Cloud as a Story - Vunvulea Radu

This post is focusing on different types of maintenance activities that can happen on your Azure Virtual Machine (VM). Depending on the actions that need to be done on your VM, this can have a direct or indirect impact on the machine availability or performance.  Impact types First of all, let's identify how a machine can be impacted by different maintenance activities. We do not include in this discussion cases like outages or disasters. Performance decrease : During a live migration of a machine, the performance of the machine can be lower than usual. This happens because of the live migration of a machine from one physical hardware to another that consumes resources. Pause : For a short period of time the machine is paused, but without data loss or connectivity problems (E.g., RDP connection is maintained, but delayed for a short period of time). Unplanned reboot : There are isolated cases when the VM needs a restart. In this situation, there is a short perio...

I saw on Twitter a discussion related to Azure VMs and RDP connection that are open by default. The main purpose of this topic is to present different use cases when the RDP connection (not) is available by default. Use Case 1: Single VM (VM with Public IP inside a default VNET) – RDP Active by default for public access In this context, we have a VM that is created from Azure Portal (or script) as a single entity. It is not part of any scale set or other type of custom configuration. It is just a simple Windows Server 2016 Datacenter machine, which is part of a default VNET with a Public IP allocated to it. In this case, by default the RDP will be configured. The default Network Security Group (NGS) that is created together with our VM will allow RDP connection to the machine. The default VNET allows RDP connection to our VM, because there are no custom NGS rules to restrict it and we have a Public IP attached to our VM. Use Case 2: Single VM (VM without Public IP in...

Context When you create the infrastructure of a system, it is common to have two separate network. One that has access to public internet where front-end system are hosted (web pages, web services). Another network is without internet access, more protected from intruders. In this kind of secure network backend services are hosted, databases and other private services. In this post we will do the following references: Blue Network - The network that had direct access to internet Red Network - The network that doesn't have access to internet and can be accessed only from internal systems As we can see above, from Public Internet a requests goes to the front-end layer (Blue Network). Systems that runs in the Blue Network can make a direct call to the Red Network systems directly. But a request cannot goes from Public Internet directly to the Red Network. Red Network configuration (e.g. routers, firewalls) don't allow requests from Public Internet. Can we have such...

In one of my latest post I presented how we can establish a PuTTy connection between two different machines through Azure Relay Hybrid Connection using web sockets . Today, we will take a look over a Node.JS sample that initiate the tunnel that can be used for an RDP connection between two machines over Azure Relay. Context Before jumping to the solution let's take a look on RDP Connection Sequence ( https://msdn.microsoft.com/en-us/library/cc240452.aspx?f=255&MSPPError=-2147217396 ). As we can see in the connection sequence flow, there are multiple connections that are open during a RDP session. The initial session that is open between client and server is used for the initial handshake and credentials validation. Once the credential are validated, the current connection is closed and other socket connection are open automatically. In the current sample, we will update the original one that was written for Telnet. The first 5 steps from the flow will be supported, until...

A few days ago I wrote a short post about Relay Hybrid Connection (using Azure Relay), that enable us to establish a secure tunnel connection between two different computers, that can be located anywhere in the world. The connection is done over HTTPS using web sockets. This means that even if you have firewalls, as long as port 443 is open, you can have a secure connection out of the box. A short description of Relay Hybrid Connection can be found in the previous post Secure tunnel using Hybrid Connections . Scope In today post let's see how we can establish a Telnet connection between two different computers using Relay Hybrid Connection and Node.JS. Why Telnet? I decided to make this sample using Telnet, because a connection through Telnet requires a direct connection to a specific port. Having such a connection requires as to redirect content that is send to a a port directly to Azure Relay. If we can do such a thing, than we can redirect the VNC or RDP port without a ...

I observed an interesting trend in a few last years. Even if more and more companies migrate to cloud providers like Azure or migrate to IoT era, a common requirement that still popups for all clients is the need of a secure tunnel - Remote Screen Sharing, FTP, Remote Access and so on. In the end the requirement is simple but very hard to fulfill. The need of a secure tunnel (like a VPN) between their devices or systems to their backends. When you combine this with scalability and integration with different system it can become an expensive and complicated nightmare. If you look in my past post , you’ll see that I played with different solutions like Service Bus Relay and OpenSSL. Hybrid Connections But now, it seems that Microsoft made a surprise for us – Hybrid Connections . This is a new feature of Azure Service Bus Relays that allows us to create a point-to-point connection in a secure and reliable way. Before jumping to code, let’s see why I am so excited about it. From the...

In one of the previous post I presented a mechanism that can be used as tunneling solution for Remote Screen Sharing using Azure Service Bus Relay. Screen Sharing using Service Bus Relay (Azure) - an out of the box Tunneling (Port Bridge) solution - http://vunvulearadu.blogspot.ro/2015/03/screen-sharing-using-service-bus-relay.html   But what is happening when you need to establish a Remote Screen Sharing session with a machine that is in a private network without direct access to internet. For this case we would need a mechanism to forward the packages from the central machine, which has access to the internet to the other machine. In theory this could be done very simple, but in practice this could be done pretty hard, because forwarding packages to another machine is not a simple task. On top of this, it would be great if we could do this without having a custom application on the target machine. One solution is to use Service Bus Relay and Port Bridge applicat...

Part 2:  How to open a RDP connection to a device that doesn't has direct access to internet using Azure Service Bus Relay http://vunvulearadu.blogspot.ro/2015/04/how-to-open-rdp-connection-to-device.html The problem We started to work on a project where we need to be able to offer a reliable solution for Remote Screen Sharing - RDP (Remote Desktop Protocol). Luckily, all devices are running Windows operating system and we can use with success the support from Windows. Because all the devices are spreaded world wide we need a tunneling solution. All the content that is send over the wire needs to be encrypted. In theory we would need some relays servers that would be ‘the man on the middle’ between devices and people that would like to access that device - tunneling. There are some solutions on the market for Relay Servers and Tunneling. Some of them are open source and free, others are expensive and very exotic. Our solution would run on Azure, because of this, we want to ...

La orice instanta din Windows Azure, un user se poate conecta remote ca si pe orice alta masina. Acesta are acces la orice fel de resurse din sistemul de operate incepand de la task manager la event logs sau la Windows Services. Pentru a ne putea conecta remote la instanta unui rol este nevoie ca de portalul Windows Azure sa selectam instanta la care vrem sa ne conectam, iar apoi din meniul de sus sa apasam butonul "Connect". Browser-ul o sa faca download la un fisier cu extensia .rdp, care se foloseste pentru conextiune remote. Odata rulat acest fisier, totul o sa decurga normal, o sa fie nevoie sa introduceti credentialele si gata, sunteti conectat remote in Cloud. Pana aici nu o sa aveti nici o problema, totul o sa mearga ca uns. Insa in unele cazuri o sa va treziti ca instanta pe care o aveti nu poate sa fie gasita, orice ati face. Cand incercati sa dati conect, aplicatia sta cateva secunde iar apoi primiti o eroare de genul: The specified user name does not exist. Verif...