Installing PowerShell on Orange PI One

Hi Everyone,

I was a long-term user of Monitor-io, and I was saddened to hear that had planned to shutdown their services on April 15, 2023. I was excited to hear that unlike many IoT vendors, Monitor-io had made the decision to provide an option for their customers to continue to use their devices in a standalone manner.

A Monitor-io showing its local IP address

The Monitor-io unit consists of an Orange PI One and an LCD screen. The Orange Pi One is features an ARM processor – H3 Quad-core Cortex-A7, 512mb of DDR, 10/100mpbs Ethernet, and supports up to 32Gb of storage via micro-SD card. The Cortex-A7 is based off the 32bit ARMv7 instruction set, for those familiar with the Raspberry Pi, this is the same instruction set as the Pi 2 Model B.

Monitor-io provided an image based upon Armbian, and a shell script (netmonitor.sh) that provides basic ping checks to a list of targets listed in the targets.conf file using fping. The script updates the LCD display based upon the results from fping.

Before I started, I wanted to get PowerShell running. PowerShell doesn’t officially support the Orange Pi One, but there is a shared architecture, so I hopped for the best managed to get PowerShell 7.3.4 up and running.

The process was very similar to Installing on Raspberry Pi OS, use the following shell commands to download, and install the package. You will need to change the URL to match the right PowerShell version that you want to install.

###################################
# Prerequisites

# Update package lists
sudo apt-get update

###################################
# Download and extract PowerShell

# Grab the latest tar.gz
wget https://github.com/PowerShell/PowerShell/releases/download/v7.3.4/powershell-7.3.4-linux-arm32.tar.gz

# Make folder to put powershell
mkdir ~/powershell

# Unpack the tar.gz file
tar -xvf ./powershell-7.3.4-linux-arm32.tar.gz -C ~/powershell

###################################
# Optional - Create a symbolic link to start PowerShell without specifing path to pwsh bindar
sudo ln -s ~/powershell/pwsh /usr/bin/pwsh

I haven't fully tested and validated that everything is working, however items like Invoke-WebRequest, and Invoke-RestMethod both appear to function correctly. Most other basic commands also seem to be running without any issues.

Planet PowerShell Update: Mastodon, Twitter, and Pronoun Support

Over the last few weeks, I have been working on some new features in Planet PowerShell.

Mastodon Support

As more users make the move to Mastodon, I wanted to ensure that Planet PowerShell could continue to support the community.

You can now follow Planet PowerShell on Mastodon, @[email protected]. New posts are automatically tooted using the #PowerShell and #pwsh hashtags.

There is now support for authors to share their Mastodon handles. Authors will need to specify a value for the MastodonHandle property. I have already included some authors’ handles where I was following them. If you are a Planet PowerShell author and have made the transition to Mastodon, please ensure you update your author .cs file.

Including Mastodon support was a simple decision for me, and I am extremely thankful that I have made the decision considering recent announcements (see Twitter Support). As part of the change, I needed to update from Font Awesome v4 to v6, you may notice some icons have slightly changed on the website.

Twitter Support

With the extremely unfortunate decision by Twitter to no longer provide free access to their API, Zapier have notified their users that they anticipate their integration to stop working. Planet PowerShell uses Zapier to post to Twitter, Facebook, and Mastodon.

At this stage, it appears that when Twitter’s API change occurs, the @Planetpshell Twitter will also go silent. This is incredibly disappointing. Over the years, Planet PowerShell has gained 3,358 followers, posted hundreds or blog posts and had tens of thousands of impressions each month.

If an alternative solution for posting becomes available, then we may see Planet PowerShell return to Twitter, until then, I recommend everyone follows the RSS, Mastodon, or Facebook page.

Pronoun Support

It is extremely important to me that Planet PowerShell is an inclusive community. Authors now have the option to specify their pronouns. Simply update the Pronouns property in your author .cs file, and the pronouns will be displayed on the Authors page. This is optional, but I highly encourage all authors to include their pronouns.

Analytics & Cookies

Analytics has been a big challenge with Planet PowerShell. I rely on analytics and usage information as part of my Microsoft MVP reporting; making use of a mix of values provided by Google Analytics and Cloudflare’s built in analytics. This isn’t a perfect solution, particular as there isn’t an effective measure for the RSS feed.

In the past, my side projects like Planet PowerShell have often influenced my work projects. Recently, the flow has reversed. After some discussions around GDPR and Analytics, I decided to make some changes to Planet PowerShell.

Planet PowerShell didn’t have a cookie consent mechanism, something that was a potential issue. CookieBot has a free tier for smaller websites, it works by scanning the website and collecting information on all the cookies in use; you just include a small snippet of code from CookieBot, and it will take care of prompting users to accept or reject various cookies. Due to the small number of pages, Planet PowerShell fits perfect in the free tier, with setup and testing being very quick and easy.

As I was implementing CookieBot, I discovered an issue with Planet PowerShell that goes back to the original fork from Planet Xamarin. When I made the fork, I made sure to update Google Analytics and Google Maps codes and keys, but I missed something. Planet Xamarin also made use of Clicky, a more privacy-friendly website analytics provider. I have update Planet PowerShell to use its own Clicky ID.

Lastly, I have also implemented Heap analytics. Heap analytics platform is one of the easiest to understand, and provides information in a concise manner. It still doesn’t help with the RSS feed, I hope will give me a better understanding of the interactions on the Planet PowerShell website.

My aim is to review the usefulness of the information provided by Google Analytics, Clicky, Heap and Cloudflare, and remove those who aren’t useful long term.

Looking for more authors!

I want to grow the number of authors whose content is aggregated as part of the Planet PowerShell feed. If you are an author, please take the time to add your blog. If you need help, feel free to message me and I will be able to assist.

Finally, I want to thank everyone of the support over the years with Planet PowerShell. Things have come a long way over the last 7 years. I can’t wait to see how things change in the next 7 years!

PowerShell CSV Quick Hack – Redistributing Columns in CSV Files

These days, I spend much of my time working with spreadsheets or manipulating data that has come from systems in the form of CSV files.

This week I ran into an interesting issue where I ended up using some PowerShell tricks to change the structure of the data into a more useful format.

I found myself with a CSV file with the columns: Sender, Recipient, Recipient2, Recipient3… all the way to Recipient24. The file looked like this:

The original CSV file I was working with

Every row had a value for Sender and Recipient, however only some rows had values for Recipient2 and onwards.

What I needed was a list of Sender and Recipient, removing the other Recipient* columns and making them new entries. What I needed was a list that looked like this one:

The CSV layout I wanted

I am not an Excel guru, but I am handy with PowerShell, so I decided that I would clean this up with PowerShell.

My original thought was this process:

1. Import the CSV file using import-csv
2. Have a foreach loop that looked at each entry in the CSV file, and created new entries as follows.

My code looked like this:

$OriginalCSV = import-csv 'original.csv'
$NewCSV = @()
Foreach ($item in $OriginalCSV) {
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient}
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient2}
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient3}
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient4}
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient5}
    # ...
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient23}
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient24}
}
$NewCSV | Export-Csv -Path 'new.csv'

This code does what I needed, but it is far from perfect. I have copy-pasted the same code; it does not look very re-usable.

How could I make this code more reusable?

With PowerShell, I can dynamically build a reference to an object’s methods and members as so:

$Value=2
$item."Recipient$Value"

By adding a for loop, I can now pass throw each of the Recipient* columns without resorting to copy-pasting code. This allowed me to simplify my code down to:

$OriginalCSV = import-csv 'original.csv'
$NewCSV = @()

Foreach ($item in $OriginalCSV) {
    $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item.Recipient}

    for ($ii = 2; $ii -le 24; $ii++) {
        if ($item."Recipient$ii" -ne '') {
            $NewCSV = $NewCSV + [PSCustomObject]@{Sender = $item.Sender; Recipient=$item."Recipient$ii"}
        }
    }
}
$NewCSV | Export-Csv -Path 'new.csv'

Till next time,

Kieran

Mitigating IE Zero-Day (CVE-2020-0674/ADV200001) with PowerShell and Intune

Microsoft published a security advisory (ADV200001) containing mitigations against an actively exploited zero-day remote code execution (RCE) vulnerability in Internet Explorer. At time of writing, there is no patch for the vulnerability. Microsoft is expecting to release a patch as part of the usual Patch Tuesday (Wednesday for some of us) cycle.

Microsoft has provided some mitigation steps that can be applied; however, they only recommend taking these steps if there is an indication you are under elevated risk. One of the problems with the mitigation steps is that you MUST revert the changes before you can install any future updated.

The mitigations also come with some side-effects; their impact might be too much for some organisations. Side-effects include:

• Printing to HP printers and other USB printers mail fail.
• Windows Media Player is reported to break on playing MP4 files.
• Sfc.exe will break.
• Printing to "Microsoft Print to PDF" is reported to break.
• Proxy automatic configuration scripts (PAC scripts) may not work. For me, I couldn’t imagine managing some enterprise environments without PAC scripts. That alone would be a good reason to not deploy these fixes.

If after all of this, you want to still apply these mitigations. I put together some quick guidance for their implementation with Intune.

Enabling the mitigations

1. Get a copy of the Enable-ADV200001.ps1 script from my GitHub repository.
2. Sign-in to the Microsoft Endpoint Manager Admin Center.
3. Select Devices > PowerShell scripts > Add.
4. In Basics, enter the Name: Enable IE Mitigations for ADV200001, and select Next:
5. In Script settings, browse to where you downloaded the Enable-ADV200001.ps1 script, leave everything else at their default settings, and select Next:
6. Select Scope tags. Scope tags are optional, if you don’t use this feature, select Next.
7. Select Assignments > Select groups to include. Select with groups this script should be applied to, select Next.
8. In Review + add, a summary is shown of the settings you configured. Select Add to save the script. When you select Add, the policy is deployed to the groups you chose.

Disabling the mitigations

1. Get a copy of the Disable-ADV200001.ps1 script from my GitHub repository.
2. Sign-in to the Microsoft Endpoint Manager Admin Center.
3. Select Devices > PowerShell scripts > Add.
4. In Basics, enter the Name: Disable IE Mitigations for ADV200001, and select Next:
5. In Script settings, browse to where you downloaded the Disable-ADV200001.ps1 script, leave everything else at their default settings, and select Next:
6. Select Scope tags. Scope tags are optional, if you don’t use this feature, select Next.
7. Select Assignments > Select groups to include. Select with groups this script should be applied to, select Next.
8. In Review + add, a summary is shown of the settings you configured. Select Add to save the script. When you select Add, the policy is deployed to the groups you chose.

More guidance can be found here Use PowerShell scripts on Windows 10 devices in Intune

Just remember that before your next patch cycle, you need to disable the mitigations, otherwise the updates will fail.

[Updated Module] Posh-SYSLOG v4.1.5 has been released

A new version of the Posh-SYSLOG module has been released.

The purpose of this update is to provide better support when running on PowerShell Core. This module removes the dependencies on Get-CIMInstance that isn't available on PS Core (at least on MacOS and Linux).

This code will not work correctly on PSCore 6 on WSL at this stage due to an issue in the underlying .Net Core version.

I have also switched to YAML builds and added additional test cases. I need to write a few more test cases for the new functionality.

Getting the Module

If you have never used the module before, the easiest way to get Posh-SYSLOG is through the PowerShell Gallery:

PS> Install-Module -Name Posh-SYSLOG

If you already have the module installed, you can update the module from the PowerShell Gallery with:

PS> Update-Module -Name Posh-SYSLOG

You can also download the release from the module’s GitHub Releases page.

Found an issue? Then raise any bugs or feature requests via GitHub Issues.

[Updated Module] AzurePublicIPAddresses v1.0.14 has been released

A new version of the AzurePublicIPAddresses module has been released. This includes support for 8 new regions: UAE, South African, Chile, and Brazil. For more information see the Change Log.

Getting the Module

If you have never used the module before, the easiest way to get AzurePublicIPAddresses is through the PowerShell Gallery:

PS> Install-Module -Name AzurePublicIPAddresses

If you already have the module installed, you can update the module from the PowerShell Gallery with:

PS> Update-Module -Name AzurePublicIPAddresses

You can also download the release from the module’s GitHub Releases page.

Found an issue? Then raise any bugs or feature requests via GitHub Issues.

Using the OpenSSH client included in Windows 10 (1809) as your Git’s SSH client

Microsoft has included an OpenSSH client with Windows 10 since the Fall Creators Release (1709). This client has been installed by default since the April 2018 Update (1803). The biggest benefit for the average user is that they can now use a supported OpenSSH client, without downloading and installing any other software.

I was setting up my new Surface Pro 6 and wanted to ensure that I was using the built in SSH client and particularly, the SSH Agent. If you are not familiar with the SSH Agent, it caches your private key, so you are not prompted to enter your password for your private key every single time you use it.

I spent some time getting everything to work and wanted to help anyone else who might be having issues.

Side: Why not just use the Credential Provider?

This is a good question! For most users, I recommend that they use the built-in Git Credential Provider. Personally, I prefer using SSH as it is the tool that I am more familiar and comfortable with it. It is just a personal preference.

Step 1 – Install Git

Download Git and install it as you normally would.

Step 2 – Ensure OpenSSH client for Windows is installed

Hit Start > Type “Optional Feature” > go to the Setting App. Check the “OpenSSH Client” is in the list of installed optional features, otherwise install it using the “Add a Feature” button.

Step 3 – Put your private SSH keys in the right directory, and specify the correct permissions

Get your existing private key (or generate a new SSH keypair) and place the private key into the .ssh folder in your user profile. By default, you can/should call the private key id_rsa and the public key should be id_rsa.pub.

The SSH key agent will check the permissions of your private key to ensure it is correctly secured. By default, it isn’t, so we will need to update the security permissions on this file by:

1. Removing inheritance (select copy when prompted).
2. Remove all users and groups except for SYSTEM and your user account.

Step 4 – Update your global Git configuration to use the OpenSSH for Windows

Next, we need to tell Git you use the OpenSSH client provided by Windows and not the one bundled with it. There are two ways you can do this, using the git config command, or directly editing the global configuration file directly.

Via the Git config command:

git config --global core.sshcommand "C:/Windows/System32/OpenSSH/ssh.exe"

Via the Git global configuration file:

[core]
    sshcommand = C:/Windows/System32/OpenSSH/ssh.exe

Step 5 – Change the start-up properties of the SSH Agent Service.

We will need to change the settings for the SSH Agent’s Windows Service. Using your favourite tool (PowerShell or Services.msc), change the start-up type of the service “OpenSSH Authentication Agent” from Disabled to Manual.

Optional – Start the SSH Agent when PowerShell loads

For the most seamless experience, we should automatically start the SSH Agent just prior to our first need of it.

To do this, I have added the following to my PowerShell profiles:

$sshAgentStopped = 'Stopped' -eq (Get-Service -Name 'ssh-agent' -ErrorAction SilentlyContinue).status
Write-Verbose -Message ('SSH Agent Status is stopped: {0}' -f $sshAgentStopped)

if ($sshAgentStopped) {
    Write-Verbose -Message 'Stating SSh Agent'
    Start-Service -Name 'ssh-agent'
}

If you don’t perform this step, you will need to manually start the agent, or will need to enter the password for your SSH private key every time you wish to use it.

Azure Automation State Configuration – Installing Common DSC Modules

Azure Automation State Configuration

Azure Automation State Configuration (previously Azure Automation DSC), is a service provided by Azure that allows you to write, manage and compile PowerShell Desired State Configuration (DSC) configurations and assign these configurations to target virtual machines (or any server or workstation to be honest). On its own, State Configuration provides some basic configuration examples, but its true power comes form the ability for you to define your own configurations.

User created configurations need to be imported and compiled before the configuration is applied to a virtual machine. It is common when creating DSC configurations to rely on a variety of DSC Resources. The modules containing these resources need to be imported into Azure Automation for it to be able to compile any configuration. So how do we import and update these modules?

The first mechanism to manage the PowerShell modules is through the Azure Portal, by going to your Automation Account > Shared Resources > Modules. Here you can add modules from a zip file, update the built in Azure modules, or add modules from the PowerShell Gallery. This provides a simple mechanism particularly if you are starting; unfortunately, most production configurations will need multiple modules, making the Azure Portal difficult to use.

We can also manage modules via ARM templates. Define the template is relatively straight forward but requires a couple of tricks to get started. I will put together a separate blog post on how you can define your own ARM template.

Accelerating Adoption

I wanted to help those starting out with State configuration. My goal was to help accelerate new State Configuration deployments, by creating a “starter” ARM template that would install the most common PowerShell DSC modules that are in the PowerShell Gallery and the most common in my production DSC configurations. This ARM template could also be used to ensure that the modules are also updated on a regular basis.

So what modules are included? I selected 32 modules in the end. These cover the configuration of core Windows, Windows Server roles and features, security hardening, package management and Chocolatey. Most of the modules are maintained by Microsoft, however four modules, cChoco, cSpeculationControlFixes, UpdateServicesDSC and xSystemSecurity that are maintain by members of the community.

Module Name	Author	Description
ActiveDirectoryCSDsc	Microsoft Corporation	This DSC Resource module can be used to install or uninstall Certificate Services components in Windows Server.
AuditPolicyDsc	Microsoft Corporation	The AuditPolicyDsc module allows you to configure and manage the advanced audit policy on all currently supported versions of Windows.
cChoco	Chocolatey Software Lawrence Gripper Javy de Koning	Chocolatey DSC Resources for use with internal packages and the community package repository. Learn more at http://chocolatey.org/
CertificateDsc	Microsoft Corporation	This module includes DSC resources that simplify administration of certificates on a Windows Server
ComputerManagementDsc	Microsoft Corporation	The ComputerManagementDsc module is originally part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit. This version has been modified for use in Azure. This module contains the xComputer and xDisk resources. These DSC Resources allow you to perform computer management tasks, like joining a domain or initializing disks.
cSpeculationControlFixes	Kieran Jacobsen	PowerShell DSC for enabling Speculation Control fixes on Windows Server
DFSDsc	Microsoft Corporation	DSC resources for configuring Distributed File System Replication and Namespaces.
GPRegistryPolicy	Microsoft Corporation	Module with cmdlets to work with GP Registry Policy .pol files
GPRegistryPolicyParser	Microsoft Corporation	Module with parser cmdlets to work with GP Registry Policy .pol files
NetworkingDsc	Microsoft Corporation	Module with DSC Resources for Networking area
PackageManagementProviderResource	Microsoft Corporation	Module with DSC resources for the package management.
PSDscResources	Microsoft Corporation	This module contains the standard DSC resources. Because PSDscResources overwrites in-box resources, it is only available for WMF 5.1. Many of the resource updates provided here are also included in the xPSDesiredStateConfiguration module which is still compatible with WMF 4 and WMF 5 (though that module is not supported and may be removed in the future).
SecurityPolicyDsc	Microsoft Corporation	This module is a wrapper around secedit.exe which provides the ability to configure user rights assignments
SqlServerDsc	Microsoft Corporation	Module with DSC Resources for deployment and configuration of Microsoft SQL Server.
StorageDsc	Microsoft Corporation	This module contains all resources related to the PowerShell Storage module, or pertaining to disk management.
UpdateServicesDsc	Michael Greene	Module with DSC Resources for deployment and configuration of Windows Server Update Services.
WindowsDefender	Microsoft Corporation	Windows Defender module allows you to configure Windows Defender settings.
xActiveDirectory	Microsoft Corporation	The xActiveDirectory module is originally part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit. This version has been modified for use in Azure. This module contains the xADDomain, xADDomainController, xADUser, and xWaitForDomain resources. These DSC Resources allow you to configure and manage Active Directory.
xDhcpServer	Microsoft Corporation	Module with DSC Resources for DHCP Server area
xDismFeature	Microsoft Corporation	Module with DSC Resources for Deployment Image Servicing and Management features.
xDnsServer	Microsoft Corporation	Module with DSC Resources for DNS Server area
xFailOverCluster	Microsoft Corporation	Module containing DSC resources used to configure FailOver Clusters.
xInternetExplorerHomePage	Microsoft Corporation	This DSC Resources can easily set an URL for the home page of Internet Explorer
xPendingReboot	Microsoft Corporation	This module identifies pending reboots in Windows Server and acts on them.
xPSDesiredStateConfiguration	Microsoft Corporation	The xPSDesiredStateConfiguration module is a part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit, which is a collection of DSC Resources produced by the PowerShell Team. This module contains the xDscWebService, xWindowsProcess, xService, xPackage, xArchive, xRemoteFile, xPSEndpoint and xWindowsOptionalFeature resources.
xRemoteDesktopAdmin	Microsoft Corporation	Module with DSC Resources for enabling administrative Remote Desktop Connections
xSmbShare	Microsoft Corporation	Module with DSC Resources for SmbShare area
xSystemSecurity	Arun Chandrasekhar	Handles Windows related security settings like UAC and IE ESC. xUAC enables or disables the User Account Control prompt, while xIEEsc enables or disables IE Enhanced Security Configuration.
xTimeZone	Microsoft Corporation	This DSC Resources can easily set the System Time Zone.
xWebAdministration	Microsoft Corporation	Module with DSC Resources for Web Administration
xWindowsEventForwarding	Microsoft Corporation	This module can be used to manage configuration of a Windows Event Forwarding server in a Collector role.
xWindowsUpdate	Microsoft Corporation	Module with DSC Resources for Windows Update
xWinEventLog	Microsoft Corporation	Configure Windows Event Logs

Want to get started and use the template?

You will need an Azure Automation account to start.

You can then use the Deploy to Azure button on the Git Repository or download the latest release and deploy using Azure CLI or PowerShell.

What to contribute?

The project is up on GitHub and I welcome everyone to make suggestions and recommendations. If you need a had with your first PR, check out this guide from egghead.io. I have connected this project to Azure DevOps build pipelines so all PRs will be validated for any issues.