purpose. https://azure.microsoft.com/en-gb/free/ 

• Azure PowerShell Module – In this demo I am going to use PowerShell. Please make sure you have Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

Create Resource Groups

The first step of the configuration is to create new resource groups in different regions. 

To do that, 

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create EUSRG1 under East US Azure region by using,

New-AzResourceGroup -Name EUSRG1 -Location "East US" 

In the above command, -Name parameter specifies the resource group name and -Location parameter specify the Azure region. 

3. Next step is to create UKSRG1 resource group in UK South Azure region by using,

New-AzResourceGroup -Name UKSRG1 -Location "UK South"

[Read more…] about Step-by-Step Guide to setup Azure VNet-to-VNet VPN Gateway Connection (PowerShell Guide)

Step-by-Step Guide: How to standardize Desktop devices using Microsoft Intune Device configuration Profiles?

Last Updated on September 1, 2019 by Dishan M. Francis

In my previous blog post, I have explained how we can apply Microsoft security settings to corporate devices using Intune Security Baselines (https://www.rebeladmin.com/2019/08/step-step-guide-apply-security-baselines-windows-10-devices-using-microsoft-intune/). We can apply similar settings to on-premises devices via group policies. Apart from security settings, we use group policies to standardize device configurations in on-premises environments. As an example, we can block user access to control panel settings by using group policy.

Microsoft Intune Device configuration Profiles allow us to push similar desktop settings to cloud-managed (Azure AD + Intune) devices. This allows organizations to maintain granular control over device settings. In this demo, I am going to demonstrate how to set up and apply Microsoft Intune Device configuration Profile. 

• Device configuration Profiles can use to standardize Android, iOS, macOS, Windows Phone 8.1, Windows 8.1, Windows 10 devices. 

• You need to have your devices enrolled with Intune to use this feature. You can find more info about device enrollment using my previous blog posts https://www.rebeladmin.com/2018/11/step-step-guide-enroll-windows-10-devices-microsoft-intune-using-autopilot/ 

In my demo environment, I have Azure AD joined & Intune enrolled windows 10 device called W2003.

Using device configuration profiles, I am going to,

• Disable user access to Control Panel Settings

• Push corporate proxy server settings to IE (server IP 10.10.10.10 with port 8080)

To do that, 

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator and go to All services | Intune or else log in to Intune device management portal directly via https://devicemanagement.microsoft.com 

2. Then click on Device configuration | Profiles 

3. In the profiles page, click on + Create profile

[Read more…] about Step-by-Step Guide: How to standardize Desktop devices using Microsoft Intune Device configuration Profiles?