DEV Community: Matthew Hart

Create a Self-Signed Certificate for IIS with Powershell

Matthew Hart — Sat, 20 Jun 2020 12:40:59 +0000

This post will describe how to create a self-signed certificate to be used for a local website hosted in IIS. It is assumed you are running Windows 10 with Administrator privileges and have .NET Framework installed. These commands may not work for prior versions of Windows. If you are looking for a more complete script to setup a local IIS site with multiple domains all configured with self-signed SSL. You can find my IIS Builder Powershell script here: https://github.com/mattou07/iis-builder.

Prerequisite

Before we start, we need to know what our binding (hostname) will be for the IIS site. For my example we will have the binding mattou07.localtest.me (The localtest.me domain was kindly provided as a wildcard DNS where any subdomain points to 127.0.0.1, you can read more here https://readme.localtest.me/). If you want to use a different domain, you will need to make sure its pointing to 127.0.0.1 in your hosts file.

Before running any of the IIS commands please ensure you open Powershell as Admin and import the WebAdministration module first (You may run into issues with Powershell 7):

Import-Module WebAdministration

Creating a self-signed certificate

The following powershell command will create our self-signed certificate for our binding and store it in the Personal Store (Note how I also store a reference to the certificate in a variable called $cert this will be needed further on):

$binding = "mattou07.localtest.me" $cert = New-SelfSignedCertificate -DnsName "$binding" -CertStoreLocation "cert:\LocalMachine\My"

However, this is not enough to make the certificate work for HTTPS in our browser. We need to add our newly created certificate to the Trusted Root Certificate store. To do this we take our $cert variable which references our created certificate and add it to our Trusted Root Certificate store like so:

$DestStore = new-object System.Security.Cryptography.X509Certificates.X509Store([System.Security.Cryptography.X509Certificates.StoreName]::Root,"localmachine") $DestStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite) $DestStore.Add($cert) $DestStore.Close()

In terms of creating the self-signed certificate that’s it! You now have a valid self-signed certificate for your binding, created and trusted on your local machine. You can now manually add this certificate to your binding in IIS. I will continue to discuss how to add the certificate to IIS using Powershell commands below.

Creating our IIS site with HTTPS bindings

Create App Pool

First, we will create the App Pool, if you already have an app pool created you can skip this. The $runtimeVersion is the .NET Framework runtime you want the pool to run, you could use a later version if you wanted. However, it needs to be installed on the machine before it can be used.

$appPoolName = "mattou07-pool" $runtimeVersion = "v4.0" $appPool = New-WebAppPool $appPoolName $appPool | Set-ItemProperty -Name "managedRuntimeVersion" -Value $runtimeVersion

The above code will create our app pool named mattou07-pool running version 4.0 of the .NET Framework.

Create IIS Site

We now need to create our IIS site, to do so we need to assign a normal HTTP binding first. The Powershell below will take our previous variables and use the New-Website commandlet to create our IIS site.

$appPoolName = "mattou07-pool" $binding = "mattou07.localtest.me" $siteName="mattou07-web" $webRootPath="L:\dev\mattou07" New-Website -Name $siteName -PhysicalPath $webRootPath -ApplicationPool $appPoolName -HostHeader $binding

Adding multiple bindings

To add additional bindings, you need to use a separate commandlet to do this called New-WebBinding. The below Powershell will add an additional HTTP binding called mattou07-second.localtest.me to the site we created previously:

$siteName="mattou07-web" $binding2 = "mattou07-second.localtest.me" New-WebBinding -Name $siteName -IPAddress "*" -Port 80 -HostHeader $binding2

Assigning HTTPS bindings to our IIS site

To get the binding to work under HTTPS we need to add a separate HTTPS binding and then assign our certificate to that binding. The Powershell below will create our HTTPS binding and add our self-signed certificate we created earlier:

New-WebBinding -Name $siteName -Protocol "https" -Port 443 -IPAddress * -HostHeader $binding -SslFlags 1 (Get-WebBinding -Name $siteName -Port 443 -Protocol "https" -HostHeader $binding).AddSslCertificate($cert.Thumbprint, "my")

I no longer have the certificate referenced

If you no longer have the $cert variable you can easily get the thumbprint using this Powershell to get the certificate by its Subject name (the binding) and then obtain the Thumbprint.

$binding = "mattou07.localtest.me" $cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -eq "CN=$binding"} $cert.Thumbprint

One thing to watch out for is if there are multiple certificates with that subject name. Powershell will return multiple certificates as an array. You will need to target a specific one in the array like so or delete the duplicate certificates:

$cert[0].Thumbprint

The end result should be your domain now working with SSL pointing at your local IIS site.

The end

Again if you are looking for a script that is more complete and is actively being used by others then check out my IIS Builder script here: https://github.com/mattou07/iis-builder Give it a star if you like it!

Feel free to tweet me if you found this post useful or if you notice an issue in the post. Thanks for reading!

Creating complex JSON with Powershell

Matthew Hart — Thu, 19 Mar 2020 12:11:10 +0000

How do I create a JSON file with Powershell?

How do I create a JSON array with Powershell?

How do I create a JSON List using Powershell?

How can I create a JSON array with a List inside with Powershell and vice-versa?

This post will serve as a reference to show how to make complex JSON structures with Powershell, as things can get messy when you are trying to figure out how to use a list or an Array structure and meld them together to make your desired JSON.

How to write to a JSON file

First the basics, here is how you can write out your data to a JSON file:

$yourData | ConvertTo-Json -Depth 10 | Out-File ".\myJsonFile.json"

What does this mean? First we get our variable $yourData which contains your data whether its a list or a hashtable or a mix of each. We then pipe this variable into ConvertTo-Json, we then need to specify the Depth. By default the depth is 2, depth refers to the number of levels powershell can write into the JSON. If your JSON has a lot of nested arrays and lists, increase the depth to prevent powershell from ignoring deeper elements in your data.

Lastly we pipe out the contents to a JSON file that will be created if it doesn’t exist, using the Out-File command. Adding .\ in front of the file name will create the JSON file in the same directory that the script is running in.

Constructing our JSON

Defining a JSON List

Below is the full code snippet to make a basic list in JSON:

$jsonBase = @{}$list = New-Object System.Collections.ArrayList $list.Add("Foo")
$list.Add("Bar") 
$jsonBase.Add("Data",$list)
$jsonBase | ConvertTo-Json -Depth 10 | Out-File ".\write-list.json"

This produces the following JSON:

{"Data":     [     "Foo",     "Bar"    ]}

How does this work? First to begin our JSON with the curly brackets we need to define a hashtable, we can do this by defining a variable with @{}. What happens if I don't use an empty hashtable at the start? Depending on how big your list is, if there is only one element it will just write in that single element without any square brackets. I circumvent this by nesting the list into a hashtable.

Next we define a list using New-Object System.Collections.ArrayList.

We then add our elements by calling .Add() on the variable defined as a List.

Lastly, we add our List to our Hashtable (curly braces) by using the .Add() method however in hashtables we need to additionally define a key in the first argument .Add(key,object). Which is then piped out to a json file.

Defining a JSON Array

Below is the snippet to make a basic JSON Array:

$jsonBase = @{}

$array = @{}

$data = @{"Name"="Matt";"Colour"="Black";}

$array.Add("Person",$data)

$jsonBase.Add("Data",$array)
$jsonBase | ConvertTo-Json -Depth 10 | Out-File ".\write-array.json"

This produces the following JSON:

{
   "Data":  {
                "Person":  {
                               "Name":  "Matt",
                               "Colour":  "Black"
                           }
            }
}

How does this work? First we define two hashtables one which will start our JSON with curly brackets, the other will be used to define our person object.

Next I create a hashtable containing some dummy data, each entry requires a key and a value, divided by a semi colon. Hence we have “Name”=”Matt”;”Colour”=”Black”;.

I then add the $data into another hashtable with the key of "Person". Which is then added to the $jsonBase hashtable with the key of "Data" which is then piped out to the file.

Combining Lists and Arrays

This next set of examples will combine what we have learned and mix our data structures within the same file.

$jsonBase = @{}
$list = New-Object System.Collections.ArrayList
$list = "apples","pears","oranges","strawberries"
$basket = @{"Basket"=$list;}
$customer = @{"Name"="John";"Surname"="Smith";"OnSubscription"=$true;}

$jsonBase.Add("Data",$basket)
$jsonBase.Add("Customer",$customer)
$jsonBase | ConvertTo-Json -Depth 10 | Out-File ".\basket.json"

This produces the following:

{
   "Customer":  {
                    "OnSubscription":  true,
                    "Name":  "John",
                    "Surname":  "Smith"
                },
   "Data":  {
                "Basket":  [
                               "apples",
                               "pears",
                               "oranges",
                               "strawberries"
                           ]
            }
}

How about lists containing arrays?

Snippet:

$jsonBase = @{}
$list = New-Object System.Collections.ArrayList

$list.Add(@{"Name"="John";"Surname"="Smith";"OnSubscription"=$true;})
$list.Add(@{"Name"="Daniel";"Surname"="Cray";"OnSubscription"=$false;})
$list.Add(@{"Name"="James";"Surname"="Reed";"OnSubscription"=$true;})
$list.Add(@{"Name"="Jack";"Surname"="York";"OnSubscription"=$false;})

$customers = @{"Customers"=$list;}

$jsonBase.Add("Data",$customers)
$jsonBase | ConvertTo-Json -Depth 10 | Out-File ".\customers.json"

JSON:

{
   "Data":  {
                "Customers":  [
                                  {                                       "OnSubscription":  true,                                       "Name":  "John",                                       "Surname":  "Smith"                                   },                                   {                                       "OnSubscription":  false,                                       "Name":  "Daniel",                                       "Surname":  "Cray"                                   },                                   {                                       "OnSubscription":  true,                                       "Name":  "James",                                       "Surname":  "Reed"                                   },                                   {                                       "OnSubscription":  false,                                       "Name":  "Jack",                                       "Surname":  "York"                                   }
                              ]
            }
}

How about something extra?

Below I have consumed some data from a JSON placeholder api and have separated the data based on whether the ID number is even or odd. I then pipe the results to their own JSON files. To make things easier I use the Invoke-RestMethod command to convert the JSON into a PSCustomObject. This allows me to use this notation $i.id instead of $i["id"].

Here is the snippet:

#Use Invoke-RestMethod to convert to PSCustomObject
$data = Invoke-RestMethod -Uri "https://jsonplaceholder.typicode.com/users"

#Some basic filter logic here
$even = New-Object System.Collections.ArrayList
$odd = New-Object System.Collections.ArrayList
foreach ($i in $data){
    if($i.id % 2 -eq 0) {
        $even.Add($i)
    }
    else {
        $odd.Add($i)
    }

}

$data | ConvertTo-Json -Depth 10 | Out-File ".\api.json"
$even | ConvertTo-Json -Depth 10 | Out-File ".\api-even.json"
$odd | ConvertTo-Json -Depth 10 | Out-File ".\api-odd.json"

To keep things short this is the output for odd numbers:

[
    {
        "id":  1,
        "name":  "Leanne Graham",
        "username":  "Bret",
        "email":  "Sincere@april.biz",
        "address":  {
                        "street":  "Kulas Light",
                        "suite":  "Apt. 556",
                        "city":  "Gwenborough",
                        "zipcode":  "92998-3874",
                        "geo":  {
                                    "lat":  "-37.3159",
                                    "lng":  "81.1496"
                                }
                    },
        "phone":  "1-770-736-8031 x56442",
        "website":  "hildegard.org",
        "company":  {
                        "name":  "Romaguera-Crona",
                        "catchPhrase":  "Multi-layered client-server neural-net",
                        "bs":  "harness real-time e-markets"
                    }
    },
    {
        "id":  3,
        "name":  "Clementine Bauch",
        "username":  "Samantha",
        "email":  "Nathan@yesenia.net",
        "address":  {
                        "street":  "Douglas Extension",
                        "suite":  "Suite 847",
                        "city":  "McKenziehaven",
                        "zipcode":  "59590-4157",
                        "geo":  {
                                    "lat":  "-68.6102",
                                    "lng":  "-47.0653"
                                }
                    },
        "phone":  "1-463-123-4447",
        "website":  "ramiro.info",
        "company":  {
                        "name":  "Romaguera-Jacobson",
                        "catchPhrase":  "Face to face bifurcated interface",
                        "bs":  "e-enable strategic applications"
                    }
    },
    {
        "id":  5,
        "name":  "Chelsey Dietrich",
        "username":  "Kamren",
        "email":  "Lucio_Hettinger@annie.ca",
        "address":  {
                        "street":  "Skiles Walks",
                        "suite":  "Suite 351",
                        "city":  "Roscoeview",
                        "zipcode":  "33263",
                        "geo":  {
                                    "lat":  "-31.8129",
                                    "lng":  "62.5342"
                                }
                    },
        "phone":  "(254)954-1289",
        "website":  "demarco.info",
        "company":  {
                        "name":  "Keebler LLC",
                        "catchPhrase":  "User-centric fault-tolerant solution",
                        "bs":  "revolutionize end-to-end systems"
                    }
    },
    {
        "id":  7,
        "name":  "Kurtis Weissnat",
        "username":  "Elwyn.Skiles",
        "email":  "Telly.Hoeger@billy.biz",
        "address":  {
                        "street":  "Rex Trail",
                        "suite":  "Suite 280",
                        "city":  "Howemouth",
                        "zipcode":  "58804-1099",
                        "geo":  {
                                    "lat":  "24.8918",
                                    "lng":  "21.8984"
                                }
                    },
        "phone":  "210.067.6132",
        "website":  "elvis.io",
        "company":  {
                        "name":  "Johns Group",
                        "catchPhrase":  "Configurable multimedia task-force",
                        "bs":  "generate enterprise e-tailers"
                    }
    },
    {
        "id":  9,
        "name":  "Glenna Reichert",
        "username":  "Delphine",
        "email":  "Chaim_McDermott@dana.io",
        "address":  {
                        "street":  "Dayna Park",
                        "suite":  "Suite 449",
                        "city":  "Bartholomebury",
                        "zipcode":  "76495-3109",
                        "geo":  {
                                    "lat":  "24.6463",
                                    "lng":  "-168.8889"
                                }
                    },
        "phone":  "(775)976-6794 x41206",
        "website":  "conrad.com",
        "company":  {
                        "name":  "Yost and Sons",
                        "catchPhrase":  "Switchable contextually-based project",
                        "bs":  "aggregate real-time technologies"
                    }
    }
]

Thanks for reading!

I hope this helped you in some way, I am currently working on a feature for my IIS Builder script to work at a solution (sln) level rather than at a project (csproj) level. You can read more about it from my post on the Moriyama blog: Automate your local IIS Development Environment.

Some projects can contain multiple web projects in a solution. So far I have seen a solution containing 4 different Umbraco web projects! Having my script 4 times in a project is not ideal so moving the script to work at sln level will hopefully rectify this!

I am currently using these techniques to construct JSON based on any visual studio solution containing a web project. My aim is to have the script read an sln file and identify the web projects in the solution. This JSON can then be used with my IIS Builder script to construct local IIS sites for each web project in the solution. Allowing my colleagues to work more efficiently when facing a new project.

Six ways to secure your Umbraco back office

Matthew Hart — Sun, 07 Jul 2019 17:05:33 +0000

The aim of this post is to provide you with additional layers to the security of your Umbraco back office login page. By adding more layers of security you make it harder for someone with malicious intent to gain access to your Umbraco back office. Here are six ways to prevent that, starting from the fairly obvious to more technical.

1. Use a secure password or password manager

This is a very obvious one, avoid using common phrases or words for your password such as the famous "password1234" or "keepout", "qwerty" etc. Some seem like a clever idea and easy to remember but is probably already in a big guess list of common passwords that a password cracker would use. Ideally your password should be a random set of characters such as: 3NUg%3SW!zn756D or C^gh53M9gkGgkWx. Ideally everything you sign into should have a random password like this.

Check out, haveibeenpwned.com you simply enter your email address and they will provide you a list of sites that suffered database leaks containing the email specified. If any of your other online accounts share the same password as the sites you used in the list, change it ASAP!

But how can you remember and manage all these passwords? By using a password manager such as Lastpass or Dashlane, there are plenty more managers out there if you want something different. Such as Keepass a password manager that isn't an online service but an open source application that you install.

2. Don't use an email address or "admin" as your username for the admin account

Try to avoid using your personal email, “admin” or “admin@yourdomain.com” as the username for your admin account. Using something a bit more obscure will make it harder for someone to login as they now have to guess both your username and password.

3. IP Restrict your back office via a rewrite rule (technical)

Perhaps you have a static IP address? Maybe at your office or on your own personal or work VPN (Virtual Private Network). You can restrict access to the back office using a rewrite rule in the web config. Like so:

<rule name="RestrictBackOffice" enabled="true" patternSyntax="Wildcard" stopProcessing="true"> 
<match url="*" />
<conditions> 
<add input="{URL}" pattern="/Umbraco/*" /> 
<add input="{URL}" pattern="/Umbraco/surface/*" negate="true" /> 
<add input="{REMOTE_ADDR}" pattern="Your-IP" negate="true"/> 
<add input="{REMOTE_ADDR}" pattern="Another-IP" negate="true"/> 
<add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="Your-IP" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="Another-IP" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="127.0.0.1" negate="true"/> 
</conditions> 
<action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." /> 
</rule>

Fill out Your-IP and/or Another-IP with your static IP address. Do not remove the condition with the IP 127.0.0.1! Specifying the input {Remote_ADDR} and {HTTP_X_FORWARDED_FOR} allows the rule to look at the IP address in the request.

This rule will look at the whole of the url in the request and look for anything going to /umbraco/*. It then checks if the request is coming from the specified IP's in the rule, 127.0.0.1 being the site making requests to itself. We then return a 404 status code when the request fails our conditions.

We additionally allow any requests to the Umbraco/surface controller, you can read more about the surface controller here. If your website has its own Umbraco API controllers you will need to permit them the same way we permit the surface controller.

Avoid using commercial VPN's for you static IP address as the IP address is shared with others.

4. Access your back office via an unknown url/domain (technical)

Perhaps you don’t have a safe static IP address to use (or you do, feel free to merge tips 3 and 4 together), you could restrict the back office to only open on a different url instead. If you have a spare domain lying around use that to access your back office, however I would avoid setting up a sub-domain as these can be queried externally for example here are some the sub-domains I found for Facebook:

Point is avoid doing this for a sub-domain on your main umbraco site domain.

If you are hosting your site on an azure web app, that will already have its own url assigned to it. It will usually have the format webapp-name.azurewebsites.net. This also can be queried with a public DNS checker site if your main site url is using a CNAME record to your azure web app.

However if you use Cloudflare on your website, they obscure this by hiding where the URL is pointing too. Regardless, even if someone does figure out your azure website url this is still another hurdle that someone would have to overcome. Just to view the Umbraco login page!

Below is the same IP restriction rewrite rule and the URL/Domain restriction together:

<rule name="RestrictBackOffice" enabled="true" patternSyntax="Wildcard" stopProcessing="true"> 
<match url="*" />
<conditions> 
<add input="{URL}" pattern="/Umbraco/*" /> 
<add input="{HTTP_HOST}" negate="true" pattern="^subdomain\.domain\.net$" /> 
<add input="{HTTP_HOST}" negate="true" pattern="^another-domain\.com$" />
<add input="{URL}" pattern="/Umbraco/surface/*" negate="true" /> 
<add input="{REMOTE_ADDR}" pattern="Your-IP" negate="true"/> 
<add input="{REMOTE_ADDR}" pattern="Another-IP" negate="true"/> 
<add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="Your-IP" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="Another-IP" negate="true"/> 
<add input="{HTTP_X_FORWARDED_FOR}" pattern="127.0.0.1" negate="true"/> 
</conditions> 
<action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." /> 
</rule>

By using {HTTP_HOST} input and setting negate to true we can say if the request comes via a specific domain let it through.

Example without the IP restriction in play:

<rule name="RestrictBackOffice" enabled="true" patternSyntax="Wildcard" stopProcessing="true"> 
<match url="*" />
<conditions> 
<add input="{URL}" pattern="/Umbraco/*" /> 
<add input="{HTTP_HOST}" negate="true" pattern="^subdomain\.azurewebsites\.net$" /> 
<add input="{HTTP_HOST}" negate="true" pattern="^another-domain\.com$" />
<add input="{URL}" pattern="/Umbraco/surface/*" negate="true" /> 
</conditions> 
<action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." /> 
</rule>

Here is a diagram outlining how this would look with Cloudflare:

5. Don’t access the back office over an insecure URL using Cloudflare SSL

If you are taking advantage of Cloudflare’s free SSL and don't have an SSL binding setup on the server. I would avoid accessing the back office over your main domain as the SSL certificate only protects the connection between you and Cloudflare. There is no guarantee that someone is listening to the unencrypted traffic between Cloudflare and your web server hosting your site. If you are using an Azure web app or VPS, accessing the back office via the azurewebsites.net domain or a domain pointing directly at the VPS, with an SSL binding, would be more secure as you are directly connected to your site as mentioned previously with an SSL certificate on the web server.

You can obtain a free SSL certificate with letsencrypt if you want to avoid paying for SSL or use your azure web app azurewbesites.net url.

6. Use Azure Active Directory to log into your back office

If you already use Azure AD for your organization you can configure Umbraco to use it too. This puts the authentication responsibility on Microsoft instead and leaves Umbraco to focus on delivering your content. With Azure AD you can enforce MFA (Multi Factor Authentication) through Azure adding another additional layer of security. See this article from Shannon Deminick to set it up: https://shazwazza.com/post/configuring-azure-active-directory-login-with-umbraco/.

Thanks for making it down here!

I hope you found this post useful and I hope it provided you with more tools to secure your Umbraco back office. Feel free to get in touch if it works out for you or if you notice something wrong in the post.