… PaaS, and SaaS: This type of security consists in properly programming cloud applications to avoid vulnerabilities such as SQL injection, cross-site …
Tag: Cloud computing
Azure Logic Apps and SQL Injection Vulnerabilities
https://michaelhowardsecure.blog/2019/07/22/azure-logic-apps-and-sql-injection-vulnerabilities/](https://michaelhowardsecure.blog/2019/07/22/azure.
Related:
Azure Logic Apps and SQL Injection Vulnerabilities
https://michaelhowardsecure.blog/2019/07/22/azure-logic-apps-and-sql-injection-vulnerabilities/](https://michaelhowardsecure.blog/2019/07/22/azure.
Related:
Azure Logic Apps and SQL Injection Vulnerabilities
https://michaelhowardsecure.blog/2019/07/22/azure-logic-apps-and-sql-injection-vulnerabilities/](https://michaelhowardsecure.blog/2019/07/22/azure.
Related:
Azure Logic Apps and SQL Injection Vulnerabilities
https://michaelhowardsecure.blog/2019/07/22/azure-logic-apps-and-sql-injection-vulnerabilities/](https://michaelhowardsecure.blog/2019/07/22/azure.
Related:
CVE-2019-5476
An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to …
Related:
Sql injection seed lab solutions
this lab. In this lab, we have created a web application that is vulnerable to the SQL injection attack. . NEW Cloud security: The material on cloud …
Related:
When integrated with Intune MAM via EMS Connector, attempts to publish or edit an app in the Citrix Cloud Library results in '500 internal server error' being displayed.
This problem can be caused by invalid details being used to populate ‘Intune app protection policies’ on Citrix Cloud Library. See the value ’12’ entered for ‘Require minimum iOS operating system’ in the following:
To resolve this issue, you must first manually delete some of the content which has been incorrectly created. This example will use ‘Microsoft Excel for iOS’ as the affected app which is in need of manual steps to remove. This example also assumes that Citrix Endpoint Management is in use for MDM functions. Once fully removed, the app can then be deployed again, gracefully, by using modified settings.
To manually remove the affected app and related settings:
– Log on to Citrix Cloud Library with an administrator account (requires Citrix Endpoint Management permissions and also Library permissions)
– Open the Library and delete the app, if it is found (the app will likely be missing from this screen, though it is best practice to delete the app from the Library if it is found in the Library)
– Log on to Microsoft Azure using a suitable account with administrative privileges (require permissions to manage applications)
– Find the following elements and manually delete them:
1) Under Intune App Protection > Apps > Delete the affected app if it is found
2) Under Intune App Protection Policies > Delete any entries for the app here also (if any are found)
3) Under Intune App Configuration Policies > Delete any entries here too (if any are found)
The steps listed above will remove the app and related settings from Intune only.
– Log on to Citrix Endpoint Management console (if in use) and delete the following entries
1) Under Configure > Apps > Delete the affected app if found
2) Under Configure > Delivery Groups > Delete the Delivery Group, which has been created for the app, if one is found
The steps listed above will fully remove the app from Microsoft Azure and also from Citrix Endpoint Management service. Only after the app has been removed, will attempts to publish it again succeed as intended.
When publishing the app again, take care to enter the configuration details in the same way as described at: https://docs.microsoft.com/en-us/intune/app-protection-policy-settings-ios.
For ‘iOS Minimum operating system’, the detail should be entered as ‘major dot minor’ (for example, enter 12.0, not 12).
In this example, entering ‘12.0’ for ‘Require minimum iOS operating system’ meets the syntax requirements for Intune MAM. Using this value does not result in ‘500 internal server error’ being received.
Related:
Build Blockchain Applications with Hyperledger Fabric and Composer on IBM Cloud
Deploy Blockchain-as-a-service Applications with IBM Cloud
IBM Cloud (https://www.ibm.com/cloud/), previously known as IBM Bluemix, provides an enterprise blockchain platform as a flexible blockchain-as-a-service (BaaS), which is based on the open source Hyperledger Fabric. The customer can easily create, deploy, and manage a secure enterprise blockchain on IBM Cloud without caring about the underlying infrastructure.
IBM Cloud is an expensive service for a developer who wants to learn. Therefore, instead of deploying a custom example which requires a premium plan, we present here one of the samples—Marbles—provided by IBM from its free starter plan.
The application will create a marble (a glass ball used as a children’s toy) and store it in the blockchain by invoking Chaincode. We will create a UI that creates or updates the marble’s attributes and stores them in the ledger. The Hyperledger Fabric Client SDK will call the network Chaincode through the RPC protocol.
To run this sample in the IBM Cloud, we need to create an IBM Cloud account and select the blockchain service:
Select the Starter Membership Plan, which is free:
Once created, you’ll need to launch the network and set up the toolchain for Marbles. For that, browse to the IBM Blockchain GitHub link at https://github.com/IBM-Blockchain/ marbles/blob/master/.bluemix/README.md , and click Get Marbles. You should see a page similar to the following one, where you should click Create to create the Marbles sample toolchain:
During setup, it will ask you for your GitHub login. Enter all the required login information, and click Authorize IBM-Cloud.
Once GitHub’s code is set up in IBM Cloud, click Create to continue to the next step—Delivery Pipeline:
Click on Delivery Pipeline and it will start deploying the Marbles application to the blockchain:
Once completed, click on the Marbles Node.js application:
You should see the web interface of the Marbles application launched in the browser:
Login as admin, and a welcome demo page will pop up. You can select Express or Guided
setup. Let’s click the Express button:
The Marbles application is now loaded:
Try to add one Marble by clicking the Ava add (+) button. Add the marble, and then click
Create:
You should see that a new green Marble is added to Ava:
Congratulations! You have just run a sample Hyperledger Fabric blockchain application on the IBM Cloud platform!
IBM Cloud is a powerful platform with built-in services that can easily be integrated into your blockchain project. For instance, we can utilize Watson, which is IBM’s AI solution, to analyze and customize application data to share among authorized network participants.
After finishing this recipe, you can move on to Building A Blockchain for Letter of Credit Using Hyperledger Fabric and Composer and Ultimate Guide for Building A Blockchain Supply Chain Using Hyperledger Fabric and Composer tutorials that cover more advance topics on Hyperledger Fabric.
This recipe is written in collaboration with Brian Wu who is a senior Hyperledger Developer at DC Web Makers in Washington DC.
Related:
How to Create Machine Catalog using MCS in Azure Resource Manager
Pre-requisites
- Access to the XenApp and XenDesktop Service of Citrix Cloud.
- An Azure Subscription.
- An Azure Active Directory (Azure AD) user account in the directory associated with your subscription, which is also co-administrator of the subscription.
- An ARM virtual network and subnet in your preferred region with connectivity to an AD controller and Citrix Cloud Connector.
- “Microsoft Azure” host connection
- To create an MCS machine catalog, XenDesktop requires a master image that will be used as a template for all the machines in that catalog.
Creating Master Image from Virtual Machine deployed in Azure Resource Manager
Create a virtual machine (VM) in Azure using the Azure Resource Manager gallery image with either the Server OS or Desktop OS (based on whether you want to create Server OS catalog or Desktop OS catalog).
Refer to Citrix Documentation – install Citrix VDA software on the VM for more information.
Install the applications on the VM that you want to publish using this master image. Shutdown the VM from Azure Portal once you have finished installing applications. Make sure that the power status for the VM in Azure Portal is Stopped (deallocated)
When creating MCS catalog we need to use the .vhd file that represents OS disk associated with this VM as master image for the catalog. If you have the experience of using Microsoft Azure Classic connection type in XenDesktop, you would have captured specialized image of the VM at this stage, but for Microsoft Azure connection type you don’t have to capture the VM image, you will only shutdown the VM and use the VHD associated with the VM as master image.
Create MCS Catalog
This information is a supplement to the guidance in the Create a Machine Catalog article. After creating master image, you are all set to create MCS catalog. Please follow the steps as described below to create MCS catalog.
-
Launch the Studio from your Citrix Cloud client portal and navigate to Machine Catalogs in the left hand pane.
-
Right click Machine Catalogs and click on Create Machine Catalog to launch the machine creation wizard.
-
Click Next on the Introduction page.
-
On the Operating System page Select Server OS or Desktop OS based on what type of catalog you want to create and click Next.
-
On the Machine Management page, select Citrix Machine Creation Service (MCS) as the deployment technology and select the Microsoft Azure hosting resource and click Next.
Master Image Selection – This page provides a tree view which you can navigate to select the master image VHD. At the topmost level are all the resource groups in your subscription except those which represent the MCS catalog created by XenDesktop. When you select and expand a particular resource group, it shows the list of all storage accounts for the Azure Umanaged Disks in that resource group. If there are no storage accounts in that resource group, there will not be any child items under that resource group. If you have manually created number of resource groups and storage accounts to host your manually created VMs in your subscription, the master image page will show all those resource groups, storage accounts, containers and VHDs even though not all those VHDs are master images that you want to use for the provisioning. Select the storage account that has your master image. When you expand the storage account, it shows list of containers inside the storage account. Expand the container that has master image VHD and select the VHD that you want to use as master image for the catalog.
In the case of Azure Unmanaged Disk, you need to know the VHD path in order to select it. If you have stood up a VM in Azure and prepared it to be used as a master image and you want to know the VHD path, follow the steps below:
-
Select the resource group that has your master image VM.
-
Select the master image VM and click Settings
-
Click on Disks then Click OS Disks and copy the disk path.
-
OS disk path is structured as https://<storage account name>.blob.core.window.net/<container name>/<image name>.vhd
-
You can use the disk path obtained in the step above to navigate the tree view to select image.
In the case of Azure Managed disk, it will be available directly under the Resource Group that you had created or as a part of the Virtual Machine’s Resource Group, as show below:
Note: If you don’t shutdown the master image VM and select the corresponding VHD to create a catalog, the catalog creation will fail. So make sure if you are selecting the VHD which is attached to running VM instance, the VM is in Stopped(deallocated) state.
-
Storage type selection – XenDesktop supports Locally Redundant Standard or Premium storage for provisioning VMs in Azure. Your master image VHD can be hosted in any type of storage account, but for the VMs to be provisioned in Azure, XenDesktop will create new storage accounts based on storage type you selected.
-
XenDesktop will provision maximum 40 VMs in single storage account due to IOPS limitations in Azure. For example if you want to create 100 VM catalog, you will find 3 storage accounts created and VM distribution in each storage account will be 40, 40 and 20.
-
VM instance size selection – XenDesktop will show only those VM instance sizes which are supported for the selected storage type in the previous step. Enter number of VMs and select the VM instance size of your choice and click Next.
-
Network Card Selection – Select network card and the associated network. Only one network card is supported.
-
Select resource location domain and enter machine naming scheme.
-
Enter credentials for your resource location Active Directory.
-
Review the catalog summary, enter the catalog name and click Finish to start provisioning.
-
Once the provisioning is complete, you will find new resource group created in your Azure subscription which hosts, all the VMs, storage accounts and network adapters for the catalog you provisioned. The default power state for the VMs after provisioning is Stopped(deallocated).
Once the provisioning is complete, you will find new resource group created in your subscription that has VM RDSDesk-01 as per the naming scheme we provided, NIC corresponding to that VM and a storage account that XenDesktop created to host the OS disk and the identity disk for the VM. The VM will be hosted on the same network as that of the selected hosting resource during catalog creation and the default power state of the VM will be Shutdown(deallocated).
The resource group created by XenDesktop during the MCS provisioning will have following naming convention
citrix-xd-<ProvisioningSchemeUid>-<xxxxx>
To find out which resource group in the Azure portal corresponds to the catalog you created from studio, follow the steps below.
- Connect to your XenApp and XenDesktop service using Remote PowerShell SDK. Please visit this link to find our how to interact with your Citrix Cloud environment using Remote PowerShell SDK.
- Run command Get-ProvScheme -ProvisioningSchemeName <Catalog Name>
- Note down the ‘ProvisioningSchemeUid’ from the output of the above command.
- Go to the Azure portal and search for the resource group name that contains ‘ProvisioningSchemeUid’ you obtained in step 3.
-
Note:
As a best practice you should always create a copy of your master image and use the copied image as input to the provisioning process. In future if you want to update the catalog, you can start the master image VM and make necessary changes, shut it down and again create a copy of the image which will be your update image. This helps you to use the master image VM to create multiple image updates.Remember to shutdown the master image VM from Azure portal before starting to create the catalog. The master image needs to be copied into catalog’s storage account once provisioning starts, so we need to make sure it is not in use by any VM, otherwise it will lead to image copy failure and eventually provisioning failure.
- Make sure you have sufficient cores, NIC quota in your subscription to provision VMs. You are most likely going to run out of these two quotas. You may not be able to check your subscription quota limits,
- If your master image VM is provisioned in the Premium storage account then just shutting down the VM from the portal isn’t enough. You also need to detach the disk from the VM to use it as master image in provisioning. But in Azure Resource Manager you can not detach the disk while the VM is still available. So you need to delete the VM from the portal, this will only delete the VM but keep the OS disk in the storage account. The NIC corresponding to the VM also needs to be deleted separately.
