[{"content":" IAP in Google Cloud # Google\u0026rsquo;s IAP is phenomonal technology that should be more widely known by those working with GCP.\nSecure access to resources, with no bastion host (or jump box) required.\nThe landing page for IAP documentation is here, https://cloud.google.com/security/products/iap\nNoteworthy highlights being:\nCentralized access control # IAP provides a single point of control for managing user access to web applications and cloud resources.\nWorks with cloud and on-premises apps # IAP can protect access to applications hosted on Google Cloud, other clouds, and on-premises.\nProtects apps and VMs # With TCP forwarding, IAP can protect SSH and RDP access to your VMs hosted on Google Cloud. Your VM instances don\u0026rsquo;t even need public IP addresses.\nCentralized access control IAP provides a single point of control \u0026gt;for managing user access to web \u0026gt;applications and cloud resources.\nWorks with cloud and on-premises apps IAP can protect access to applications hosted on Google Cloud, other clouds, and on-premises. Protects apps and VMs With TCP forwarding, IAP can protect SSH and RDP access to your VMs hosted on Google Cloud. Your VM instances don\u0026rsquo;t even need public IP addresses.\nWhen it comes to using IAP with CloudRun - for some time - setup was slightly more convoluted than one might hope for. Entirely doable, but this was recently simplified.\nSee https://docs.cloud.google.com/run/docs/securing/identity-aware-proxy-cloud-run#console\nIn a nutshell:\nIn the Google Cloud console, go to Cloud Run Select Services from the Cloud Run navigation menu. If you are configuring a new service, click Deploy container and fill out the initial service settings. If you are configuring an existing service, click the service, then click the Security tab. Select Require authentication, then select Identity-Aware Proxy (IAP). Optional: To grant access to users, follow the instructions to Manage user or group access for IAP. If you encounter issues when configuring access for users outside of your organization, see the Troubleshooting section. To save the configuration, click Save. Click Create for a new service. Click View diff \u0026amp; redeploy, then Deploy changes for an existing service. However - for my part - I’ll normally always be working with such matters programmatically whenever possible, so we’d be looking at https://docs.cloud.google.com/run/docs/securing/identity-aware-proxy-cloud-run#gcloud\nIn a very welcome move, Google has also simplified configuring access for external users.\nSee https://docs.cloud.google.com/run/docs/securing/identity-aware-proxy-cloud-run#outside-org\n","date":"7 setembro 2026","externalUrl":null,"permalink":"/posts/2026-09-07-gcp-google-cloud-iap/","section":"Posts","summary":"IAP in Google Cloud # Google’s IAP is phenomonal technology that should be more widely known by those working with GCP.\n","title":"GCP (Google Cloud) IAP","type":"posts"},{"content":"","date":"7 setembro 2026","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":" GCP (Google Cloud): Getting a list of all Projects in a GCP Org (tenant) # When dealing with Google Cloud (GCP), how can we get a list of all existing projects (for example) ? There are a number of good posts out there about this, so I\u0026rsquo;m not presenting anything especially novel here. But - if nothing else - hopefully this will be useful to others, and I\u0026rsquo;m recording it here for posterity.\nPulling GCP IAM information typically means dealing with how GCP effectively uses Projects as a boundary/encapsulation. Which requires a multi-step approach, such as follows:\n# gcloud list all projects in root folder of organization in GCP: gcloud alpha projects search --query=\u0026#34;parent.id=\u0026lt;tenant_ID_Here\u0026#34; gcloud projects list --filter \u0026#39;parent.id=\u0026lt;id_here\u0026gt; \\ AND parent.type=organization\u0026#39; | awk \u0026#39;{print $1 }\u0026#39; \u0026gt; projects.txt And from there, reference the following with something like:\nfor Project in projects.txt; do gcloud projects get-iam-policy Project; done Originally posted December, 2023\n","date":"6 setembro 2026","externalUrl":null,"permalink":"/posts/2026-09-06-gcp-how-to-get-a-list-of-all-projects-in-an-org/","section":"Posts","summary":"GCP (Google Cloud): Getting a list of all Projects in a GCP Org (tenant) # When dealing with Google Cloud (GCP), how can we get a list of all existing projects (for example) ? There are a number of good posts out there about this, so I’m not presenting anything especially novel here. But - if nothing else - hopefully this will be useful to others, and I’m recording it here for posterity.\n","title":"GCP - How do I get a list of all Projects in an Organization ?","type":"posts"},{"content":" Managing Entra/Azure users (immutableID) with Microsoft Graph # When dealing with federated user identities, you\u0026rsquo;ve very likely encountered situations in which a user\u0026rsquo;s ImmutableID needs to be altered.\nA very nice benefit of working with accounts via Microsoft Graph, is you can do so via Powershell (7) for macOS (most things you\u0026rsquo;ll need are available).\nFor that, I strongly recommend downloading via the direct MS link here, https://mnk.li/powershell-for-macOS\nA simple (starting-point) script example is here, https://github.com/illudium/powershell-admin-helper-scripts/blob/main/msgraph_changeImmutableID.ps\nOriginally posted November, 2024\n","date":"7 março 2026","externalUrl":null,"permalink":"/posts/2026-03-07-managing-entra-azure-users-immutableid-with-microsoft-graph/","section":"Posts","summary":"Managing Entra/Azure users (immutableID) with Microsoft Graph # When dealing with federated user identities, you’ve very likely encountered situations in which a user’s ImmutableID needs to be altered.\n","title":"Managing Entra/Azure users (immutableID) with Microsoft Graph","type":"posts"},{"content":" Current Thoughts about Contempoary macOS Security # Original Publication Date: 2024-02-07 # Current Thoughts about Contempoary macOS Security # When it comes to managing Security for macOS in a corporate environment, the first critical requirement is to understand that macOS is not Windows. Of course this is known and understood by all veteran Mac Admins, but it bears repeating for anyone who might have extensive experience handling Security policies and protections for Windows, but is newly tasked with pursing the same for macOS.\nContinuing from the above understanding, it\u0026rsquo;s important to ensure that the proper tools and practices are pursued, for effectively protecting macOS, and avoid any misunderstandings (or worse disasters) that can arise by attempting to treat two very different computer operating systems as the same.\nOne thing that protecting both OSes (macOS and Windows) have in common, is that the best security is a layered approach, and with that in mind: Your first best layer of protection is user awareness and training (Security awareness and best-practices for users).\nIn terms of Security researchers who represent expertise most worthy of your attention, I recommend you devote some time and attention to Patrick Wardle (his website is https://objective-see.org/index.html) and Phil Stokes (his blog is here: https://sqwarq.wordpress.com). Which is not intended to imply any disregard for anyone else ! But please do your own research, and be a particularly careful consumer when it comes to bold statements or claims relating to the security of macOS.\nAn understanding of the native security capabilites of macOS and Apple hardware, should cover at least ASLR, SIP as well as Gatekeeper, Notarization, and XProtect. I recommend further reading listed at the end of this post.\nIn the current day and age (and probably as far back as the last 5-7 years), another critical layer of a meaningful security posture is DNS-level protection/filtering. Common choices here are Netskope, DNSFilter, Cisco Webroot (look for any history of compatibiility issues), and Zscaler amongst others. At a smaller scale, you might care to trial NextDNS.\nIf you\u0026rsquo;re working with Jamf (or not, it\u0026rsquo;s not a requirement), I recommend you look into Jamf Protect (for historical context, read about the past work of Patrick Wardle).\nIn terms of Security Software for macOS, opinions differ greatly here. Some like to believe that nothing more is needed than the native features of the Apple software and hardware. Given the state of the current threat landscape (for technology and online communications), such a perspective is probably overly-confident and probably unduly biased in favor of Apple. That said, in my opinion, many common \u0026ldquo;Anti-Virus\u0026rdquo; offerings don\u0026rsquo;t actually offer anything that specifically protects against the current real-world threats that exist for - and are specific to- macOS. In other words, I\u0026rsquo;m not entirely convinced that many of them accomplish anything \u0026hellip;that is properly or thoroughly effective. Beware of products that appear to \u0026ldquo;check a box\u0026rdquo; (eg when it comes to compliance requirements), and please look carefully into whether the product does provide the intended goal of effectively protecting macOS.\nHowever, so-called \u0026ldquo;Next-Gen\u0026rdquo; security software can indeed provide real, worthwhile protections. Common choices here with cross-platform support are Crowdstrike Falcon https://www.crowdstrike.com/platform/endpoint-security/, and Sentinel One https://www.sentinelone.com If you need to deal with regulatory compliance, I recommend you read Apple\u0026rsquo;s article very nicely directing us to the macOS Security Compliance Project (mSCP)\nJamf also has information here: Enforcing CIS, STIG and More to Meet Auditor Standards Additional considerations should of course include keeping your fleet up to date, which means MDM is a requirement. While I\u0026rsquo;ve mentioned Jamf, other popular choices (also not limited to the MDM exclusively) for macOS are Kandji, Mosyle, Addigy, and SimpleMDM. However, if you\u0026rsquo;re specifically Sys/DevOps (GitOps, CF management) oriented in your practices, you could do well to look at FleetDM, Zentral, or even roll your own with MicroMDM and perhaps AutoPkg, Munki, Chef, Puppet, Salt or Ansible. At this time, while I use Intune extensively with Windows, it would not yet be a first choice for macOS. It might be fine for your needs for iOS Additionally, you should of course choose a trustworthy Identity Provider and configure it appropriately.\nAdditional information about iOS security is available from Apple. Additional further reading from Apple: https://support.apple.com/guide/security/welcome/web, https://www.apple.com/macos/security/ , https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web, as well as https://support.apple.com/guide/security/hardware-security-overview-secf020d1074/1/web/1\n","date":"7 fevereiro 2025","externalUrl":null,"permalink":"/posts/2025-02-07-current-thoughts-about-contemporary-macos-security/","section":"Posts","summary":"Current Thoughts about Contempoary macOS Security # Original Publication Date: 2024-02-07 # Current Thoughts about Contempoary macOS Security # When it comes to managing Security for macOS in a corporate environment, the first critical requirement is to understand that macOS is not Windows. Of course this is known and understood by all veteran Mac Admins, but it bears repeating for anyone who might have extensive experience handling Security policies and protections for Windows, but is newly tasked with pursing the same for macOS.\n","title":"Current Thoughts About Contemporary Macos Security","type":"posts"},{"content":" Managing Adobe updates remotely via Jamf or other MDM # Adobe provides their Remote Update Manager tool, which you can read more about from Adobe\nThere is an excellent script for using Adobe RUM via Jamf, from John Mahlman, here: https://github.com/jmahlman/Mac-Admin-Scripts/blob/master/Adobe-RUMWithProgress-jamfhelper.sh\nOne problem you will encounter with RUM, is that it will download available updates but fail to apply them, when an Adobe app is still running.\nTo handle that gracefully, I suggest the following script snippet (also listed here), which will invoke AppleScript and ask the user quit all running Adobe apps, and prompt them to save any unsaved changes.\n#!/bin/sh #other code here quit_all_adobe_apps () { osascript \u0026lt;\u0026lt;EOF tell application \u0026#34;System Events\u0026#34; set adobeApps to displayed name of (every process whose background only is false and (name starts with \u0026#34;Adobe\u0026#34; or name is \u0026#34;Distiller\u0026#34;)) as list end tell repeat with appName in adobeApps set end of adobeApps to appName end repeat try if adobeApps is not {} then repeat with currentApp in adobeApps if application currentApp is running then try tell application currentApp to activate tell application currentApp to quit end try end if end repeat end if end try EOF } # other code here quit_all_adobe_apps ","date":"20 outubro 2024","externalUrl":null,"permalink":"/posts/2024-10-20-managing-adobe-updates/","section":"Posts","summary":"Managing Adobe updates remotely via Jamf or other MDM # Adobe provides their Remote Update Manager tool, which you can read more about from Adobe\n","title":"Managing Adobe Updates","type":"posts"},{"content":" Microsoft Entra (Azure) discovery # When you face (are tasked with) Azure/Entra discovery or cataloging, and want to work in an efficient manner, be sure to use the following:\nGet-AzResource along with:\nGet-AzSubscription Originally published by me, March 15th, 2024 # ","date":"15 março 2024","externalUrl":null,"permalink":"/posts/2024-03-15-azure-entra-discovery/","section":"Posts","summary":"Microsoft Entra (Azure) discovery # When you face (are tasked with) Azure/Entra discovery or cataloging, and want to work in an efficient manner, be sure to use the following:\n","title":"Azure Entra Discovery","type":"posts"},{"content":" macOS and advanced network commands for managing DNS settings # While MDM is unequivocally a must for managing macOS at (really any) scale, there are times when the core capabilities of MDM won\u0026rsquo;t meet our needs, and a custom scripted approach is required.\nCommands for determining the active network interface and working with DNS server settings: # When we want to programmatically determine the existing primary network interface ID, name and existing DNS servers, there are a few different ways we can go about this:\nserviceGUID=\u0026#34;$(printf \u0026#34;open\\nget State:/Network/Global/IPv4\\nd.show\u0026#34; | /usr/sbin/scutil | /usr/bin/awk \u0026#39;/PrimaryService/{print $3}\u0026#39;)\u0026#34; serviceName=\u0026#34;$(printf \u0026#34;open\\nget Setup:/Network/Service/${serviceGUID}\\nd.show\u0026#34; | /usr/sbin/scutil | /usr/bin/awk -F\u0026#39;: \u0026#39; \u0026#39;/UserDefinedName/{print $2}\u0026#39;)\u0026#34; !!! OR !!!\nactiveIF=$(route -n get 0.0.0.0 2\u0026gt;/dev/null | awk \u0026#39;/interface: / {print $2}\u0026#39;) serviceName=$(networksetup -listnetworkserviceorder | grep \u0026#34;$activeIF\u0026#34; | awk -v FS=\u0026#34;(Hardware Port: |,)\u0026#34; \u0026#39;{print $2}\u0026#39;) The problem with cataloging existing DNS servers, when they are supplied via DHCP # When DNS servers are provisioned via DHCP, a common approach for determining the IP addresses for said servers will fail:\n/usr/sbin/networksetup -getdnsservers \u0026#34;$serviceName\u0026#34; Returns with incorrect info: \u0026ldquo;There aren\u0026rsquo;t any DNS Servers set on \u0026lt;serviceName\u0026gt;\u0026rdquo;\nWhich is hardly useful ! So, we can proceed with the following:\nFor utility and extra tech-type fun, let\u0026rsquo;s use an array !\ncurrDNS=($(/usr/sbin/networksetup -getdnsservers \u0026#34;$serviceName\u0026#34;)) if [[ ${currDNS[0]} == \u0026#34;There\u0026#34; ]]; then currDNS=($(ipconfig getsummary $activeIF | awk -v FS=\u0026#34;({|, |})\u0026#34; \u0026#39;/domain_name_server/ {$1=\u0026#34;\u0026#34;; print $0 }\u0026#39;)) fi # check the array, via # declare -p currDNS # For an example of working with the captured info: # echo ${currDNS[0]} # So now you can capture those existing DNS servers and append another /usr/sbin/networksetup -setdnsservers \u0026#34;$serviceName\u0026#34; ${currDNS[0]} ${currDNS[1]} 8.8.8.8 Originally published by me, Feb 9th, 2024 # ","date":"9 fevereiro 2024","externalUrl":null,"permalink":"/posts/2024-02-09-advanced-macos-commandline-network-management/","section":"Posts","summary":"macOS and advanced network commands for managing DNS settings # While MDM is unequivocally a must for managing macOS at (really any) scale, there are times when the core capabilities of MDM won’t meet our needs, and a custom scripted approach is required.\n","title":"Advanced Macos Commandline Network Management","type":"posts"},{"content":" GCP (Google Cloud): Discovery - collecting, reviewing auditing Projects and IAM # Pulling GCP IAM information typically means dealing with how GCP effectively uses Projects as a boundary/encapsulation.\nStart by listing all projects in the root folder of an organization in GCP:\ngcloud alpha projects search --query=\u0026#34;parent.id=\u0026lt;tenant_ID_Here\u0026#34; AND\ngcloud projects list --filter \u0026#39;parent.id=\u0026lt;id_here\u0026gt; AND parent.type=organization\u0026#39; | awk \u0026#39;{print $1 }\u0026#39; \u0026gt; projects.txt And from there, reference the following with something like\nfor Project in projects.txt; do gcloud projects get-iam-policy Project; done For more information and reference, see https://stackoverflow.com/questions/44746358/how-do-i-list-all-iam-users-for-my-google-cloud-project\nOriginall posted December, 2023\n","date":"15 dezembro 2023","externalUrl":null,"permalink":"/posts/2023-12-15-gcp-googlecloud-iam-project-discovery/","section":"Posts","summary":"GCP (Google Cloud): Discovery - collecting, reviewing auditing Projects and IAM # Pulling GCP IAM information typically means dealing with how GCP effectively uses Projects as a boundary/encapsulation.\n","title":"GCP Google Cloud IAM Project Discovery","type":"posts"},{"content":" IDRAC RED007: UNABLE TO VERIFY UPDATE PACKAGE SIGNATURE # Dell servers provide an iDRAC (\u0026ldquo;Integrated Dell Remote Access Controller\u0026rdquo;) card for remote management of the unit. Note that this feature is a default (with some limited functionality in the \u0026ldquo;express\u0026rdquo; version) in Dell\u0026rsquo;s most entry-level tower server options.\nThere are a number of options for managing updates for Dell servers, including direct access to an iDRAC card, which is configured with a specifed network configuration during initial setup of a/the server in question. Of course, please observe standard best-practices and never provide public accessibility to any such device, keep it behind your perimeter firewall where it (the iDRAC interface) can only be accessed via VPN. Once configured the iDRAC card is readily accessible at its assigned IP address, via a web-browser.\nWhile there may be a tendency to \u0026ldquo;set it and forget it\u0026rdquo; with regards to something like this, there is an expectation to keep the iDRAC updated, and generally within a certain range (for reasons of compatibility if not official support) of associated system BIOS versions. If you are tasked with maintaining a Dell server that\u0026rsquo;s fallen behind in terms of updates, you can encounter an error when attempting to update an iDRAC when jumping up too many versions:\nidrac RED007: Unable to verify Update Package signature\nRemediation # This is most probably due to the existing iDRAC setup lacking required information about newer security (certificate) information for the much newer update installer.\nA confirmed fix is to apply earlier updates to/for the iDRAC in a more step-wise manner: For example, if the card is listed at version 2.3x.(etc), apply the update to 2.40.40.40 then 2.5x, etc. up the latest update. It is often possible to skip one version, but as always, proceed with due care \u0026amp; caution.\nOriginally published by me, January 29, 2019 # ","date":"5 outubro 2023","externalUrl":null,"permalink":"/posts/2023-10-05-idrac-red007-unable-to-verify-update-package-signature/","section":"Posts","summary":"IDRAC RED007: UNABLE TO VERIFY UPDATE PACKAGE SIGNATURE # Dell servers provide an iDRAC (“Integrated Dell Remote Access Controller”) card for remote management of the unit. Note that this feature is a default (with some limited functionality in the “express” version) in Dell’s most entry-level tower server options.\n","title":"Idrac Red007: Unable To Verify Update Package Signature","type":"posts"},{"content":" New items on a fileserver (network fileshare) from one user are missing (don\u0026rsquo;t show up) for other users: # A common occurrence with clients/users on Macs working with a fileserver (network shares) is that when someone else adds new items (files, folders) to network (server-based) sharepoint/folder/drive, other Mac users don\u0026rsquo;t see those new items, they appear to be missing or \u0026ldquo;hidden,\u0026rdquo; but they\u0026rsquo;re not.\n(This is actually a longstanding issue with macOS and the Finder).\n\u0026ndash;\nAn available workaround as remediation: # This is a long-standing issue with (shortcoming of the macOS Finder, in that it\u0026rsquo;s not very good at picking up changes or auto-refreshing in response to underlying changes in a network-based volume. It can happen with OS X Server-based AFP, and various vendors\u0026rsquo; AFP or SMB server-based shares/network folders. One thing we can easily do is create an AppleScript to prompt/prod the Finder to refresh. Save it as an application, store it somewhere safe from accidential deletion (eg: /Library/CompanySupport) and then add it (drag and drop) to the top of a Finder window. Users can click on it to cause a Finder refresh. Optionally, you can add a dialog stating that a refresh is happening.\nThe AppleScript content is below:\ntry tell application \u0026#34;Finder\u0026#34; to update items of front window end try And with a dialog:\ntry tell application \u0026#34;Finder\u0026#34; to update items of front window display dialog \u0026#34;Refreshing the Finder\u0026#34; default button \u0026#34;OK\u0026#34; giving up after 1 end try ","date":"6 maio 2023","externalUrl":null,"permalink":"/posts/2023-05-06-new-items-on-a-fileserver/","section":"Posts","summary":"New items on a fileserver (network fileshare) from one user are missing (don’t show up) for other users: # A common occurrence with clients/users on Macs working with a fileserver (network shares) is that when someone else adds new items (files, folders) to network (server-based) sharepoint/folder/drive, other Mac users don’t see those new items, they appear to be missing or “hidden,” but they’re not.\n","title":"New Items On A Fileserver","type":"posts"},{"content":" macOS and the continuing saga of softwareupdate (software update) being \u0026ldquo;frozen\u0026rdquo; or not working, no updates listed # There is a well-known issue with macOS in which a Mac does not show available software updates. This has been occurring since the time of macOS Big Sur - aka \u0026ldquo;macOS \u0026lsquo;(this one) goes to\u0026rsquo; 11\u0026rdquo;\nInvestigating further # If you look at the running processes, you may see an existing softwareudpated process listed, which might have been active for some time.\nManually launching Software Update (in the GUI) or using the softwareudpate command, will simply sit without returning anything about available updates.\nRemediation # To get past this, I have found the following helpful and the steps do not require a reboot:\nRun the following via the Terminal (or remotely via ssh): sudo /bin/launchctl disable system/com.apple.softwareupdated\nThen wait several seconds, and run: sudo /bin/launchctl enable system/com.apple.softwareupdated\nWait several more seconds. Note, the following should be (technically speaking) redundant and unnecessary, but think of it as one more \u0026ldquo;kick\u0026rdquo; to help get things working again:\nsudo /bin/launchctl kickstart -k system/com.apple.softwareupdated\nAnd - hopefully - you\u0026rsquo;ll find the problem resolved, as I have so far.\nOriginally published by me, March 17th, 2022 # ","date":"25 janeiro 2023","externalUrl":null,"permalink":"/posts/2023-01-25-macos-and-the-continuing-saga-of-softwareupdate/","section":"Posts","summary":"macOS and the continuing saga of softwareupdate (software update) being “frozen” or not working, no updates listed # There is a well-known issue with macOS in which a Mac does not show available software updates. This has been occurring since the time of macOS Big Sur - aka “macOS ‘(this one) goes to’ 11”\n","title":"Macos And The Continuing Saga Of Softwareupdate","type":"posts"},{"content":"","externalUrl":null,"permalink":"/pt-br/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/pt-br/","section":"Blowfish","summary":"","title":"Blowfish","type":"page"},{"content":"","externalUrl":null,"permalink":"/pt-br/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","externalUrl":null,"permalink":"/pt-br/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","externalUrl":null,"permalink":"/pt-br/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"}]