Securing passwords in PowerShell

It is sometimes necessary to use plaintext passwords in PowerShell scripts, but obviously not a good idea to have those passwords stored in cleartext on disk. The solution is to use the PowerShell ConvertTo-SecureString and ConvertFrom-SecureString cmdlets to encrypt the password, save it to a file, and then decrypt it in memory when required. I ported this function to PowerShell for properly converting the SecureString to a string.

The code below uses the default encryption method, which is specific to the logged in user (or, more precisely, the user that is running the code). Note that, for machines that have joined a domain, a domain administrator can decrypt your data by resetting your password. No other users can decrypt your data.

Encrypt password and save to a file

$secureStringPassword = Read-Host "Enter the password" -AsSecureString
$encryptedPassword = ConvertFrom-SecureString $secureStringPassword
Set-Content -Path Password.bin -Value $encryptedPassword

Load and decrypt the password in memory

function ConvertToUnsecureString(
    [System.Security.SecureString][parameter(mandatory=$true)]$SecurePassword)
{
    $unmanagedString = [System.IntPtr]::Zero;
    try
    {
        $unmanagedString = [Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($SecurePassword)
        return [Runtime.InteropServices.Marshal]::PtrToStringUni($unmanagedString)
    }
    finally
    {
        [Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($unmanagedString)
    }
}

$encryptedPassword = Get-Content -Path Password.bin
$secureStringPassword = ConvertTo-SecureString -String $encryptedPassword
$password = ConvertToUnsecureString $secureStringPassword 

Adding Google OpenID authentication to your ASP.NET MVC3 site

This is a very simple example of an ASP.NET MVC3 application that uses the DotNetOpenAuth project to authorise users against Google OpenID.

Convert DICOM medical images to png or jpg

We received our baby scans on CD in DICOM format which can be viewed in the viewer on disk. I wanted to convert these to a more popular format - either png (lossless) or jpg (lossy).

I used ImageMagick through PowerShell to convert all the images and save them into a separate folder:

mogrify -format png *; md Converted; move *.png Converted

Overriding Internet Explorer Compatibility Mode for intranet sites

Many corporate environments (including my own) have the "Display intranet sites in Compatibility View" setting enabled. This means that, even if you use the new <doctype html> tag, your intranet site will render in Compatibility Mode. This means that Internet Explorer 8 will render your site in Internet Explorer 7 mode.

I found a fantastic summary of the decision tree that Internet Explorer uses when deciding how to render a page. Using this information, I tried adding the following tag to each page:

<meta http-equiv="X-UA-Compatible" content="IE=Edge"/>

This tag will override the Compatibility Mode settings and the browser will render in the most standards compliant way.

The downside of this tag is that it is not standard HTML, and will fail HTML validation.

Setting up a Google App Engine development environment on Ubuntu 11.04

1. Install Ubuntu 11.04.
2. sudo add-apt-repository ppa:fkrull/deadsnakes
3. sudo apt-get update
4. sudo apt-get dist-upgrade
5. sudo apt-get install eclipse python2.5
6. Launch Eclipse and install PyDev from http://pydev.org/updates
7. Download Google App Engine from http://code.google.com/appengine/downloads.html
8. Expand app engine code into source code folder
9. Create a new PyDev Google App Engine Project (Ctrl+N)
10. Set up run configuration
    
    1. Name your run configuration.
    2. Under "Project", add your Google App Engine Python project.
    3. Under "Main Module", enter the location of the "dev_appserver.py" script.
    4. Change to the "Arguments" tab and enter "${project_loc}/src" as first argument. After this argument, you may add all available additional arguments listed on the Dev Webserver documentation page. (Here, for example we changed the port where GAE is listening to 9999.)
11. Run the project.
12. Optionally use lib/django_1_2/django/bin/django-admin.py to create a new Django project. You will need to install Django first by running sudo python2.5 setup.py install

"SHOWPLAN permission denied" in Database Engine Tuning Advisor

I recently ran into an issue while trying to tune a database used by an ASP.NET website. The error displayed in the Database Engine Tuning Advisor was:

[Microsoft][SQL Server Native Client 10.0][SQL Server]SHOWPLAN permission denied in database 'database'.

After a lot of digging, I managed to track down an obscure post that mentioned DTA runs statements as the user who originally executed the statement - in this case the site's application pool user. This user is locked down and does not have SHOWPLAN permission, even though I, as administrator do have permission.

The solution in the development database (where security is not a major concern) was to grant SHOWPLAN permission to the application pool user:

grant showplan to [domain\user]

Generating random date data in SQL Server 2005

The statement below will generate random dates between 1 January 2010 and 27 Apr 2011.

select cast(cast('1 Jan 2010' as datetime) as int); --returns 40177
select cast(cast('27 Apr 2011' as datetime) as int) - cast(cast('1 Jan 2010' as datetime) as int); --returns 481

update transactions
set requesteddatetimeutc = cast((RAND(convert(varbinary,newid()))*481 + 40177) as datetime);