Thursday, August 17, 2023

Azure portal VM start-stop permissions for guest user

Revisiting my older post on the subject:

I had created that custom role inside the particular VM I wanted to delegate access for. So, the custom role "VM-start-stop" or whatever was not available for another VM I had created in the same resource group. The point to note is that the role should be created with the desired scope - so, 

  • if I navigate to the resource group --> IAM --> Add +  --> Add custom role, then that custom role would be available throughout that resource group. 
  • if I navigate to Home --> Subscriptions --> (a particular subscription) --> IAM --> Add +  --> Add custom role, then that custom role would be available throughout that subscription.
  • if I navigate to the VM and go to IAM --> Add + , I don't see the option to add a custom role.

https://stackoverflow.com/questions/23668154/allow-users-to-start-stop-particular-azure-vms

According to the stackoverflow post above, "Virtual Machine Contributor" role gives more permissions than we want to delegate. So, after trying out this role (which works for start/stop VMs, but also allows some more permissions), decided to recreate the permissions given in my earlier post. So, copy-pasting from the JSON tab of the previously created role, only the actions and dataActions parts in permissions,

"permissions": [

            {
                "actions": [
                    "Microsoft.Network/publicIPAddresses/read",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/loadBalancers/read",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Compute/virtualMachines/*/read",
                    "Microsoft.HybridCompute/machines/*/read",
                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action",
                    "Microsoft.Compute/virtualMachines/start/action",
                    "Microsoft.Compute/virtualMachines/powerOff/action",
                    "Microsoft.Compute/virtualMachines/restart/action",
                    "Microsoft.Compute/virtualMachines/deallocate/action"
                ],
                "notActions": [],
                "dataActions": [
                    "Microsoft.Compute/virtualMachines/login/action",
                    "Microsoft.HybridCompute/machines/login/action"
                ],
                "notDataActions": []
            }


to a newly created custom role in the Resource Group, (we have to click Edit in the JSON tab, and then Save after entering the permissions).

Then, to see it under our VM, had to go to roles tab, choose the custom role filter, and then refresh.

Later, under Role Assignments, selected the VM contributor rule, and removed that role since it was too permissive.

Posted by on No comments:

Wednesday, August 16, 2023

setting timezone to Indian Standard Time on Ubuntu 22.04

Probably similar for other systems running systemd, I guess.
sudo timedatectl set-timezone Region/City,

so

sudo timedatectl set-timezone Asia/Kolkata

Posted by on No comments:

Tuesday, August 15, 2023

Sony Trinitron Micro Latch-up

The error-code in the service manual of the Sony Trinitron TV used in the waiting area, model KVXJ29M50, indicated "Micro Latch-up". Apparently that means that some CMOS component is damaged?

https://eng.libretexts.org/Bookshelves/Electrical_Engineering/Electronics/Introduction_to_Physical_Electronics_(Wilson)/03%3A_FETs/3.12%3A_Electrostatic_Discharge_and_Latch-Up

Currently not digging further.

Edit 16 Aug - saw some waveforms of "board C6" on oscilloscope, they seemed to be OK - at least not flat, even for R, G and B, even though R is not coming on screen. Perhaps damage inside the picture tube? Or on the board C6? Anyway, not digging any further, just leaving it, as it works as a "monochrome" or "duo-chrome" monitor at present. 

Posted by on No comments:

Saturday, August 12, 2023

some notes on using supervisord to start a flask web app on Raspberry Pi or Ubuntu-based systems


One of the methods suggested to start a python flask web app on boot was to use supervisor. Since I installed it with apt, the suggested method to create a configuration file did not work.

Also, it is apt install supervisor, and not apt install supervisord.

sudo apt install supervisor
looks like /etc has a supervisor directory and a conf.d directory inside it!
sudo service supervisor status
not supervisord

Also, supervisor seems to search for and use supervisord.conf files, so we must ensure wrong or backup files are renamed to something else. 

INFO exited: flask_app (exit status 1; not expected
This was apparently due to not using the user=ouruser in the config file.

Final configuration was just by appending the following to the existing /etc/supervisor/supervisord.conf file.

[program:flask_app]
user = ouruser
command = /usr/bin/python ourapp.py
directory = /home/our/path/to/WebServer
autostart = true
autorestart = true

Then, to add a favicon, we need to add a route:


Authentication, or running on android - 

Posted by on No comments:

notes about controlling "smart lamps"

The final solution was something like this,
https://github.com/hn-88/python-tuya-fadein-web
Connecting to the web app running on our internal network using our mobile browsers to have local controls. 
Making the flask python app start on booting the "server" - using supervisor. I'll write a separate post on configuring supervisor on Raspberry Pi (in general, Ubuntu-based systems).

Link dump:


flux_led shows no devices. And there is no ip address for the wipro smart batten 
(Actually it did have an ip address, our router was not displaying the client list properly - it would show only those clients which have recently requested ip leases.)
Apparently philips hue uses a bridge, which does have an ip address.

on alexa app, info by long press is "Connected via Smart Life"


from
which is mentioned in above video.

Will try the nmap solution at

nmap -sU -p 137,5353 --script nbstat,dns-service-discovery <<your target range here>>
Install localtuya custom integration and when trying to add devices,
it will list found ones with their ip addresses and IDs.

sean6541/tuyaapi (github.com) - but this seems to be 5 years old, may not work.



But in testing, even if the set_brightness_percentage() calls are not separated by sleep calls, it still works synchronously, taking more than half a second per call.

Exploit for jailbreaking tuya devices (not used)


Posted by on No comments:

Friday, August 11, 2023

fade in and fade out lights using "smart lamps"

Testing out various options, found that these two smart lamps do the job for us.


Wipro Next Smart Wi-Fi 20W CCT+RGB LED Batten | 16 Million Colours | White Tunable | Dimmable |Scheduling |Scene Creation |Smart Grouping of Lights |Amazon Alexa & Google Asst. Compatible |Pack of 1 

https://www.amazon.in/gp/product/B08D19X3LS/

Amazon Basics - 9W Smart LED Bulb with Alexa, Google Assistant & Wi-Fi Enabled (Pack of 1, Cool White, B22 Holder)

https://www.amazon.in/gp/product/B0BBMRCFGW/

Apparently these are Tuya compatible, since they are controlled using the Smart Life app. 

We could control these using either the Smart Life app or the Alexa app, but in case future updates cause them to need a subscription or something, I thought of writing python controls for them with the help of tinytuya.

 Some notes. 

The Amazon basics lamp - for pairing, need to put on and off exactly 5 times: doing 10 times does not seem to work. First need to set up in smart life app, only then can we set up in Alexa app.

1. Smart Life App -

  • way to add - add a 'home', add a 'room', add devices
    Click on the + in the top right to create "scene" (fade in fade out etc)
    Tap to run
  • minimum delay between actions is 1 second
  • does not seem to support drag and drop to rearrange actions in a scene.
  • does not seem to support "local" control - the control type seems to be set to 'cloud' only.

2. Alexa App - 

  • When adding device in Alexa app, choose Smart Life as the device type.
  • After adding to "office" group, More... for custom routine.
  • minimum wait time is 5 seconds. For shorter wait, a workaround as suggested at reddit is to make Alexa say something with 0 volume.

    https://www.reddit.com/r/amazonecho/comments/qtz9ob/create_1_second_wait_in_routine/

    Action: +
    >(Device Settings) Set Volume 0
    >Next>Action: +
    >(Alexa Says)>(Customize)>Count 1
    >Next>Action: +
    >(Device Settings) Set Volume 5
    >Next>Save<  

3. Writing a python script: I'll write a separate post on my notes for writing this set of scripts.

 

Posted by on No comments:

Sunday, August 06, 2023

Excel as a sport

Interesting concept - Excel as an E-sports event!
Posted by on No comments:

Thursday, August 03, 2023

passport renewal from a rural location

A follow-up post from my earlier post on applying for a passport.
  • Since I had a "Post office passport seva kendra" or "POPSK" in a nearby town of Hindupur, I could avoid going all the way to Hyderabad.
  • In the online application process, I had to change my Passport regional office from Hyderabad to Vijayawada, since Hindupur comes under Vijayawada. But for doing this, the procedure is to create a new account - the old account's office cannot be changed. I checked this with the toll-free helpline too.
  • After filling up the online form, after the last step of making the payment, there is no option to choose a date and time of convenience - the appointment date and time is intimated. So, if we need an appointment on a certain date, we have to keep checking the available dates at their website. Booking an appointment in the evening after 8 pm, like I did this time, seemed to result in an early morning appointment.
  • The only required documents shown at the passportindia.gov.in website were the old passport and a proof of identity, for which Aadhaar was available. I took my Voter Id card (EPIC - Election Photo Identity Card) too, and also the old copies of all the documents I had taken for the initial passport application. That turned out to be useful. The passport officer asked me for proof, since I was born out of India and was a citizen by descent and not by birth. Note to self - take the old passports of parents on next renewal too!
  • The officer also asked me to take fresh xerox copies of the first and last page of the passport on a single sheet, as well as page 4 & 5 (blank pages). I wonder why. Perhaps as proof that I had not gone out of the country after receiving the first passport booklet in 2014?
  • The officer also refused to recognize my class X SSLC certificate (which is a booklet as they used to issue in Kerala in 1990), saying that it is Transfer Certificate and not X class certificate(!) and finally took my MSc certificate as proof that I'm a matriculate for "non-ECR category"!
  • But overall, very smooth. Only 2 people in a tiny office - the passport officer and a lady to take the passport photos and biometrics - thumb/other fingerprints. As soon as we entered at 9:35, he started working with us, since ours was among the first appointments, even though the appointment time was 10 am. 
  • And the drive to Hindupur was very pleasant, via a National Highway to Lepakshi. Left at 7:45, reached Hindupur POPSK at 9:15 after stopping for coffee and a restroom break at AP tourism hotel next to the Lepakshi bull. On the return, started at 10:10, reached back at 11:45 after taking the non-toll road, since we had to wait at a level crossing for a goods train for a few minutes. 
Posted by on No comments:

Wednesday, August 02, 2023

pdf find and replace

 There was a request to find/replace some boilerplate text in a few thousand pdfs. One option was to use  https://pdfreplacer.com/

and see if it does the job with a watermark.

(You may need to find/replace one line at a time).

Just for interest, looked at scripting options, found it was quite complicated. Some notes below.

Learning more about pdf

Visual studio
file 
open with 
binary editor

But does not find the text, because it is zlib compressed.




($30 for no watermarks)





above gist does not work in our case, since the text is not encoded as ANSI/ASCII text but using the font's encoding, in hex.

font subsetting


 
Both are not useful.
Method 1 changes the formatting
Method 2 makes the pdf into an image.



since xpdf pdftotext seems to work, checking out the code
PDFDoc.cc
Page.cc




Although not a library in traditional sense, Pdfedit has scriptable editing capabilities. But it requires QT. PodoFo probably fits best at your requirements. There's also PdfHummus.

(unmaintained)

(maintained, but unstable)

(apache license.)





page 16 says
The Font encoding object specifies how to translate this value into a character (and these are defined in Appendix D of the PDF Reference specification)

But these seem to be similar to Unicode / ASCII, with d being  0x64 - not 0x47 as seen in our document at an offset of 18020 or so.





Using RUPS



























Thence to find the encoding Identity-H

So, looking for a ToUnicode CMap
found the stream,

















to understand bfchar and bfrange in cmap

we see a pair
<0047> <0064>
So, 47 in the pdf is mapped to unicode 64?! Yes!




We can use
instead of RUPS to browser (but RUPS can also edit/change the PDF.)


Unfortunately, there is no space 0x0020 mapped? So we can't just replace the characters with 0x0020 or something similar.

The "correct" way to do it might be to use the "stamp" function to overwrite the offending text with what we want.

The "hacky" way might be to replace the characters with something else and make them not visible, if that is feasible.
Posted by on No comments:

Tuesday, August 01, 2023

creating and using an "outage page" using github pages and cloudflare redirect rules

Easy to create a page on github pages for outages, and then point to that page using cloudflare redirect rules. Once the outage is resolved, we can simply disable the rule for the site to work again normally. 
Posted by on No comments:
Subscribe to: Posts (Atom)