In this post we’re going to talk about how to provision a NAT Instance from scratch, using AWS Linux 2 and CloudFormation. We’re going to provision an auto-healing NAT, meaning an instance launched by an auto-scaling group with a desired capacity of 1, so if our instance crashes the auto-scaling group with terminate it for us and spin up a new one. This is much like the auto-healing Bastion Host I provisioned in a previous post, Provision a Bastion Host to our VPC with CloudFormation. So the CloudFormation template for this NAT Instance is very similar to the Bastion Host template, and this post will focus only on the differences.
My Walk in the Clouds
Linux Hardening for your Bastion Host
This post is going to provide a brief description of basic Linux hardening for the Bastion Host I created using CloudFormation in my last post. Really it’s hardening 101 for any Linux host, but this kind of information is surprisingly hard to find on the Internet. For instance, I read a bunch of posts that say don’t run services you don’t need, but with no practical advice on how to implement that (like how to figure out what services are running on a typical Linux box, or which specific ones I might want to stop and why). The absolute best post I’ve seen on the subject is 40 Linux Server Hardening Security Tips [2019 edition]. I didn’t actually find this post until after I’d worked through the things I’m going to implement in this post, but it covered them all and a whole lot more, so you could just go there and skip this post, however, it’s pretty complex and hard to follow in some parts, and I’m going to provide a simple explanation for some simple hardening, so you might want to stick around.
Provision a Bastion Host to our VPC with CloudFormation
What is a bastion host? It’s sometimes called a jump box, or in days gone by a sacrificial lamb. Technically, it’s just a machine that is directly exposed to the Internet. In general, you don’t want all of your machines directly exposed to the Internet. So you take one box and expose it through SSH to the outside world (or RDP if it’s a Windows box). If you need to administer a more private instance, you SSH into the bastion and from there you can SSH into the private instance (which doesn’t accept SSH connections from outside of your network) to do your administration task. So you two-hop into your network (jump box) and you assume the direct exposure to the Internet means you may get compromised at some point (sacrificial lamb).
So in this post, we’re going to look at a CloudFormation template for adding a Bastion Host to a VPC. We’re going to deploy our bastion host to an auto-scaling group, not so much for the purpose of high availability but rather for some measure of auto-healing. If the box goes south and stops responding, the auto-scaling group will kill it and bring up a new fresh instance.
Continue reading “Provision a Bastion Host to our VPC with CloudFormation”
Provisioning a VPC with CloudFormation in AWS
This post is about a detailed examination of a CloudFormation template for provisioning a Virtual Private Cloud (VPC) in Amazon AWS. It is the first of what will be a series of posts that talk about Infrastructure as Code, revolving around trying to accomplish some particular thing. In particular, I’m moving my blog (this blog) to AWS from a shared hosting provider, and my experiences doing that is what this series will be about.
I have some specific goals in moving my blog, like my current service is a bit slower than I would like, and also less reliable (only 2 nines of availability), so I was looking to upgrade either way. Looking at the next step up in shared hosting, it would cost about twice as much as I’m currently spending (around $400/year), so I would ideally like to come up with something on AWS that isn’t much more than that, but with improved reliability and maybe speed. I have no idea starting out if I can actually meet any of these goals.
Continue reading “Provisioning a VPC with CloudFormation in AWS”
Getting All SharePoint Group Membership for a User Using JavaScript
As everyone knows by now, Microsoft is pushing all development out to the client-side. But most of the time, I find customers who desire customization want a user experience that is somewhat tailored to the current user. Like managers should see one thing when they log in, but regular users should see something else. That means that on the client-side, I need to be able to distinguish managers from other users. That’s normally done by assigning the users to groups. But in large organizations, that usually means Active Directory groups, which are then added to SharePoint groups. This leads to a problem, because from the client-side, there is no way to determine if the user has membership in a SharePoint group to which they’ve been added indirectly (i.e. through membership in an Active Directory group).
Continue reading “Getting All SharePoint Group Membership for a User Using JavaScript”
Why Don’t My CSS Files Work on SharePoint 2019?
For those of you who may not know, I have an open source project for SharePoint called SPEasyForms. But this post is not about that, it’s about a general problem you might encounter in SharePoint 2019, which is that none of your CSS files in document libraries work. It just so happens that I first heard about this issue this week, when somebody reported SPEasyForms doesn’t work on SharePoint 2019. I had tested it in 2019 Preview, and it had worked just fine, but the preview license had expired, so I had to spend a few days standing up a 2019 RTM farm. As soon as I did that, I saw the same results as had been reported (i.e. SPEasyForms looked like crap). So I’m just using SPEasyForms to demonstrate the problem, and I’ll go on to talk about how to fix it.
Understand that this problem will affect all CSS files that are loaded out of document libraries. That includes OOB style sheets loaded out of the master page gallery. It does not affect all SharePoint 2019 installations. Like I said, my preview didn’t display this behavior, and that’s not because this only affects the RTM release. Others had already reported this issue with the Preview release. And Microsoft is aware of the problem, but nobody has explained what alignment of the stars will cause this issue, just some people have it and others don’t.
Continue reading “Why Don’t My CSS Files Work on SharePoint 2019?”
Using a Polyfill Service with SharePoint
If you’ve read many of my previous posts, you have probably seen me use polyfills (i.e. CRUD Operations for SharePoint Docs Using Fetch and REST), to patch older browsers with modern functionality like fetch. I generally download the polyfill, upload it to SharePoint, and load it on the page as a user custom action. But there is another way to load polyfills, which is generally called a polyfill service. The idea is that you load the polyfill from some external service, which detects your current browser, and loads just enough polyfill to patch your current browser up to some level of specification compatibility (usually like ES5, but you can also generally ask for specific functionality, like fetch and/or Promise). There are some unique problems with loading this kind of polyfill in SharePoint, mostly due to limitations in user custom actions. In this post I’m going to talk about how to load such a polyfill in SharePoint, but first lets talk a little more about polyfill services in general.
An Entity Editor Display Template, Advanced Client Side Rendering
Ever had a list in SharePoint with a choice field that allowed multiple selections (i.e. checkboxes)? And with many things to choose from? See the picture below. In this particular case, you’d need to scroll down a page or two to see all of the choices. I’ve seen a lot of people try to solve this problem by making the choices wrap around inline instead of one per line, which is a fine solution if your choices are relatively small strings and there is a small enough number of them. But what if there are over 100 choices, and some of them are pretty big strings? That’s the problem I’m trying to solve with this Entity Editor Display Template.
Continue reading “An Entity Editor Display Template, Advanced Client Side Rendering”
Star Ratings Display Template, Advanced Client Side Rendering
In this post, I’m going to do a CSR field rendering template for a star ratings field. It’s just what it sounds like, give the user an opportunity to rate something with 0 to 5 stars, by clicking into an image of 5 stars. Under the hood it will just be a numeric field, but as much as possible I’d like the user to never see the number. Anywhere the field appears, they should see an image with the appropriate number of gold stars.
Continue reading “Star Ratings Display Template, Advanced Client Side Rendering”
Parameter Aliases in SharePoint REST
This relatively brief post will explain what Parameter Aliases are in OData. They’re used in examples throughout the SharePoint REST API Documentation, and there is a brief description of them (see references), but they are not very well explained. The basic syntax looks like: