AWS Creds Profile Manager - An easier way to manage your AWS CLI/SDK config and credentials files

Source code and download:

https://github.com/walkerk1980/AWSCredsProfileManager

examples:

awsprofilemanager.py -r us-west-2 -a AKID0123456789012 -s 'YourSecretAccessKey/klngs/a49nunf98494n'

awsprofilemanager.py -p saml -r us-east-1 -a AKID0123456789012 -s 'YourSecretAccessKey/klngs/a49nunf98494n' -t 'YourSessionToken/d932u98unf43/a93uh'

For usage and arguments please see: https://github.com/walkerk1980/AWSCredsProfileManager/blob/master/README.txt

For more info on AWS config and credentials files please see the AWS Documentation. [1][2]

[1] Named Profiles - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

[2] AWS Config/Credential File Format - https://docs.aws.amazon.com/cli/latest/topic/config-vars.html

usage: awsprofilemanager.py [-h] [-p [PROFILE]]

                            [-r [{ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2,eu-west-3,sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2}]]

                            [-a [ACCESS_KEY_ID]] [-s [SECRET_ACCESS_KEY]]

                            [-t [SESSION_TOKEN]] [-o [{json,text,table}]]

                            [-R [ROLE_ARN]] [-S [ROLE_SESSION_NAME]]

                            [-P [SOURCE_PROFILE]]

                            [-c [{Environment,Ec2InstanceMetadata,EcsContainer}]]

                            [-e [EXTERNAL_ID]] [-m [MFA_SERIAL]]

                            [-f [CONFIG_FILE_PATH]] [-d [DURATION_SECONDS]]

optional arguments:

  -h, --help            show this help message and exit

  -p [PROFILE], --profile [PROFILE]

                        The name of the profile to create or overwrite

  -r [{ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2,eu-west-3,sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2}], --region [{ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2,eu-west-3,sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2}]

                        the region to set for the profile

  -a [ACCESS_KEY_ID], --access-key-id [ACCESS_KEY_ID]

                        AccessKeyID to set in the profile

  -s [SECRET_ACCESS_KEY], --secret-access-key [SECRET_ACCESS_KEY]

                        The SecretAccessKey to set for the profile

  -t [SESSION_TOKEN], --session-token [SESSION_TOKEN]

                        The SessionToken to set for the profile

  -o [{json,text,table}], --output [{json,text,table}]

                        Default output style

  -R [ROLE_ARN], --role-arn [ROLE_ARN]

                        The ARN of the Role to set for the profile to assume

  -S [ROLE_SESSION_NAME], --role-session-name [ROLE_SESSION_NAME]

                        The Role Session Name to set for the profile to use

  -P [SOURCE_PROFILE], --source-profile [SOURCE_PROFILE]

                        The name of the source profile to set

  -c [{Environment,Ec2InstanceMetadata,EcsContainer}], --credential-source [{Environment,Ec2InstanceMetadata,EcsContainer}]

                        The credential provider to use to get credentials for

                        the initial assume-role call

  -e [EXTERNAL_ID], --external-id [EXTERNAL_ID]

                        A unique identifier that is used by third parties to

                        assume a role

  -m [MFA_SERIAL], --mfa-serial [MFA_SERIAL]

                        The identification number of the MFA device to use

                        when assuming a role

  -f [CONFIG_FILE_PATH], --config-file-path [CONFIG_FILE_PATH]

                        Path to he file to create the profile in, defaults to

                        ~/.aws/config

  -d [DURATION_SECONDS], --duration-seconds [DURATION_SECONDS]

                        The duration, in seconds (900..max_session_duration)

                        of the role session. Default=3600

Puppet install.pp for PBIS-Open

An install.pp in the works for PowerBroker that uses the official ppa. Haven't gotten around to finishing my join.pp yet, will post when I do.

 class optivlabsdomain::install inherits optivlabsdomain {  
  include apt  
  apt::source { 'powerbroker':  
   comment => 'Powerbroker Identity Services',  
   location => 'http://repo.pbis.beyondtrust.com/apt',  
   release => 'pbiso',  
   repos  => 'main',  
   pin   => '500',  
   key   => {  
    'source'   => 'http://repo.pbis.beyondtrust.com/yum/RPM-GPG-KEY-pbis',  
    'id'     => 'BE7FF72A6B7C8A9FAE061F4F2E52CD89C9CEECEF',  
   },  
   include => {  
    'deb' => true,  
   },  
  }  
  exec { 'apt-get update':  
   command => '/usr/bin/apt-get update',  
   refreshonly => true,  
 #  unless => "/usr/local/bin/pbis-installed.sh",    
  }  
  package { 'pbis-open' :  
   ensure => installed,  
   provider => apt,  
  }  
 # file { '/root/pbis-open-8.3.0.3287.linux.x86_64.deb.sh' :  
 #  ensure => present,  
 #  owner => root,  
 #  group => root,  
 #  mode => '0544',  
 #  source => 'puppet:///files/pbis-open-8.3.0.3287.linux.x86_64.deb.sh'  
 # }  
 # file { '/usr/local/bin/pbis-installed.sh' :  
 #  ensure => present,  
 #  content => "$(dpkg-query -W -f='\${status}' pbis-open 2>/dev/null | grep -c 'ok installed')'",  
 #  mode => '0544',  
 #  owner => root,  
 #  group => root,  
 # }  
 # exec { 'install.sh':  
 #  command => '/root/pbis-open-8.3.0.3287.linux.x86_64.deb.sh install',  
 #  refreshonly => true,  
 #  unless => "/usr/local/bin/pbis-installed.sh",    
 # }  
 }  

BASH SSH Key Scripts for authorized_keys

Replace all instances of "user" with a variable and set to correct username.

Delete a Key from authorized_keys

 #!/bin/bash  
 #/usr/local/bin/delete_key  
   
 echo " "  
 echo " "  
 echo " "  
 echo "current number of keys before deletion: " $(cat /home/user/.ssh/authorized_keys |wc -l)  
 echo " "  
 echo "Backing up keys..."  
 cp -fv /home/user/.ssh/authorized_keys /home/user/.ssh/authorized_keys.$(date +%Y.%m.%d)  
 echo " "  
   
 if [ $1 ]; then  
     keytodelete=$1  
     if [ ${#keytodelete} -gt 4 ]; then  
         keys=$(cat /home/user/.ssh/authorized_keys |grep $keytodelete |awk '{print $3}')  
         echo "key(s) will be deleted: " $keys  
         echo " "  
         if [ $2 ]; then  
             if [ $2 == "yes" ]; then  
                 sed -i /$1/d /home/user/.ssh/authorized_keys;  
                 echo "current number of keys after deletion: " $(cat /home/user/.ssh/authorized_keys |wc -l)  
             fi  
         else  
             echo "The above keys will be deleted, if this is what you want run again with 'yes' as your second argument"  
         fi  
     fi  
 else  
     echo "Key you want to delete must be at least 5 chars..."  
     echo "Syntax: delete_key npp56"  
 fi  
   

Backup Keys

 #!/bin/bash  
 #/usr/local/bin/backup_keys  
   
 echo "current number of keys: " $(cat /home/user/.ssh/authorized_keys |wc -l)  
   
 cp -fv /home/user/.ssh/authorized_keys /home/user/.ssh/authorized_keys.$(date +%Y.%m.%d)  

Show Keys

 #!/bin/bash  
 #/usr/local/bin/show_keys  
   
 echo "current number of keys: " $(cat /home/user/.ssh/authorized_keys| wc -l)  
   
 echo " "  
 echo " "  
   
 echo "SSH Keys:"  
 echo " "  
 cat /home/user/.ssh/authorized_keys |awk '{print $3}'  
   
 echo " "  
 echo " "   

Fix NTFS permissions on user subfolders of a redirect folder

Ran in to this problem a few times and had to fix, script requires installation of NTFSSecurity. I made a script once that doesn't require NTFSSecurity, but it is much more complex.

 Write-Host ""  
 Write-Host ""  
 $startingDir = "\\fileserver\redirect"  
 $domain = "ExampleDomain.com"  
 cd $startingDir  
 $adminServiceAccount = New-Object System.Security.Principal.NTAccount($domain + "\" + "AdministratorAccountName")  
   
 Function setPermissions  
 {  
   param ($file, $user)  
   $user = $domain + "\" + $user  
   Write-Host user is $user  
   $objUser = New-Object System.Security.Principal.NTAccount($user)  
   Get-ChildItem $file -Recurse | ForEach-Object {  
     setOwner $_.FullName.ToString() $adminServiceAccount  
   }  
   #$acl.SetAccessRuleProtection($False,$True)  
   $acl = Get-Acl $file.ToString()  
   Write-Host $file  
   Add-NTFSAccess -Path $file -Account $user -AccessRights FullControl  
   Get-Acl $file |fl  
   Get-ChildItem $file -Recurse | ForEach-Object {  
     setOwner $_.FullName.ToString() $objUser  
   }  
 }  
   
 Function setOwner  
 {  
   param ($file, $user)  
   Write-Host Setting ownership of $file to $user  
   $owner = New-Object System.Security.Principal.NTAccount($user)  
   $acl = Get-Acl $file  
   $acl.SetOwner($owner)  
   Set-Acl $file $acl  
 }  
   
   
 Get-ChildItem $startingDir | ForEach-Object {  
   $folderFullPath = $_.FullName  
   $user = $_.Name.ToString()  
   Write-Host Setting permissions on $folderFullPath  
   setPermissions $folderFullPath $user  
 }  

Create AD accounts from a csv in Powershell

I made this to create a bunch of users who need Apache website access, but don't actually need to log into domain, thus the PasswordNeverExpires, edit to your liking before using.

$domain = "ExampleDomain.com"
$pass = "ExamplePass-$@#%$#^"
Import-Csv \\adm-dc\redirect\kwalker\Desktop\Users.csv | ForEach-Object {  
 $first = $_.first  
 $last = $_.last  
 $email = $_.email  
 $location = $_.location  
 $name = $first + " " + $last   
 $sam = $first.Substring(0,2) + $last  
 $principal = $sam + "@" + $domain 
 Write-Host $name  
 New-ADUser -PasswordNeverExpires $true -Path "OU=POC,DC=EXAMPLEDOMAIN,DC=COM" -GivenName $first -Surname $last -AccountPassword (ConvertTo-SecureString $pass -AsPlainText -force) -DisplayName $name -Name $name -SamAccountName $sam -UserPrincipalName $principal  
 }  

Short Spam and Content Filter Scripts for Exchange 2013

ShowCurrentConfig

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $cfc = Get-ContentFilterConfig  
 $sfc = Get-SenderFilterConfig  
 Write-Host 'Blacklisted Senders:'  
 $sfc | Select-Object -ExpandProperty BlockedSenders  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host 'Whitelisted Senders:'  
 $cfc | Select-Object -ExpandProperty BypassedSenders  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host 'Blacklisted Domains:'  
 $sfc | Select-Object -ExpandProperty BlockedDomains  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host 'Blacklisted SubDomains:'  
 $sfc | Select-Object -ExpandProperty BlockedDomainsAndSubdomains  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host 'Whitelisted Domains:'  
 $cfc | Select-Object -ExpandProperty BypassedSenderDomains  
 Write-Host ' '  
 Write-Host ' '  
 Write-Host ' '  

WhiteListSpamSender

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $sender = Read-Host 'Enter the name of the sender you would like to WHITELIST '  
 Set-ContentFilterConfig -BypassedSenders @{Add=$sender}  

WhiteListSpamDomain

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $domain = Read-Host 'Enter the name of the domain you would like to WHITELIST '  
 Set-ContentFilterConfig -BypassedSenderDomains @{Add=$domain}  

unWhiteListSpamSender

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $sender = Read-Host 'Enter the name of the sender you would like to REMOVE from WHITELIST '  
 Set-ContentFilterConfig -BypassedSenders @{Remove=$sender}  

UnWhiteListSpamDomain

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $domain = Read-Host 'Enter the name of the domain you would like to REMOVE from WHITELIST '  
 Set-ContentFilterConfig -BypassedSenderDomains @{Remove=$domain}  

BlackListSender

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $sender = Read-Host 'Enter the name of the sender you would like to BLACKLIST '  
 Set-SenderFilterConfig -BlockedSenders @{Add=$sender}  

BlackListDomain

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $domain = Read-Host 'Enter the name of the domain you would like to BLACKLIST '  
 Set-SenderFilterConfig -BlockedDomains @{Add=$domain}   

UnBlackListSender

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $sender = Read-Host 'Enter the name of the sender you would like to REMOVE from BLACKLIST '  
 Set-SenderFilterConfig -BlockedSenders @{Remove=$sender}  

UnBlackListDomain

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
 $domain = Read-Host 'Enter the name of the domain you would like to REMOVE from BLACKLIST '  
 Set-SenderFilterConfig -BlockedDomains @{Remove=$domain}  

Enable/Disable OWA access based on group membership

Use scenario for this is disabling OWA access to employees who are non-exempt and enabling it for exempt employees.

Powershell:

Disable Members:

 $members=Get-Group -Identity "all aka employees" |select members  
   
 Foreach($person in $members)  
 {  
 $name = $person.members.name  
   Foreach($n in $name)  
   {  
     Write-Host $n  
     Set-CasMailbox -identity $n -OWAEnabled $false  
   }  
 }  

Enable Members:

 $members=Get-Group -Identity "exemptemployees" |select members  
   
 Foreach($person in $members)  
 {  
 $name = $person.members.name  
   Foreach($n in $name)  
   {  
     Write-Host $n  
     Set-CasMailbox -identity $n -OWAEnabled $true  
   }  
 }  

Enable users VM Boxes for Exchange UM

Powershell Script:

I guess I could have thrown this in a For Loop asking you if you needed to add more users, but I didn't. Change the pin of course to what you would want and if you have 5 digit pin policy change the wording.

 Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
   
 $user = Read-Host 'Enter the name of the user you would like to setup voicemail for '  
   
 $extension = Read-Host 'Enter 4 digit extension of user '  
   
 Enable-UMMailbox -UMMailboxPolicy "AdminDialPlan Default Policy" -PinExpired $true -Pin 4321 -Extensions $extension -Identity $user  
   

Script to change Exchange/Lync 2013 User Photos

Can take a command line argument of the user's name otherwise it asks.

Powershell:

 param([String]$UserName)  
 $DefaultPhotoPath = “\\headstart.admin\share\redirect3\”  
   
 if (!$username) {  
   $UserName = "Username"  
   $UserName = Read-Host "Please place photo into" $DefaultPhotoPath"Username\ folder with naming format username.jpg and then type UserName into this script and press enter"  
 }  
 $DefaultPhotoPath = “\\headstart.admin\share\redirect3\” + $UserName + "\"  
 $PhotoPath = $DefaultPhotoPath + $UserName + “.jpg”  
 $photo = ([Byte[]] $(Get-Content -Path $PhotoPath -Encoding Byte -ReadCount 0))  
 Remove-UserPhoto $UserName -Confirm:$False  
 Set-UserPhoto -Identity $UserName -PictureData $photo -Confirm:$False  
 #Set-UserPhoto -Identity $UserName -Save -Confirm:$False  

Last line commented out because it is no longer needed as of Exchange 2013 CU, CU3 I believe, but it could be an earlier CU.  Uncomment if on and older build or if pictures don't actually populate.