system32

AD Authentication Issues 2022-05 May Patches / Mapping Certificates to AD Objects

Fri, 20 May 2022 00:00:00 +0000

This article shows how to use PowerShell to address the issues that come with the new StrongCertificateBindingEnforcement security feature of Active Directory by mapping the existing/already enrolled certificates to their respective AD account (whether computer or user).

Disclaimer: This content and scripts are provided free of charge and I do not take any responsability for them nor any harm they may cause, it is up to you to review and test them properly before deploying them anywhere.

Introduction

Many organizations were hit a bit unprepared by this months' patchday which introduces a new security feature called "StrongCertificateBindingEnforcement" that ended up breaking authentication on various important Windows roles such as Network Policy Servers (NPS) or Routing and Remote Access Service (RRAS) when authenticating via certificates.

While Microsoft already released hotfixes to address an issue where the AD Object was not properly matched to the Certificate it uses, there are still many users facing issues.

It is possible to disable this new behavior by setting the registry property HKLM\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement to REG_DWORD:0x00000000. However this disables the security mitigations that Microsoft introduced during this patch day (for a good reason!).

Mitigating the actual issue will require multiple steps in many environments, therefor please follow the next paragraphs.

Issue Mitigation Steps

In this post, I will address different topics you should take into account when addressing this issue in your environment.

1. Applying the Hotfixes

First off, apply the hotfixes Microsoft released on 2022/05/20 to make sure that you're not walking into the previously introduced bug.

As for the modern operating systems, all you need is to install the following cumulative updates depending on the OS (installation of the previous 2022-05 updates is not required):

Windows Server 2022: KB5015013
Windows Server version 20H2: KB5015020
Windows Server 2019: KB5015018
Windows Server 2016: KB5015019

On the older OSes which do not follow the modern update pattern with cumulative updates, you will first have to update your OS before applying one of the following hotfixes:

Windows Server 2012 R2: KB5014986
Windows Server 2012: KB5014991
Windows Server 2008 R2 SP1: KB5014987
Windows Server 2008 SP2: KB5014990

2. Adding userPrincipalName to the Certificate Templates

While this is not mentioned in any of the official support articles, you will need to make sure that the Certificate Template your clients are using does include the userPrincipalName (UPN) in the Subject Alternative Name (SAN) as shown on this screenshot:

3. Updating ADCS and re-enrolling Certificates

After applying the 2022-05 Cumulative Updates to your Enterprise Issuing CAs, you will see that each enrolled certificate has a new property with the OID 1.3.6.1.4.1.311.25.2 under "Details". This new property holds the SID of the AD account that enrolled it. To map existing certificates, please see the next paragraph.

Mapping existing certificates to their AD Object

Hint: For this to work, your Templates already need to include the UserPrincipalName as described above

Background Information

To avoid having to wait for all clients to re-enroll their certificate, you can map them to the AD Objects manually, however this is a lot of manual effort.

Mapping certificates is archived by adding an certain identifiers of the previously issued certificates to the altSecurityIdentities attribute of the AD Object. This identifier can be built using the following ways, some of them are not explicitly unique to the certificate and should therefor be avoided.

The recommended way to map it is using the certificate serial number in conjunction with the CA Name for example X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<SR>1200000000AC11000000002B.

Mapping	Example	Type	Remarks
X509IssuerSubject	"X509:<I>IssuerName<S>SubjectName"	Weak
X509SubjectOnly	"X509:<S>SubjectName"	Weak	Text
X509RFC822	"X509:<RFC822>user@contoso.com"	Weak	EmailAddress
X509IssuerSerialNumber	"X509:<I>IssuerName<SR>1234567890"	Strong	Recommended
X509SKI	"X509:<SKI>123456789abcdef"	Strong	Text
X509SHA1PublicKey	"X509:<SHA1-PUKEY>123456789abcdef"	Strong
Source - support.microsoft.com

For this approach, the binary order of the serial number needs to be added backwards and the CA Name needs to be read backwards as well. As quoted here:

1Note that when you reverse the SerialNumber, you must keep the byte order. This means that reversing the SerialNumber “A1B2C3” should result in the string “C3B2A1” and not “3C2B1A”. For more information, see HowTo: Map a user to a certificate via all the methods available in the altSecurityIdentities attribute.

Mapping using PowerShell

Luckily PowerShell comes into play here and allows us to read the existing enrolled certificates from the Enterprise CA and automatically set them on the AD Object in question (no matter if user account or computer account). The script has cross-domain support and will ask you for credentials for all trusted domains where the Enterprise CA issued certificates to.

To use the script, you will need to populate the following environment variables before you execute the script:

1[string]$CertAuthority = "<pkiname>" # Server Name of the Enterprise CA is enough
2[array]$CertTemplates = 'DeviceCert', 'UserCert' # List of Certificate Templates to process
3[bool]$DryRun = $true # With DryRun = $true, the script will not do any changes but will show you the impact

You will also need to install the PSPKI Module which is available here or in the PS Gallery.

You can find the script here: https://github.com/system32blog/blog/blob/master/static/post/adsmapcertificates/Invoke-ADCSCertMapping.ps1

PowerShell based PRTG Sensor Discovery

Mon, 08 Nov 2021 00:00:00 +0000

This article shows a script I made to enhance PRTGs own sensor discovery. The script can be run as scheduled tasks and will use the PrtgApi to find any kind of sensors that you wish to monitor on your systems (such as Windows Services, NetApp Volumes, Cisco UCS Disks and so on)

Introduction

Many of you probably already heard about PRTG or are already using it to monitor your network. PRTG has a great builtin sensor discovery that will add sensors for almost everything you'd want to know about on your server. One downside of this is the fact, that everytime you run this discovery, it adds all sensors once again as it does not check if this sensor is already there.

To workaround this, I've build a PowerShell script that you can run as scheduled job to automatically discover any kind of discoverable sensor.

The script is also able to send you a summary of what it discovered and created directly into your Teams Channel (via an Webhook Connector).

How does it work?

The script uses PRTGs inbuilt API and the PowerShell Module "PrtgApi" (https://github.com/lordmilko/PrtgApi) to invoke a sensor discovery for a specific sensor on a device or a group of devices. After that it loops through the existing sensors to detect if there are any that are not explicitly excluded or already existent.

The script has the following features and attributes per sensor type:

RawType: The PRTG Name of a sensor, you can find all your PRTG Instance is aware off using the cmdlet Get-SensorType.
SensorPrefix: The prefix that is used by the sensor when you add them using the PRTG API.
Group: The PRTG Device Group which the script shall run for this sensor type. If multiple groups with the same name exist (e.g. under different probes), it will run for all of them.
NameFilter: A wildcard aware filter of devices the script shall run for. Do all your Windows Servers starts with "WSRV"? Great! Enter "WSRV*" into the NameFilter and you'll avoid unnecessary discoveries on not applicable devices. If not, just let the asterix in.
AttributeName: The attribute name out of which the script shall extract the discovered sensors. This differs per sensor. You can find the correct property by running New-SensorParameters on a device.
ExclusionList: An array of occurences to ignore, in the existing sensor types below, you can find some examples. This exclusion list also supports wildcards.
MaxSensors: A threshold of how many sensors to discover per device. Exceeding this limit will fire an error message.
DiscoveryInterval: A limitation of how often this Sensor Type discovery shall run, meaning that even if the script is executed multiple times in a row, if the discovery interval is not yet due again, it will skip this sensor type. An example of this would be disk sensors, discovering them all few days will be more than enough. Windows services however might pop up more often and therefor require a more frequent discovery. The last discovery is saved in the current user registry for each device, if you run the script on another device or under an other user context, it will start fresh.
NameExtractionSB: An additional scriptblock that's being run against the object t to extract the individual element name out of a device. This might be required for devices that return inconsistent or badly formatted informations around the actual device name. The Cisco UCS Disks Sensor Type shows an example of it.

How to use it

To use the script, you will need to populate the following environment variables before you execute the script:

 1# Required
 2## PRTG server url
 3$env:PRTGUrl = "https://prtg.internaldomain.com"
 4## PRTG Username
 5$env:PRTGUsername = "svc-discovery"
 6## PRTG Password
 7$env:PRTGPassword = "bacon"
 8
 9# Optional
10## A teams webhook to sent a summary of discovered sensors to (if any)
11$env:TeamsURL = "https://yourtenant.webhook.office.com/webhookb2/.."
12## A teams webhook to sent a summary of discovered sensors to (if any) while using VSCode to work on the script
13$env:TeamsStagingURL = "https://yourtenant.webhook.office.com/webhookb2/.."

Depending on the number of items you got in the specified groups, it will take some time (minutes to hours) to discover the Sensor Types defined below.

Predefined Sensor Types

There is already a bunch of sensor types defined in the script, feel free to either keep them or delete them out of the hashtable. Those are the ones I've developed the script for and are actively used in my work environment.

Cisco UCS Disks: Discover disk of a Cisco UCSC and Cisco UCSB Series using their CIMC Interface
NetApp System Health: Discover NetApp System Health Sensors for each Controller
NetApp IO: Discover NetApp IO Sensors for each Controller
NetApp Aggregates: Discover NetApp Aggregates Sensors for all clusters
NetApp Lifs: Discover NetApp Lif Sensors for each Controller
NetApp Physical Disk: Discover NetApp Disk Sensors for each physical disk
NetApp Interfaces: Discover NetApp Physical Interface Sensors for each
NetApp Volumes: Discover NetApp Volume Sensors for each Cluster
NetApp SnapMirrors: Discover NetApp Snapmirror/SnapVault Relationship Sensors for each Cluster
Disk Space: Discover any available SNMP Disk Space Sensor (Windows/Linux) for each device
Windows Services: Discover any running Windows Service via SNMP for each device. This Sensor Type already holds a long list of exclusions of builtin Windows Services in English and German OS. The reference lists are from Server 2019 Installations.

The script

You can find the script here: https://github.com/system32blog/blog/blob/master/static/post/PRTGSensorDiscovery/Invoke-PRTGSensorDiscovery.ps1

PowerShell NetApp SnapMirror Destination Migration

Mon, 23 Aug 2021 00:00:00 +0000

This article shows how to use PowerShell and the NetApp PowerShell Module to migrate all NetApp SnapVault/SnapMirror relationships to a new system. The script also builds the SVM Relationships and does the cutovers of the relationships on the source ONTAP Systems.

Introduction

If you ever had to migrate a SnapMirror Destination ONTAP System to a new one, you probably already faced the struggle to migrate Volume by Volume and SnapMirror by SnapMirror to keep all Snapshots.

The good news: You don't have to do this manually as NetApp has a great PowerShell integration for both, ONTAP and 7-Mode Systems.

The magic

Since I had to migrate multiple SnapMirror Destination ONTAP Clusters to new ones and realized how much effort this is per volume, I came up with this PowerShell script to automate this process.

What this script does is:

SVM Peering
Volume creation
Intermediate SnapMirror Relationship and Initialization
Cutover on the Source Systems from the old SnapMirror Destination over to new SnapMirror Destination (keeping the existing policy, schedule and settings)
Break-up off the existing SnapMirror from Source Systems to the old Destination System

Prerequisites:

Credentials for all involved ONTAP Systems
Cluster Peering between old destination system and new destination system
Cluster Peering between source systems and new destination systems
SnapMirror Policies, Schedules and Snapshot Labels from all source storages pre-created on the new destination system (the script will not create them)

How to use it

To use the script, simply fill in the variables at the start of the script, please make sure to cross check all information you enter. On the first run, it will ask you for credentials for both, the old and the new destination system. After that, it will create the SVM Peerings (if not existent), the volumes and the SnapMirrors between the old and new destination system and initialize them.

It will take some time (hours to weeks) to transfer the data in those volumes between the old destination and the new destination systems depending on both systems performance and the amount of data.

You can check the status on the new destination system by executing snapmirror show and verifying that the status is snapmirrored and idle.

As soon as that's the case, run the script once more. It will start by fetching the status then quiescing, breaking and deleting the mirrors to the old backup system and ask you for credentials to all involved source systems. After entering the credentials, it will start to build the SnapMirror Relationships from the source system to the new destination system, invoke a resync and release the SnapMirror to the old backup system.

The script

 1#region Variables
 2$oldIP = "<Management IP of old destination storage>"
 3$newIP = "<Management IP of new destination storage>"
 4
 5[array]$svms = @(
 6 @{
 7 Old = "<SVM Name on old destination storage>"
 8 New = "<SVM Name on new destination storage>"
 9 }
 10 <#
 11 Add as many SVMs as required
 12 @{
 13 Old = "<SVM Name on old destination storage>"
 14 New = "<SVM Name on new destination storage>"
 15 }
 16 #>
 17)
 18#endregion
 19
 20#region Code below
 21
 22if(!$oldCreds){
 23 $oldCreds = Get-Credential -Message "Old System"
 24}
 25if(!$newCreds){
 26 $newCreds = Get-Credential -Message "New System"
 27}
 28
 29$oldCluster = Connect-NcController -HTTPS -Credential $oldCreds -Name $oldIP
 30$newCluster = Connect-NcController -HTTPS -Credential $newCreds -Name $newIP
 31
 32$oldClusterName = (Get-NcCluster -Controller $oldCluster).ClusterName
 33$newClusterName = (Get-NcCluster -Controller $newCluster).ClusterName
 34
 35if(!$CredentialTable){
 36 $CredentialTable = @{}
 37}
 38if(!$IPTable){
 39 $IPTable = @{}
 40}
 41if(!$ClusterTable){
 42 $ClusterTable = @{}
 43}
 44
 45if(!($calculatedBlacklist)){
 46 $calculatedBlacklist = @()
 47}
 48
 49$svms.GetEnumerator() | ForEach-Object {
 50
 51 $OldSVM = $_.Old
 52 $NewSVM = $_.New
 53
 54 $OldSVMObj = Get-NcVserver -Name $OldSVM -Controller $oldCluster
 55
 56 # Check if Destination SVM Exists
 57 if(!($NewSVMObj = Get-NcVserver -Name $newSVM -Controller $newCluster)){
 58 Write-Host("Creating new vServer $newSVM on $newClusterName")
 59 $aggr = (Get-NcAggr -Controller $newCluster | Sort-Object -Property Available -Descending)[0].Name
 60 $null = New-NcVserver -Name $NewSVM `
 61 -RootVolumeAggregate $aggr `
 62 -RootVolumeSecurityStyle $oldsvmobj.RootVolumeSecurityStyle `
 63 -Language $oldsvmobj.Language `
 64 -Controller $newCluster
 65 }
 66
 67 # Check if Destination SVM is peered with source vserver
 68 if(!($peerrelationship = Get-NcVserverPeer -Vserver $OldSVM -PeerVserver $NewSVM -Controller $oldCluster -Application "snapmirror")){
 69 Write-Host("Creating new vServer Peer Relationship for $($oldClusterName):$($OldSVM) to $($newClusterName):$($NewSVM)")
 70 $peerrelationship = New-NcVserverPeer -Vserver $OldSVM -PeerVserver $NewSVM -Controller $oldCluster -Application "snapmirror" -PeerCluster $newClusterName
 71 }
 72
 73 # Check if SVM Peer is unitialized
 74 if($peerrelationship.PeerState -eq "initiated"){
 75 Write-Host("Confirming new vServer Peer Relationship for $($oldClusterName):$($OldSVM) to $($newClusterName):$($NewSVM)")
 76 $null = Confirm-NcVserverPeer -Vserver $NewSVM -PeerVserver $OldSVM -Controller $newCluster
 77 }
 78
 79 # Get existing volumes
 80 Write-Host("Getting volumes for $oldSVM on $oldClusterName")
 81 $vols = @()
 82 Get-NcVol -Vserver $OldSVM -Controller $oldCluster | Where-Object { $_.Name -notlike "*root*" } | ForEach-Object {
 83 $vols += @{
 84 Size = $_.TotalSize
 85 Language = $_.VolumeLanguageAttributes.LanguageCode
 86 Name = $_.Name
 87 Security = $_.VolumeSecurityAttributes.Style
 88 }
 89 }
 90
 91 # Run through volumes 
 92 $vols.GetEnumerator() | Where-Object {
 93 ($_.Name -notin $calculatedBlacklist) -and
 94 ($_.Name -notin $volumeBlacklist)
 95 } | ForEach-Object {
 96 # Create new volume if it doesn't exist
 97 $aggr = (Get-NcAggr -Controller $newCluster | Sort-Object -Property Available -Descending)[0].Name
 98 if(!($volume = Get-NcVol -Name $_.Name -Vserver $NewSVM -Controller $newCluster)){
 99 Write-Host("Creating new volume `"$($_.Name)`" for $newSVM on $newClusterName")
100 $null = New-NcVol -Size $_.Size -Name $_.Name -Language $_.Language -SecurityStyle $_.Security -VserverContext $NewSVM -Aggregate $aggr -Type dp -JunctionActive:$false -JunctionPath $null -Controller $newCluster
101 }
102
103 # Create new snapmirror if it doesn't exist
104 if(!($snapmirror = Get-NcSnapmirror -SourceCluster $oldClusterName -SourceVserver $OldSVM -SourceVolume $_.Name -DestinationCluster $newClusterName -DestinationVserver $NewSVM -DestinationVolume $_.Name -Controller $newCluster)){
105 Write-Host("Creating new snapmirror from $($oldClusterName):$($OldSVM):$($_.Name) to $($newClusterName):$($NewSVM):$($_.Name)")
106 $snapmirror = New-NcSnapmirror -SourceCluster $oldClusterName -SourceVserver $OldSVM -SourceVolume $_.Name -DestinationCluster $newClusterName -DestinationVserver $NewSVM -DestinationVolume $_.Name -Schedule "hourly" -Policy "MirrorAllSnapshots" -Controller $newCluster
107 }
108
109 # Initialize new snapmirror if not done yet
110 if(
111 $snapmirror.MirrorState -eq "uninitialized" -and
112 $snapmirror.Status -ne "transferring" -and
113 $snapmirror.Status -ne "finalizing"
114 ){
115 Write-Host("Initializing new snapmirror from $($oldClusterName):$($OldSVM):$($_.Name) to $($newClusterName):$($NewSVM):$($_.Name)")
116 $null = Invoke-NcSnapmirrorInitialize -SourceCluster $oldClusterName -SourceVserver $OldSVM -SourceVolume $_.Name -DestinationCluster $newClusterName -DestinationVserver $NewSVM -DestinationVolume $_.Name -Controller $newCluster
117 }
118
119 if(
120 ($snapmirror.MirrorState -eq "snapmirrored") -and
121 ($snapmirror.status -eq "idle") -and
122 ($snapmirror.IsHealthy) -and
123 ($oldSnapmirror = Get-NcSnapmirror -DestinationCluster $oldClusterName -Destination $_.Name -Controller $oldCluster) -and
124 ($peerVserver = Get-NcVserverPeer -Controller $oldCluster | Where-Object {
125 $_.PeerVserverUuid -eq $oldsnapmirror.SourceVserverUuid -and
126 $_.VserverUuid -eq $oldsnapmirror.DestinationVserverUuid
127 }
128 )
129 ){
130 Write-Host("Found healthy snapmirror for $($oldClusterName):$($OldSVM):$($_.Name), source cluster $($peerVserver.PeerCluster) - ready for cutover.")
131 $peerCluster = $peerVserver.PeerCluster
132 if(!($IPTable[$peerCluster])){
133 $IPTable[$peerCluster] = Read-Host -Prompt "Enter IP for: $peerCluster"
134 }
135 if(!($CredentialTable[$peerCluster])){
136 $CredentialTable[$peerCluster] = Get-Credential -Message "Enter Credentials for: $peerCluster" -UserName "admin"
137 }
138 if(!($ClusterTable[$peerCluster])){
139 $ClusterTable[$peerCluster] = Connect-NcController -HTTPS -Credential $CredentialTable[$peerCluster] -Name $IPTable[$peerCluster]
140 }
141
142 if(Get-NcVol -Name $oldsnapmirror.SourceVolume -Vserver $oldSnapmirror.SourceVserver -Controller $ClusterTable[$peerCluster]){
143 Write-Host("Found healthy snapmirror for $($oldClusterName):$($OldSVM):$($_.Name), source cluster $($peerVserver.PeerCluster) - successfully validated volume on source cluster.")
144 $curVol = $_
145 if(!(Get-NcClusterPeer -Name $peerCluster -Controller $newCluster)){
146 Write-Host -Object "Cluster Peering between $peerCluster and $newClusterName does not exist, please peer first!"
147 break;
148 }
149
150 # Check if Destination SVM is peered with source vserver
151 if(!($peerrelationship = Get-NcVserverPeer -Vserver $peervserver.PeerVserver -PeerVserver $NewSVM -Controller $ClusterTable[$peerCluster] -Application "snapmirror")){
152 Write-Host("Creating new vServer Peer Relationship for $($peerCluster):$($peervserver.PeerVserver) to $($newClusterName):$($NewSVM)")
153 $peerrelationship = New-NcVserverPeer -Vserver $peervserver.PeerVserver -PeerVserver $NewSVM -Controller $ClusterTable[$peerCluster] -Application "snapmirror" -PeerCluster $newClusterName
154 }
155
156 # Check if SVM Peer is unitialized
157 if($peerrelationship.PeerState -eq "initiated"){
158 Write-Host("Confirming vServer Peer Relationship for $($peerCluster):$($peervserver.PeerVserver) to $($newClusterName):$($NewSVM)")
159 $null = Confirm-NcVserverPeer -Vserver $NewSVM -PeerVserver $peervserver.PeerVserver -Controller $newCluster
160 }
161
162 # Stop replicating from source to old cluster
163 ## Quiesce Snapmirror on old cluster from source cluster
164 Write-Host("Quiscing Snapmirror from $($oldsnapmirror.SourceLocation) to $($oldsnapmirror.DestinationLocation)")
165 Invoke-NcSnapmirrorQuiesce -Destination $oldsnapmirror.DestinationLocation -Source $oldsnapmirror.SourceLocation -Controller $oldCluster
166
167 # Break Relationship new cluster to old cluster 
168 ## Quiesce Snapmirror on new cluster from old cluster
169 Write-Host("Quiscing Snapmirror from $($snapmirror.SourceLocation) to $($snapmirror.DestinationLocation)")
170 Invoke-NcSnapmirrorQuiesce -Destination $snapmirror.DestinationLocation -Source $snapmirror.SourceLocation -Controller $newCluster
171
172 ## Break Snapmirror on new cluster from old cluster
173 Write-Host("Break Snapmirror from $($snapmirror.SourceLocation) to $($snapmirror.DestinationLocation)")
174 Invoke-NcSnapmirrorBreak -Destination $snapmirror.DestinationLocation -Source $snapmirror.SourceLocation -Controller $newCluster -Confirm:$false
175
176 ## Delete Snapmirror on new cluster from old cluster
177 Remove-NcSnapmirror -Destination $snapmirror.DestinationLocation -Source $snapmirror.SourceLocation -Controller $newCluster -Confirm:$false
178
179 ## Release Snapmirror on old cluster to new cluster
180 Invoke-NcSnapmirrorRelease -Source $snapmirror.SourceLocation -Destination $snapmirror.DestinationLocation -Controller $oldCluster -Confirm:$false
181
182 # Build Snapmirror to new cluster from source cluster and cleanup
183 ## Create new snapmirror
184 New-NcSnapmirror -Destination $snapmirror.DestinationLocation -Source $oldsnapmirror.SourceLocation -Schedule $oldsnapmirror.Schedule -Policy $oldsnapmirror.Policy -Controller $newCluster -Type $oldsnapmirror.PolicyType
185
186 ## Resync new snapmirror
187 Invoke-NcSnapmirrorResync -Destination $snapmirror.DestinationLocation -Source $oldsnapmirror.SourceLocation -Controller $newCluster -Confirm:$false
188
189 ## Break Snapmirror on old cluster from source cluster
190 Invoke-NcSnapmirrorRelease -Destination $oldsnapmirror.DestinationLocation -Source $oldsnapmirror.SourceLocation -Controller $ClusterTable[$peerCluster] -Confirm:$false
191
192 ## Delete Snapmirror on old cluster from source cluster
193 Remove-NcSnapmirror -Destination $oldsnapmirror.DestinationLocation -Source $oldsnapmirror.SourceLocation -Controller $oldCluster -Confirm:$false
194
195 ## Add Volume to calculated blacklist
196 $calculatedBlacklist += $_.Name
197
198 Start-Sleep -Seconds 15
199 }
200 }
201 }
202}
203
204#endregion

Post and Collaboration Guide

Fri, 20 Aug 2021 00:00:00 +0000

This article offers a quick guide on how to collaborate on the blog and submit / update posts.

Introduction

The system32.blog is powered by a static site generator called Hugo and the Clarity Theme. All content is written in Markdown and hosted on Github which allows anyone to submit posts or collaborate on existing ones.

How to contribute?

To contribute to the block, please fork the repository system32blog/blog and update or add a post under /content/post. If your change is ready in your opinion, please raise a pull request to the preview branch on system32blog/blog.

After raising the pull request, a spellcheck action will check your spelling. If the action fails, please review its' output and correct if required. If there are words that need to be whitelisted, please add them to the wordlist.txt in the repository root and commit them. The pull request will check again.

Scroll down further to see a video which describes the process.

License

Please note that all content you submit will fall under the MIT License. We will remove blog posts based on the authors request, but the content will stay in the Git Revision history.

Preview posts

After your pull request was accepted, you can preview your post on preview.system32.blog. We'll review the formatting there and move it into the master branch.

Posting

To submit a new post, please create a new file under /content/post/ with a meaningful name like whataregrouppolicypreferences.md. The post needs a set of metadata information, please follow this guidance.

Syntax

 1+++
 2title = "Post and Collaboration Guide" <!--- A meaningful title --->
 3date = "2021-08-20" # Date in Format yyyy-MM-dd --->
 4description = "An article describing the process to collaborate on the blog." <!--- A short description for the search engine --->
 5featured = false <!--- Please don't change --->
 6tags = [
 7 "Robin Beismann" <!--- Put yourself as author here, realname, nickname or github username is fine --->
 8]
 9categories = [
10 "blogging" <!--- Categories, please have a look at the existing ones or invent a new one if there is none that fits --->
11]
12series = [""] <!--- If this is a blog series, put a meaningful name here, otherwise leave empty --->
13thumbnail = "images/building.png" <!--- Use one of the thumbnails under /images/ or submit a new one. Please note that you need to have the rights on it. --->
14+++ <!--- This is a separator, please leave in-place --->
15This article offers a quick guide on how to collaborate on the blog and submit / update posts. <!--- The preview line the start page, please leave the next line in-place --->
16<!--more-->
17
18# First heading
19More text to follow

Feel free to check out the formatting on any other post under /content/post/.

Referencing media

If you want to reference pictures or other content in your posts, please submit them under "/static/post/<your post name without extension>". You can then reference them using:

1![describing text](logo_red.png)

How to use Visual Studio Code for Git in a Webbrowser

This animation shows how you can check in posts without any Git Client or Markdown editor on your computer.