new-nanoserverimage - guest

Package management - nano server

Package management
As we have learnt earlier Nano Server does not come with roles or features that are required in the server. In this section, we will learn to install roles on VM which is connected to Azure and create a custom VHD with roles already installed. Nano server comes with online package repository which allows us to connect to any online repository, install and download roles and features that are available. In order to connect to online package repository, the server should be connected to the internet, in the next section I will show you how to install packages on servers not connected to the internet.

As a first step let us get the list of package providers supported on Nano Server, run the following command from WinRM session connected to Nano Server on Azure:

    Find-PackageProvider

Notice most of the famous package providers are supported on Nano Server, let us install the NanoServer package provider by running the following command. With the Windows Management Framework 5.0 preview, Microsoft released a PowerShell module called OneGet. OneGet is the new way to discover and install software packages from around the Web:

    Install-PackageProvider NanoServerPackage
NanoServerPackage internally depends on NuGet provider so you will be prompted to download the dependent packages as well. Once installed you can import the package any time using the following command:

    Import-PackageProvider NanoServerPackage

The following command shows the package providers installed on the machine:

    Get-PackageSource

Run the following command given to see the packages available as part of NanoServerPackage:

    Find-NanoServerPackage -Name *

The following command installs IIS on Nano Server:

    Find-NanoServerPackage *iis* | install-NanoServerPackage
    -culture en-us
Restart the server using the following command:

    restart-computer
The following command creates a new site under IIS and set the physical path location:

    cd\
    md mysite
    Import-module iis*
    New-iissite -Name mysite -BindingInformation
    "*:80:mysite" -PhysicalPath c:\mysite
If we browse by using the public IP or DNS Name of the Nano Server, we should see the default IIS page. Ensure the Nano Server contains the inbound security rule for port 80 open. After you have installed the package you can list by using Get-Package cmdlet or uninstall a package by using the Uninstall-Package cmdlet.

Installing packages on a server connected to Internet is easy as you have seen. In some enterprises, the machines in private data centers are not connected to internet due to security reasons, in such cases we must perform an offline installation of roles or features in Nano Server. There are a couple of ways to do this; one way is to create a custom image. If you are planning to build a farm or a cluster of hundreds of Nano server machines seemingly this is the best option, it allows you to create a custom Nano Server image with the required software installed which can be re-used to create any number of Nano Server machines. To create a custom Nano Server image, we should download the Windows Server 2016 ISO. You can download the 6.5 GB ISO image from https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016/. In the following section, we will build a custom Nano Server image with IIS installed and create a virtual machine using the custom image:

On a Windows 10 machine, right-click the downloaded ISO file and say Mount.
Open the mounted disk in Windows Explorer and copy the contents of d:\NanoServer to a separate folder on the host like c:\nano. Here D:\ drive is where the ISO is mounted on my machine.
Open a new PowerShell windows under elevated permissions and run the following command to import the image preparation module for Nano Server.
       Import-Module C:\nano\NanoServerImageGenerator.psm1
The following command creates a new Nano Server image using standard edition. In the following command, media path points to the drive where the ISO is mounted, BasePath will be used to store temporary files, TargetPath is where the result is stored and package option mentions the package to be installed on the server:
       New-NanoServerImage -Edition Standard -MediaPath D:\
       -BasePath C:\Nano -TargetPath c:\nano\nanowebserver.vhdx
       -DeploymentType Guest -ComputerName nanowebserver -Storage
       -Package Microsoft-NanoServer-IIS-Package -verbose
Enter the administrator password when prompted. The image preparation takes a couple of minutes, the following image shows the verbose log and the progress indicator:

After successful completion the .vhdx file should be available at c:\nano\nanowebserver.vhdx. Let us create a new virtual machine using this .vhdx file and the steps as mentioned in the section Provisioning Nano Server on Windows 10
As shown, I'm attempting to create a new virtual machine using Hyper-V manager and the .vhdx file created previously:

Ensure the machine is running and WinRM is configured on the virtual machine.
Login to the machine from a PowerShell window using WinRM command shown:
       Set-Item WSMan:\localhost\Client\TrustedHosts -Value
       <<IP address of the VM>>
       Enter-PSSession -VMName nanowebserver -credential
       <<IP Address of the VM>>\administrator
You can now manage IIS using PowerShell commands, enable/disable IIS features, create websites, app pools, certificates and so on using the PowerShell cmdlets. The following image shows few commands used to create a default website:

Let us image you have a set of Nano Servers running and you are asked to install a new Package like IIS or DSC, the above method would not help. For such cases, we can move the packages folder to the remote virtual machine and perform and offline installation. The following line creates a PowerShell session which will used to copy files to the remote server.

    $session = New-PSSession -VMName nanowebserver
    -Credential nanowebserver\administrator
Next, let us copy the packages folder from the host machine to the remote machine using the following command. The packages folder contains the .cab file one for each package as shown in the following command. These files can be found under D:\Nanoserver\Packages inside the ISO file when mounted:

    copy-item 'C:\nano\packages' -Destination c:\nano -recurse
    -ToSession $session -verbose

Now remote login into the virtual machine and run the following commands to install the IIS package on the Nano Server:

    dism /online /add-package /PackagePath:c:\nano\Microsoft
    -NanoServer-Storage-Package.cab
    dism /online /add-package /PackagePath:c:\nano\Microsoft
    -NanoServer-IIS-Package.cab
For more information on managing IIS on Windows Server 2016 - Nano Server please visit https://technet.microsoft.com/en-us/windows-server-docs/get-started/iis-on-nano-server#application-development.

import-module for nano server

set-executionpolicy remotesigned - nano server

Changing the RDP port on your server to hide access

How to do it…

Go through the following steps to change the RDP port to one of your liking:

1. Open Registry Editor. You can do this by going to either the Start screen or Command Prompt and typing regedit.
2. Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
3. Find the value called PortNumber and change it to 4822.
   
   
4. Restart the server.
5. Now log into your client computer and open up Remote Desktop Connection by typing that name into your Start screen. You can also type mstsc in Command Prompt to open this program. If you try to connect directly to WEB1, your connection will fail as the server is no longer listening on the standard port 3389.
6. Enter in WEB1:4822 and you connect successfully.
   
   

   Tip

   If at first you cannot connect, make sure to check your Windows Firewall settings. It is possible that you may need to add a rule to WFAS on the server to allow port 4822.

How it works…

With a simple registry change, we can adjust the RDP listener port on servers. This will help keep unwanted RDP connections from being made, which can be useful both inside and outside the corporate network. After making this change, the only people who will be able to reach the RDP login screen would be those who know your new RDP port, and who know how to utilize that custom port within the Remote desktop connection tool.

shutdown command - /s /c

shutdown /s /c "because I wan to"

Windows 2016 Server requirements

Desktop Experience

python - calendar - example

eval(expr_str [, globals [, locals]] )

eval(expr_str [, globals [, locals]] )

Evaluates the Python expression contained in expr_str. Although this can be a way to write more compact code, it’s potentially dangerous if you evaluate arbitrary input strings input by the user, unless the app is for your own use only.

The following example evaluates a Python expression and returns the result.

>>> a = 100

>>> eval('3 * a +55')

355

The string must contain an expression and not a statement. Therefore, assignment statements cannot be used. However, expressions can contain function calls, and function calls, in turn, can execute statements.

One way to reduce the dangers of eval is to prevent access to symbols. The globals argument, by default, gives the setting for local symbols as well. Setting this argument to an empty dictionary prevents access to symbols. (But note that built-in functions are always accessible.)

>>> eval('3 * 10 +55', {}) # This is fine.

355

>>> eval('3 * a + 55', {}) # ERROR; 'a' no longer defined

One way to bulletproof your code is to create a dictionary containing the symbols you want to be accessible; then give that dictionary as the globals argument:

>>> from math import *

>>> a = 25

>>> dict_1 = {'tan': tan, 'radians': radians, 'a': a }

>>> eval('1000 * tan(radians(a))', dict_1)

176.326980708465

The effect is to create a dictionary that restricts the eval statement to recognize only two functions (tan and radians) and one variable (a).

The locals argument isn’t used much, but you can use it to restrict access to local symbols only. In that case, it won’t usually permit access to functions.

eval('a * a + 100', {}, locals())

Although you can use the arguments to try to make eval safer, you can never fully bulletproof this usage if your application should happen to take an arbitrary string from the user and evaluate it. There are ways hackers can take advantage of such code to bring down a system. So again, take care.

Python - eval - Untrusted code

Never exec or eval Untrusted Code

Old versions of Python tried to supply tools to ameliorate the risks of using exec and eval, under the heading of “restricted execution,” but those tools were never entirely secure against the ingenuity of able hackers, and current versions of Python have therefore dropped them. If you need to ward against such attacks, take advantage of your operating system’s protection mechanisms: run untrusted code in a separate process, with privileges as restricted as you can possibly make them (study the mechanisms that your OS supplies for the purpose, such as chroot, setuid, and jail), or run untrusted code in a separate, highly constrained virtual machine. To guard against “denial of service” attacks, have the main process monitor the separate one and terminate the latter if and when resource consumption becomes excessive. Processes are covered in “Running Other Programs”.

exec and eval are unsafe with untrusted code

The function exec_with_data is not at all safe against untrusted code: if you pass it, as the argument user_code_string, some string obtained in a way that you cannot entirely trust, there is essentially no limit to the amount of damage it might do. This is unfortunately true of just about any use of both exec and eval, except for those rare cases in which you can set very strict and checkable limits on the code to execute or evaluate, as was the case for the function safer_eval.