PhoeNIXBird Networks https://www.pbnet.ro Reality is changing Fri, 02 Jan 2026 19:59:24 +0000 en-US hourly 1 2475499 [LINUX] Create your own IP Radio Station https://www.pbnet.ro/?p=368987 Fri, 02 Jan 2026 19:51:14 +0000 https://www.pbnet.ro/?p=368987 [...]]]> OK, so the idea of this post is to create a self-hosted low-bandwidth radio station, that can even work on 33.6Kbps modems.

So, let’s start with:

  1. Hardware

1 x vCPU

2 GB of RAM

128 GB Storage

2. Software and configs

  • OS: Ubuntu Server 24.04.3 LTS
  • IceCast

sudo apt update
sudo apt -y upgrade
sudo apt install -y icecast2

  • enable IceCast daemon

sudo nano /etc/default/icecast2

ENABLE=true

  • verify settings on IceCast’s main config file

sudo nano /etc/icecast2/icecast.xml

  • Start Icecast + enable on boot

sudo systemctl enable –now icecast2
sudo systemctl status icecast2 –no-pager

 

  • Open the IceCast web page

From your PC browser:

http://YOUR_SERVER_IP:8000/

Admin page:

http://YOUR_SERVER_IP:8000/admin/

user: admin

password: whatever you set as <admin-password>

  • Create the music folder + IceCast user

sudo adduser –system –group –no-create-home icecast

sudo mkdir -p /srv/radio/music
sudo chown -R icecast:icecast /srv/radio

sudo systemctl restart icecast2

  • Install Liquidsoap

sudo apt update
sudo apt install -y liquidsoap

Test install using: liquidsoap –version

  • Create the Radio script

sudo nano /srv/radio/radio.liq

Config sample:

 

set(“log.stdout”, true)
set(“log.level”, 3)

# Folder-based playlist
music = playlist(
“/srv/radio/music”,
mode=”random”,
reload=10
)

# Output to Icecast (dial-up safe)
output.icecast(
%mp3(
bitrate=24,
samplerate=22050,
stereo=false
),
host=”localhost”,
port=8000,
password=”SOURCE_PASSWORD_HERE”,
mount=”/low.mp3″,
music
)

You can test the config manually: liquidsoap /srv/radio/radio.liq and you should see an output like:

Connecting mount /low.mp3
Source connected

Add / remove music (live, no restart)

Just copy files into:

/srv/radio/music

  • Run Liquidsoap automatically (systemd service)

sudo nano /etc/systemd/system/radio.service

[Unit]
Description=Icecast Radio (Liquidsoap)
After=network-online.target icecast2.service
Wants=network-online.target

[Service]
User=icecast
Group=icecast
ExecStart=/usr/bin/liquidsoap /srv/radio/radio.liq
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

 

Then enable it using:

sudo systemctl daemon-reload
sudo systemctl enable –now radio.service

 

  • Confirm the stream is LIVE on Icecast

curl -I http://127.0.0.1:8000/low.mp3

You want to see HTTP/1.0 200 OK (or 200).

From your PC:

Open: http://YOUR_SERVER_IP:8000/low.mp3 in VLC or browser.

 

  • Install an HTML audio player page

sudo apt install -y apache2
sudo ufw allow 80/tcp

 

sudo nano /var/www/html/player.html

 

<!doctype html>
<html>
<head>
<meta charset=”utf-8″>
<title>DialRadio</title>
</head>
<body>
<h1>DialRadio (24 kbps)</h1>

<audio controls preload=”none”>
<source src=”http://VM_LAN_IP:8000/low.mp3″ type=”audio/mpeg”>
Your browser does not support audio.
</audio>

<p>Click ▶ Play to start the stream.</p>
</body>
</html>

  • Apache Redirects

Goal: to redirect from: http://<your server IP> to: http://<your server IP>/player.html

 

sudo nano /etc/apache2/sites-available/000-default.conf

Inside <VirtualHost *:80>, add:

RedirectMatch ^/$ /player.html

Example:

<VirtualHost *:80>
DocumentRoot /var/www/html

RedirectMatch ^/$ /player.html
</VirtualHost>

Save and restart:

sudo systemctl restart apache2

Now enjoy listening to your own radio station by accessing: http://<your server IP> !

 

 

 

 

 

 

]]> 368987 [PnP/CSOM] – Reprovision SiteAssets library in SPO https://www.pbnet.ro/?p=360892 Mon, 01 Sep 2025 11:01:18 +0000 https://www.pbnet.ro/?p=360892 [...]]]> OK, so here are several ways to re-provision the SiteAssets library on a SharePoint online site collection:

Using PnP:

Connect-PnPOnline -Url https://pbnet.sharepoint.com/teams/ASSETS1 `
  -ClientId "dfbd77ff-be64-XXX-XXX-17a62a02fd29" `
  -Tenant "pbnet.onmicrosoft.com" `
  -CertificatePath "C:\SPOPNP\pnpappcert.pfx" `
  -CertificatePassword (ConvertTo-SecureString "XXXXXXXXXX" -AsPlainText -Force)

$Web = Get-PnPWeb
$Web.Lists.EnsureSiteAssetsLibrary()
Invoke-PnPQuery

Using CSOM (no MFA):

Add-Type -Path "C:\CSOM\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\CSOM\Microsoft.SharePoint.Client.Runtime.dll"
 
 
# SharePoint site and credentials
$siteUrl = "https://a830edad9050849testasset.sharepoint.com/sites/SITEASSETS1"
$username = "admin@a830edad9050849testasset.onmicrosoft.com"
 
# Get credentials
$securePassword = Read-Host -Prompt "Enter your password" -AsSecureString
$credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $securePassword)
 
# Connect to SharePoint
$context = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl)
$context.Credentials = $credentials
 
# Get the list and root folder
$t = $context.Web.Lists.EnsureSiteAssetsLibrary()
$context.Load($t)
 
$context.ExecuteQuery()

Using CSOM with MFA (you can use my DLL set from: https://www.pbnet.ro/tools_dl/CSOM-27JAN2020.zip

#Loading Assemblies
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.SharePoint.Client.dll")
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.SharePoint.Client.Runtime.dll")
[System.Reflection.Assembly]::LoadFile("C:\CSOM\\Microsoft.SharePoint.Client.Publishing.dll")
#download https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/3.19.8 
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.IdentityModel.Clients.ActiveDirectory.dll")
#download https://www.nuget.org/packages/SharePointPnPCoreOnline/3.26.2010
[System.Reflection.Assembly]::LoadFile("C:\CSOM\OfficeDevPnP.Core.dll")

$siteURL="https://pbnet.sharepoint.com/teams/ASSETS1"
 $authManager = new-object OfficeDevPnP.Core.AuthenticationManager;
$context = $authManager.GetWebLoginClientContext($siteUrl);

# Get the list and root folder
$t = $context.Web.Lists.EnsureSiteAssetsLibrary()
$context.Load($t)
 
$context.ExecuteQuery()

Or, another way to re-provision the Assets library would be by Enabling the WikiPageHomePage feature on the site collection

Using PnP:

#Disable WikiPageHomePage
Disable-PnPFeature -Identity 00bfea71-d8fe-4fec-8dad-01c19a6e4053
#Enable WikiPageHomePage
Enable-PnPFeature -Identity 00bfea71-d8fe-4fec-8dad-01c19a6e4053

Enjoy!

 

]]> 360892 [LINUX] Remote Login using Apache Guacamole https://www.pbnet.ro/?p=360380 Mon, 25 Aug 2025 06:52:50 +0000 https://www.pbnet.ro/?p=360380 [...]]]> Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH.

It is clientless because no plugins or client software are required.

Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser.

Below I’m going to discuss how to install Guacamole and it’s TOTP module (aka login with 2FA) on Ubuntu 24.04.3 LTS.

Understanding the pieces:

guacamole-server (aka guacd) = native daemon that speaks RDP/VNC/SSH, must be built from source.

guacamole web app = a .war deployed to Tomcat (we’ll use Tomcat 9).

Auth = we’ll use MariaDB (JDBC extension).
Guacamole 1.6.0 provides the WAR + JDBC extension prebuilt; only guacamole-server is compiled.

Packages & build dependencies

sudo apt update
sudo apt install -y build-essential autoconf automake libtool-bin \
  libcairo2-dev libjpeg-turbo8-dev libpng-dev uuid-dev libssl-dev \
  libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
  libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev \
  libwebsockets-dev libpulse-dev libvorbis-dev libwebp-dev \
  freerdp3-dev wget curl fonts-dejavu-core

Build and start guacd (guacamole-server 1.6.0)

cd /usr/src
sudo wget https://downloads.apache.org/guacamole/1.6.0/source/guacamole-server-1.6.0.tar.gz
sudo tar xzf guacamole-server-1.6.0.tar.gz
cd guacamole-server-1.6.0

# The systemd dir below is correct for Ubuntu; the FreeRDP flag keeps things lenient.
sudo ./configure --with-systemd-dir=/etc/systemd/system --enable-allow-freerdp-snapshots
sudo make -j"$(nproc)"
sudo make install
sudo ldconfig

# Register and start the service
sudo systemctl daemon-reload
sudo systemctl enable --now guacd
systemctl status guacd --no-pager

Install Java and Tomcat 9 (not Tomcat 10)

Note: Guacamole 1.x targets the javax servlet APIs (Tomcat 9). Tomcat 10 switched to jakarta and isn’t supported yet.

# Java (LTS)
sudo apt install -y openjdk-17-jdk

# Create a dedicated tomcat user
sudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat

# Download &amp; install Tomcat 9 (set the latest 9.0.x available)
TOMCAT_VER=9.0.108
cd /tmp
wget https://dlcdn.apache.org/tomcat/tomcat-9/v${TOMCAT_VER}/bin/apache-tomcat-${TOMCAT_VER}.tar.gz
sudo mkdir -p /opt/tomcat
sudo tar xzf apache-tomcat-${TOMCAT_VER}.tar.gz -C /opt/tomcat --strip-components=1
sudo chown -R tomcat:tomcat /opt/tomcat

# Tell Tomcat where GUACAMOLE_HOME lives
sudo bash -c 'cat &gt;/opt/tomcat/bin/setenv.sh &lt;&lt;EOF
export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
export GUACAMOLE_HOME=/etc/guacamole
EOF'
sudo chmod +x /opt/tomcat/bin/setenv.sh

# Systemd unit for Tomcat 9
sudo tee /etc/systemd/system/tomcat.service &gt;/dev/null &lt;&lt;'EOF'
[Unit]
Description=Apache Tomcat 9
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat
UMask=0007
Environment=CATALINA_BASE=/opt/tomcat
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid
ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
systemctl status tomcat --no-pager

Prepare GUACAMOLE_HOME and deploy the 1.6.0 WAR

# Config directories used by Guacamole/Tomcat
sudo mkdir -p /etc/guacamole/{extensions,lib}

# Basic properties so the webapp can reach guacd
sudo tee /etc/guacamole/guacamole.properties &gt;/dev/null &lt;&lt;'EOF'
guacd-hostname: 127.0.0.1
guacd-port: 4822
EOF

# Deploy the 1.6.0 web app
sudo wget -O /opt/tomcat/webapps/guacamole.war \
  https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-1.6.0.war

# Restart Tomcat to unpack the WAR
sudo systemctl restart tomcat

Install MariaDB and the JDBC auth extension

# DB server
sudo apt install -y mariadb-server

# Create DB and user (change the password!)
DB_PASS='ChangeMe_Secure!'
sudo mysql -e "CREATE DATABASE guacamole_db DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY '${DB_PASS}';"
sudo mysql -e "GRANT ALL PRIVILEGES ON guacamole_db.* TO 'guacamole_user'@'localhost'; FLUSH PRIVILEGES;"

# JDBC extension (MySQL/MariaDB flavor)
cd /usr/src
sudo wget https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-auth-jdbc-1.6.0.tar.gz
sudo tar xzf guacamole-auth-jdbc-1.6.0.tar.gz
sudo cp guacamole-auth-jdbc-1.6.0/mysql/guacamole-auth-jdbc-mysql-1.6.0.jar /etc/guacamole/extensions/

# Initialize the schema
cd guacamole-auth-jdbc-1.6.0/mysql
sudo bash -lc "cat schema/*.sql | mysql -u root guacamole_db"

# JDBC driver (Connector/J 8.4 LTS JAR)
sudo wget -O /etc/guacamole/lib/mysql-connector-j-8.4.0.jar \
  https://repo1.maven.org/maven2/com/mysql/mysql-connector-j/8.4.0/mysql-connector-j-8.4.0.jar

# Point Guacamole at the database
sudo tee -a /etc/guacamole/guacamole.properties &gt;/dev/null &lt;&lt;EOF

# --- JDBC auth (MariaDB/MySQL) ---
mysql-hostname: 127.0.0.1
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: ${DB_PASS}
# Explicit driver class for Connector/J 8+
mysql-driver: com.mysql.cj.jdbc.Driver
EOF

# Bounce services
sudo systemctl restart guacd tomcat

Log in and secure it

  • rowse to: http://<server>:8080/guacamole

  • Default admin (created by the schema): guacadmin / guacadmin → change it immediately (Settings → Preferences), then create your own admin and delete guacadmin.

Now, let’s install and the TOTP Module:

Download + verify (from Apache archive)

cd /tmp
curl -fL -o guacamole-auth-totp-1.6.0.tar.gz \
  https://archive.apache.org/dist/guacamole/1.6.0/binary/guacamole-auth-totp-1.6.0.tar.gz
curl -fsSL -o guacamole-auth-totp-1.6.0.tar.gz.sha256 \
  https://archive.apache.org/dist/guacamole/1.6.0/binary/guacamole-auth-totp-1.6.0.tar.gz.sha256

# must say: “guacamole-auth-totp-1.6.0.tar.gz: OK”
sha256sum -c guacamole-auth-totp-1.6.0.tar.gz.sha256

Install the extension jar

tar -xzf guacamole-auth-totp-1.6.0.tar.gz
sudo install -D -m 0644 guacamole-auth-totp-1.6.0/guacamole-auth-totp-1.6.0.jar \
  /etc/guacamole/extensions/guacamole-auth-totp-1.6.0.jar

ls -l /etc/guacamole/extensions

Restart Tomcat (not guacd) and check logs

sudo systemctl restart tomcat
# Confirm GUACAMOLE_HOME and TOTP load:
grep -i 'GUACAMOLE_HOME is' /opt/tomcat/logs/catalina.out | tail -n1
egrep -i 'Extension "TOTP Authentication"|totp' /opt/tomcat/logs/catalina.out | tail -n2

If it loaded, you’ll see something like:

Extension “TOTP Authentication” (totp) loaded.

 

Enjoy!

]]> 360380 [SPO/PNP] Connect to SharePoint online using PNP and a self-signed certificate https://www.pbnet.ro/?p=356933 Wed, 21 May 2025 09:38:25 +0000 https://www.pbnet.ro/?p=356933 [...]]]> Since the 3.0.x version of the PNP module, you don’t have the -UseWebLogin switch anymore when using Connect-PnPOnline.

So, let’s connect using a self-signed certificate instead.

Here’s how to do it:

  1. Create a self-signed certificate:

Note: you need to have the PNP.PowerShell module installed before running the below cmdlets. 

$cert = New-PnPAzureCertificate -OutPfx pnpappcert.pfx -OutCert pnpappcert.cer -CertificatePassword (ConvertTo-SecureString -String "YourStrongPassword" -AsPlainText -Force)

This command creates:

pnpappcert.pfx: the private certificate used by your script

pnpappcert.cer: the public certificate to upload to Entra ID

Note: The password is required later to use the .pfx

 

2. Register an app in Entra ID 

  • Go to: https://entra.microsoft.com
  • Navigate to “App registrations” > “New registration”

Fill in:

Name: PnPApp

Supported account types: Single tenant is OK

Redirect URI: Leave blank for now

Click Register

 

3. Upload the Public Certificate to the App

 

In the app registration panel:

Go to Certificates & secrets

Choose Certificates (Upload) → Upload pnpappcert.cer

 

4. Assign API Permissions

 

  • In the app registration:

    • Go to API permissions

    • Click Add a permission

    • Choose SharePoint > Application permissions

    • Check:

      • Sites.Read.All

      • Sites.FullControl.All (if needed)

    • Click Add permissions

  • Then click Grant admin consent

Note: you can grant additional permissions. Here’s a screenshot of what I used:

App Permissions

 

5. Connect using you certificate and APPId

 

Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/yoursite" `
  -ClientId "YOUR-APP-ID" `
  -Tenant "yourtenant.onmicrosoft.com" `
  -CertificatePath "C:\Path\To\pnpappcert.pfx" `
  -CertificatePassword (ConvertTo-SecureString "YourStrongPassword" -AsPlainText -Force)

Enjoy!

 

 

 

 

]]> 356933 [LINUX] WHOIS server retirement https://www.pbnet.ro/?p=356778 Thu, 15 May 2025 15:50:19 +0000 https://www.pbnet.ro/?p=356778 [...]]]> So, if you’re using the WHOIS command under linux (E.g whois rachita.net), you will probably get some notice like:
**NOTICE** This WHOIS server is being retired. Please use our RDAP service instead.

In a nutshell, this is why it happens:

The long-standing WHOIS system for looking up domain name registration details is coming to an end. Starting January 28, 2025, ICANN will officially replace WHOIS with the Registration Data Access Protocol (RDAP). But don’t worry—this change isn’t happening overnight, and most users won’t notice any immediate disruptions.

RDAP is a modern alternative to WHOIS that offers several improvements:

  • better security: it provides more controlled access to domain registration data.
  • international support: unlike WHOIS, RDAP supports multiple languages and character sets.
  • structured data: it delivers information in a standardized format, making it easier to process.
  • more control over data: RDAP allows differentiated access, meaning some users (like law enforcement) may see more details than the general public.

ICANN-accredited registrars and gTLDs have already supported RDAP since 2019, so the transition has been in the works for a while.

Source: https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en

So let’s use the RDAP service.

You will need a RDAP client. Here’s how to install it:

Requirements

  • Ubuntu/Debian-based system

  • git

  • golang (Go language compiler)

 

Step-by-Step Installation

🔹 1. Install Go and Git

sudo apt update
sudo apt install golang-go git -y

📝 This installs Go from Ubuntu repositories. For newer versions, visit: https://go.dev/dl

🔹 2. Clone the OpenRDAP repository

cd ~
git clone https://github.com/openrdap/rdap.git

🔹 3. Navigate to the RDAP CLI source folder

cd ~/rdap/cmd/rdap

Check that main.go is present:

ls main.go

🔹 4. Build the rdap binary

go build -o rdap

You should now have a binary file named rdap.

Check it’s a proper Linux binary:

file rdap

Expected output:

rdap: ELF 64-bit LSB executable, x86-64 ...

🔹 5. Move the binary to your PATH

sudo mv rdap /usr/local/bin/
sudo chmod +x /usr/local/bin/rdap

🔹 6. Test the RDAP client

rdap 8.8.8.8
rdap example.com
The output should look like this:
IP Network:
  Handle: NET-8-8-8-0-2
  Start Address: 8.8.8.0
  End Address: 8.8.8.255
  IP Version: v4
  Name: GOGL
  Type: DIRECT ALLOCATION
  ParentHandle: NET-8-0-0-0-0
  Status: active
  Port43: whois.arin.net
  Notice:
    Title: Terms of Service
    Description: By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use
    Link: https://www.arin.net/resources/registry/whois/tou/
  Notice:
    Title: Whois Inaccuracy Reporting
    Description: If you see inaccuracies in the results, please visit:
    Link: https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
  Notice:
    Title: Copyright Notice
    Description: Copyright 1997-2025, American Registry for Internet Numbers, Ltd.
  Entity:
    Handle: GOGL
    Port43: whois.arin.net
    Remark:
      Title: Registration Comments
      Description: Please note that the recommended way to file abuse complaints are located in the following links.
      Description: To report abuse and illegal activity: https://www.google.com/contact/
      Description: For legal requests: http://support.google.com/legal
      Description: Regards,
      Description: The Google Team
    Link: https://rdap.arin.net/registry/entity/GOGL
    Link: https://whois.arin.net/rest/org/GOGL
    Event:
      Action: last changed
      Date: 2019-10-31T15:45:45-04:00
    Event:
      Action: registration
      Date: 2000-03-30T00:00:00-05:00
    Role: registrant
    vCard version: 4.0
    vCard fn: Google LLC
    vCard kind: org
    Entity:
      Handle: ABUSE5250-ARIN
      Status: validated
      Port43: whois.arin.net
      Remark:
        Title: Registration Comments
        Description: Please note that the recommended way to file abuse complaints are located in the following links.
        Description: To report abuse and illegal activity: https://www.google.com/contact/
        Description: For legal requests: http://support.google.com/legal
        Description: Regards,
        Description: The Google Team
      Link: https://rdap.arin.net/registry/entity/ABUSE5250-ARIN
      Link: https://whois.arin.net/rest/poc/ABUSE5250-ARIN
      Event:
        Action: last changed
        Date: 2024-08-01T17:54:23-04:00
      Event:
        Action: registration
        Date: 2015-11-06T15:36:35-05:00
      Role: abuse
      vCard version: 4.0
      vCard fn: Abuse
      vCard org: Abuse
      vCard kind: group
      vCard email: network-abuse@google.com
      vCard tel: +1-650-253-0000
    Entity:
      Handle: ZG39-ARIN
      Status: validated
      Port43: whois.arin.net
      Link: https://rdap.arin.net/registry/entity/ZG39-ARIN
      Link: https://whois.arin.net/rest/poc/ZG39-ARIN
      Event:
        Action: last changed
        Date: 2024-11-11T04:27:09-05:00
      Event:
        Action: registration
        Date: 2000-11-30T13:54:08-05:00
      Role: administrative
      Role: technical
      vCard version: 4.0
      vCard fn: Google LLC
      vCard org: Google LLC
      vCard kind: group
      vCard email: arin-contact@google.com
      vCard tel: +1-650-253-0000
  Link: https://rdap.arin.net/registry/ip/8.8.8.0
  Link: https://whois.arin.net/rest/net/NET-8-8-8-0-2
  Event:
    Action: last changed
    Date: 2023-12-28T17:24:56-05:00
  Event:
    Action: registration
    Date: 2023-12-28T17:24:33-05:00
  cidr0_cidrs:
    v4prefix: 8.8.8.0
    length: 24

Enjoy!

 

 

]]> 356778 [SPO] Remove retention tags for all the items (folders included) in a document library https://www.pbnet.ro/?p=356077 Mon, 14 Apr 2025 12:51:39 +0000 https://www.pbnet.ro/?p=356077 If you tagged all your files/folders in a document library with a retention label/tag, here’s a quick way to remove them via PnP:

Connect-PnPOnline -Url https://mngenvmcap495437.sharepoint.com/sites/RETENTION-TEST1 -UseWebLogin
$items = Get-PnPListItem -List "Documents"

foreach ($item in $items)

{

     Set-PnPListItem -Identity $item.Id -List "Documents" -ClearLabel

}

Enjoy!

]]> 356077 [SPO] Get the filename, filetype and path from a SharePoint shared link URL https://www.pbnet.ro/?p=355555 Thu, 20 Mar 2025 16:35:32 +0000 https://www.pbnet.ro/?p=355555 [...]]]> OK, so the scenario goes like this:

  • You go to a SharePoint document library, click on the ellipsis next to a file and select “Copy Link”

  • you will get a URL like: https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh

OK, now for the funny part, how can you know from that URL, what the file name is and where it is located.

If you use my tool: https://whois.pbnet.ro/SPOLINKDECODER/ you can already get some basic information like:

For more information about the tool and what’s its logic, please see my GitHub page: https://github.com/pbnet/SharePointSharedLinkDecoder

Now here’s how to get way more information:

1. Ensure that you have the Files.ReadWrite.All permission

2. Encode your URL in Base64 using the following PowerShell script:

$sharingUrl = "https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh"
$base64Value = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sharingUrl))
$encodedUrl = "u!" + $base64Value.TrimEnd("=").Replace("/", "_").Replace("+", "-")
Write-Host $encodedUrl

The result will be something like: u!aHR0cHM6Ly9wYm5ldC5zaGFyZXBvaW50LmNvbS86Yjovcy9CTEFCTEExL0VYWkQ0blFFUUVwTHYycFBsLWJ0Wm5rQjNGcktVWWJQN2pYQ0V2ZWVZX1dmWUE_ZT1oSkNjV2g

3. Go to Graph Explorer at: https://developer.microsoft.com/en-us/graph/graph-explorer

The syntax of the URL should be like:

https://graph.microsoft.com/v1.0/shares/<base64 shared link from PowerShell Script>/driveItem?$expand=children

So the final URL is like: https://graph.microsoft.com/v1.0/shares/u!aHR0cHM6Ly9wYm5ldC5zaGFyZXBvaW50LmNvbS86Yjovcy9CTEFCTEExL0VYWkQ0blFFUUVwTHYycFBsLWJ0Wm5rQjNGcktVWWJQN2pYQ0V2ZWVZX1dmWUE_ZT1oSkNjV2g/driveItem?$expand=children

And there you go… you have the weburl, name of the file and name of the library:

  • If you want to do this with Graph PowerShell and get the name of the file, the logic is similar to the script below:

Import-Module Microsoft.Graph.Files
Connect-MgGraph -Scopes "Files.ReadWrite.All"


# Set the sharing URL
$sharingUrl = "https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh"
$base64Value = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sharingUrl))
$encodedUrl = "u!" + $base64Value.TrimEnd("=").Replace("/", "_").Replace("+", "-")

# Construct the Graph API request URL
$requestUrl = "https://graph.microsoft.com/v1.0/shares/$encodedUrl/driveItem?$expand=children"


$response=Get-MgShareDriveItem -SharedDriveItemId $encodedUrl -ExpandProperty "children"

# Output the file details
$response | Format-List

The PowerShell output will be similar to:

Enjoy!

 

]]> 355555 [SPO] Enable default sensitivity labels in SharePoint online https://www.pbnet.ro/?p=355258 Thu, 06 Mar 2025 08:24:43 +0000 https://www.pbnet.ro/?p=355258 [...]]]> So, here goes:

# Define the variables for your enviroment. The first one is the link to your SharePoint Admin Portal. The second one is your administrator account User Principal Name
 
$SPAdminLink = "https://tenant-admin.sharepoint.com"
$AdminUPN = "user@domain.com"
 
# Connect to SharePoint. Replace the link with your SharePoint Admin portal
# you need to have run install-module -name Microsoft.Online.SharePoint.PowerShell to have the module installed. 
 
Connect-SPOService -Url $SPAdminLink
 
# Enable AIP Integration
 
Set-SPOTenant -EnableAIPIntegration $true
(Get-SPOTenant).EnableAIPIntegration
 
# Enable support for PDFs. Update SP Online Module if this fails. The link is https://www.microsoft.com/en-us/download/details.aspx?id=35588
 
Set-SPOTenant -EnableSensitivityLabelforPDF $true
(Get-SPOTenant).EnableSensitivityLabelforPDF
 
# Connect to AAD and enable support for labels in groups. Source: https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide
 
Install-Module AzureADPreview
AzureADPreview\Connect-AzureAD
 
$grpUnifiedSetting = (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ)
$Setting = $grpUnifiedSetting
 
# Check if EnableMIPLabels is enabled. If nothing is displayed then you have no group settings. We'll enable it. 
 
$grpUnifiedSetting.Values
 
# Enable the feature. If it fails check out this guide: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-settings-cmdlets#create-settings-at-the-directory-level
 
$Setting["EnableMIPLabels"] = "True"
 
# Check that now it's enabled. If it's enabled you'll get
#
#Name                            Value
#----                            -----
#EnableMIPLabels                 True
 
$Setting.Values                                                                                                                                                                                                    
 
# Save 
 
Set-AzureADDirectorySetting -Id $grpUnifiedSetting.Id -DirectorySetting $Setting
 
# Now we'll import ExchangeOnlineManagement and then connect the Compliance Powershell to sync the labels
 
#You might have problems running the below part in PowerShell ISE. If you do, run them in a normal PowerShell session
#Also, ensure you have the module installed with Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName $AdminUPN
Execute-AzureAdLabelSync

Create and publish your label, then wait around 24h to have everything propagated.

If you get any error with the following cmdlet: $grpUnifiedSetting = (Get-AzureADDirectorySetting | where -Property DisplayName -Value “Group.Unified” -EQ) follow the steps in this article: Configure group settings using PowerShell – Microsoft Entra ID | Microsoft Learn

Hint:

Connect-MgGraph -TenantId 0f2434f0-d209-4e5f-9536-2bfb2dd9c2b7 -Scopes Directory.ReadWrite.All

You can get the tenantID from Entra

 

Enjoy!

 

]]> 355258 [NETWORK] 2000’s style ISP with the cisco uBR u7114 https://www.pbnet.ro/?p=354216 Thu, 16 Jan 2025 08:12:52 +0000 https://www.pbnet.ro/?p=354216 [...]]]> Following the dial-up Internet access, here is how to do it using a CMTS (Cable Modem Termination System) and a DOCSIS 1.x modem.

Pre-requisites:

  • 1XCMTS – in this example we will use a Cisco UBR 7114, since this model has an RF upconverter included, so we won’t need additional hardware on the CMTS. More info about the uBR7100 series here
  • Since the cable modem only has one RF interface, we will need a DOCSIS compliant Diplex filter. I used the Televes CoaxData 1Gbps TV-Data diplexer filter 2-68 MHz/87-2150MHz.

Televes Diplex

  • Since the signal is pretty strong and can damage the cable modem, I used 4X20dB attenuators on the cable connecting the OUT port of the Diplex Filter and the RF in port on the cable modem.
  • One DOCSIS 1.x compliant cable modem. I used the Thomson TCM420

CM Thompson

  • 3 Coax cables with F-male connectors on both ends.

 

Now that we have all the hardware, we have to connect the F cables to: DS0 RF and US0 on the 7114 CMTS. Both cables will go to the diplex filter.

DS0 to the 87-2150 port and US0 to the 2MHz-68MHz port. The cable modem will be connected on the center port of the diplex filter after adding the 4x20dB attenuators.

Note: the Internet link will be provided via the 100Mbps FE port on the CMTS.

Now for the config file on the CMTS, here is a sample:

!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service udp-small-servers max-servers no-limit
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no cable qos permission create
no cable qos permission update
cable qos permission modems
cable time-server
!
cable config-file platinum.cm
 service-class 1 max-upstream 128
 service-class 1 guaranteed-upstream 10
 service-class 1 max-downstream 10000
 service-class 1 max-burst 1600
 cpe max 8
 timestamp
!
no aaa new-model
ip subnet-zero
!
!
ip cef
no ip domain lookup
ip dhcp excluded-address 10.128.1.1 10.128.1.15
ip dhcp excluded-address 10.254.1.1 10.254.1.15
ip dhcp ping packets 1
!
ip dhcp pool CableModems
   network 10.128.1.0 255.255.255.0
   bootfile platinum.cm
   next-server 10.128.1.1 
   default-router 10.128.1.1 
   option 128 ip 10.128.1.1 
   option 4 ip 10.128.1.1 
   option 2 hex ffff.8f80
   option 11 ip 10.128.1.1 
   option 10 ip 10.128.1.1 
   dns-server 8.8.8.8 
   lease 1 0 10
!
ip dhcp pool hosts
   network 10.254.1.0 255.255.255.0
   next-server 10.254.1.1 
   default-router 10.254.1.1 
   dns-server 8.8.8.8 
   domain-name ExamplesDomainName.com
   lease 1 0 10
!
!
!
! 
!
!
!
interface FastEthernet0/0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Cable1/0
 ip address 10.254.1.1 255.255.255.0 secondary
 ip address 10.128.1.1 255.255.255.0
 ip nat inside
 cable downstream annex B
 cable downstream modulation 64qam
 cable downstream interleave-depth 32
 cable downstream frequency 111000000
 cable downstream channel-id 0
 no cable downstream rf-shutdown
 cable upstream 0 description Cable upstream interface, North
 cable upstream 0 frequency 37008000
 cable upstream 0 power-level 0
 cable upstream 0 channel-width 1600000
 cable upstream 0 minislot-size 4
 cable upstream 0 modulation-profile 1
 cable upstream 0 admission-control 150
 no cable upstream 0 shutdown
 cable upstream 1 channel-width 1600000
 cable upstream 1 minislot-size 4
 cable upstream 1 modulation-profile 1
 cable upstream 1 shutdown
 cable upstream 2 channel-width 1600000
 cable upstream 2 minislot-size 4
 cable upstream 2 modulation-profile 1
 cable upstream 2 shutdown
 cable upstream 3 channel-width 1600000
 cable upstream 3 minislot-size 4
 cable upstream 3 modulation-profile 1
 cable upstream 3 shutdown
 no cable arp
 cable source-verify dhcp
 cable dhcp-giaddr policy
 no keepalive
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip classless
no ip forward-protocol udp netbios-ns
no ip http server
no ip http secure-server
!
!
access-list 1 permit 10.128.1.0 0.0.0.255
access-list 1 permit 10.254.1.0 0.0.0.255
cdp run
!
!
!
line con 0
 transport preferred all
 transport output all
line aux 0
 transport preferred all
 transport output all
line vty 0 4
 login
 transport preferred all
 transport input all
 transport output all
line vty 5 15
 login
 transport preferred all
 transport input all
 transport output all
!
end

Enjoy!

 

 

 

]]> 354216 [NETWORKING] 90’s style ISP with a CISCO 2600 https://www.pbnet.ro/?p=347945 Sat, 01 Jun 2024 16:37:25 +0000 https://www.pbnet.ro/?p=347945 [...]]]> Some years passed, and I thought I can do better than the setup described in this post: [Linux/Network] PPP/PAP Dial-Up server with VoIP and Raspberry Pi

That being said I thought a CISCO router could do the ISP part of the deal.

Before starting the journey, here is what we need:

OK, so on with the configuration:

  • Even if CISCO states that the WIC-AM-V2 should work with IOS 12.2, I only managed to have the WIC card recognized in IOS 12.3. After the WIC is recognized, you should have the interfaces show up as below at boot time:

  • Then you need to configure the LAN, DHCP Pool for Dial-up user, the dial-up user/password and the Async interface (the modem itself).

Here is a sample config:

PBNET-ISP&gt;ena
Password:
PBNET-ISP#sh running-config
Building configuration...

Current configuration : 1769 bytes
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname PBNET-ISP
!
boot-start-marker
boot-end-marker
!
enable secret 5 REDACTED
enable password REDACTED
!
no network-clock-participate slot 1
no network-clock-participate wic 0
aaa new-model
!
!
aaa authentication login default local
aaa authentication ppp default if-needed local
aaa authorization exec default local
aaa authorization network default local
aaa session-id common
ip subnet-zero
ip cef
!
!
!
ip dhcp pool dialup
   network 192.168.96.0 255.255.255.0
   dns-server 172.17.77.100 192.168.100.100
   default-router 192.168.96.1
!
ip name-server 172.17.77.100
ip name-server 192.168.100.100
!
username user privilege 15 password 0 REDACTED
!
!
!
!
interface Loopback0
 ip address 192.168.96.1 255.255.255.0
!
interface FastEthernet0/0
 ip address 172.17.77.24 255.255.255.0
 ip nat outside
 speed auto
 full-duplex
 no cdp enable
!
interface Async1
 ip unnumbered Loopback0
 ip nat inside
 encapsulation ppp
 ip tcp header-compression
 dialer in-band
 dialer-group 1
 async mode dedicated
 peer default ip address dhcp-pool dialup
 ppp authentication pap chap
!
interface Async2
 no ip address
 encapsulation slip
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 172.17.77.100
ip http server
!
access-list 1 permit 192.168.96.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
line con 0
 exec-timeout 0 0
line 1
 modem Dialin
 modem autoconfigure type default
 transport input all
 autoselect ppp
 stopbits 1
 speed 115200
 flowcontrol hardware
line 2
 stopbits 1
 speed 115200
 flowcontrol hardware
line aux 0
line vty 0 4
 password YOURPASSWORD
!
!
end

PBNET-ISP#

So: 192.168.96.1 is the loopback, the users will have a DHCP range of: 192.168.96.0/24 and the network gateway is 172.17.77.100

So we’re done on the CISCO side.

Now we need to setup the Asterisk extensions and the ATA.

I won’t go into the details of creating an extension on Asterisk. Let’s just say that we have 2 extensions: 700 and 800.

We set-up those 2 extensions on each port of the CISCO ATA122.

Now, we need to be careful on how the VOICE part is configured on the ATA:

Take special care about these settings:

  • Connect extension 700 on PORT1 of the ATA to the USR modem though a serial cable + USB-to-Serial-Adapter to your PC
  • Connect extension 800 on PORT2 of the ATA to the WIC Port0 (first port) on the cisco router.
  • Configure dial-up networking in Windows 11. Dial 800 and use the user/pass defined in the CISCO configuration to login

After connect, you will have:

The PPP adapter will show an IP configuration like below:

PPP adapter test:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 192.168.96.3
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . : 0.0.0.0

Happy surfing over Dial-up!

 

 

]]> 347945