Taiwan Summit December 8th and 9th, 2018

EARCOS Workshop Presentation

Co-presented with Douglas Bradburn at EARCOS on October 25th, 2018

How to configure a Coldfusion MySql SSL connection to Google Cloud SQL

Here's instructions on how to get your MySQL Coldfusion server  (v10) to connect via SSL to Google Cloud SQL.

The tricky part of getting the SSL connection to work between Coldfusion and Cloud SQL is getting Coldfusion to use the Google CA Cert, your client cert and your client key.  I tried to put all this information into the datasource "Connection String" but was not able to get it to work that way, so I ended up splitting the information between configuring my client cert and key in the Coldfusion JVM arguments and then adding the other configuration items to the connection string in the datasource.


First Verify you can connect your datasources without SSL

If you can't connect without SSL, then you aren't going to be able to connect with SSL.  Verify first that you are able to connect your Coldfusion datasource to Cloud SQL using a non-encrypted connection.  If this works it means that you have your Coldfuison IP address added to the allowed connections for your Google Cloud SQL and it means that your mysql login id and password is working correctly.  (Make sure that your Cloud SQL is configured to allow unencrypted connections).


Now we work on the SSL Connection 

In order to get SSL connections to Google Cloud SQL you will need to have 3 files from your Google SQL Console.

server-ca.pem ->
This is your Cloud SQL Server CA and is how your client knows it is talking to your real SQL Server

client-cert.pem ->  This is your client certificate and is how the server knows it is really talking to you.

client-key.pem ->  This is your client private key.  Keep it safe.






Working with your truststore/keystore files

For working with keystores I used the opensource GUI program called Keystore Explorer  

Add your Server CA  to your Coldfusion truststore
We need to add your Cloud SQL Server CA to the Coldfusion truststore. THe truststore tells our coldfusion server which certificates that it trusts.  The default truststore coldfusion uses is located at [Coldfusion root]\jre\lib\cacerts

1. Open Keystore explorer program
2. Open the truststore located at [Coldfusion root]\jre\lib\cacerts
3. The default password is changeit (the truststore must have a password)
4. Select Tools->Import Trusted Certificate and import your server-ca.pem file
5. Save your cacerts file.

OR an alternative way to manage your Coldfusion Truststore
Another way to manage the cacert file used by Coldfusion is to install the coldfusion extension Certman and then you can view and manage your trusted certificates directly via the Coldfusion Administrator pages.




Make the keystore file for your client certificate and key
We need to make a keystore file for holding your client certificate and key.  It is very important that you use a password on both the keypair and also a password on the keystore file and the password needs to be the same for both!

1. Open Keystore explore
2. Make a new keystore file of type JKS
3. Select Tools->Import Key pair and select OpenSSL
4. When prompted for the keypair password, make sure you use a password, for example "changeit".
5. Save your new keystore file from the   File->Save menu.  MAKE SURE YOU save it with a keystore password, and it should be the same as the keypair password,  for example "changeit".
6. For this example,  I am saving the file with the  name cloudsql6.keystore in the c:\keys folder and using the password "changeit" for both the imported keypair and the the keystore file. 

Configure Coldfusion to use your keystore file
Add this line below to your Coldfusion JVM configuration and restart coldfusion.  This is telling coldfusion to use youre keystore file c:\keys\cloudsql6.keystore .  The file must have a password or it will not work.

-Djavax.net.ssl.keyStore=c:\keys\cloudsql6.keystore -Djavax.net.ssl.keyStorePassword=changeit

Connect a datasource using SSL

Add this to line below  to your datasource connectionstring to tell it to connect using SSL.  You must use the verifyServerCertificate or else it will not work.

useSSL=true&requireSSL=true&verifyServerCertificate=true

If you did everything correctly,  you will now have an SSL connection to your Google Cloud MySQL from your Coldfusion server.  Congratulations!!



Turn off allowed non-SSL connections to your Google Cloud SQL
Now you can turn off unsecured connections to your Cloud SQL to be even safer.  Tis is done from the Google Cloud Console.

Certified Information Systems Security Professional

Just received my CISSP certificate!  The test was 250 questions with 6 hours to complete.  Plus you need 5 years of full-time experience in 2 of the 8 domains.

Google Views, Photo Sphere's and make your own street view

Google Taiwan Summit Presentation May 17, 2015

More Info

Google Apps and Chromebooks at Morrison Academy

May 14th Conference at Google Taiwan

Moving Google Keep Notes to a new Gmail Account

I searched Google and couldn't find a good solution for transferring Google Keep notes between gmail accounts.  (For example between your work and personal gmail), and the option is not available on Google Takeout.  So here are the 2 ways I've been doing it.


Transferring Notes with pictures

1. In your source Google Keep account share the note with your destination Google account
2. Go to your destination Google Keep account and you will see the note,  click the 3 dots for more option and select "Make a Copy".(The reason you want to copy it is because if the original note from your source account is ever deleted it will be deleted at the destination account too)
3. Now either delete the shared note from your destination account  (So you don't see it twice).  Or if you are cleaning up your source account,  go back and delete the note from your source account (and it will also delete from the destination account).

Quick Copy/Paste 

A lot of my notes are just text and they don't even have titles so it is actually faster to just:

1. Open my source and destination Google keeps up in 2 Chrome Browsers and display both on the screen.
2. Just quickly copy/paste the text from the source note to the destination note.
3. Not the slickest solution, but it works.

The reason this came up is because I was trying to remove some of the Google Keep notes from my work Google Keep account and wanted to save them on my personal Gmail Account.

Speed Geeking Session for Morrison PL Day

Here are the slides from my speed geeking session on March 22, 2015

  

How to batch Uninstall many windows applications quickly

If you need to uninstall a lot of applications from a Windows machine and you are getting tired of clicking okay over and over and over, as well as waiting for each uninstall to finish before selecting the next application to uninstall, then here's what I do.

1. Download dUninstaller from FoolishIT.com
2. Run the dUninstaller.exe program (it doesn't even need to install)
3. Check the box of the programs you want to uninstall
4. Click the "Uninstall Now" button
5. Occasionally you will still have to click the "OK" button,  but not much compared to other uninstall options. 

Why I choose dUninstaller over other software

• You can batch uninstall many applications at once
• It will silently uninstall as many of the applications as possible,  so that you DON'T have to keep clicking the "OK" button.  I haven't seen any other uninstall programs with this feature

Embedding Google Sites into another site with an iframe not working by default anymore

Google Sites changed their default settings last week to not allow them to be embedded via iframe into other sites.


For example this page was suddenly showing white for content instead of the school bulletin.

http://hs.mca.org.tw/student-info/bulletin

(the bulletin is an iframe of a Google site page https://sites.google.com/a/mca.org.tw/hsdailybulletin/home )

All credit goes to our  Taichung ETC,  Dwight Johnson for figuring out the solution.

There is a new setting in Google Sites called "Allow Embedding of your sites in other sites"

Dwight clicked the box and the problem was solved!

https://support.google.com/sites/answer/6024145?hl=en

For more details about the cause,  google clickjacking

Thanks Dwight!

Install Apps on your new Windows PC machine in Minutes

Here is absolutely the easiest, quickest, simplest and free way to install your most commonly needed apps on a new Windows machine.

I try to run cloud-based applications as much as possible, but there is still a core set of apps that need to be installed on a new Windows PC.

In the past I would dread having to individually download all of the latest versions of applications from each vendors website when I was going to be upgrading or switching to a new machine.  But there is a free solution to this problem called NINITE


Here is how EASY it is for me to install my core list of apps which are

• Chrome
• Skype
• iTunes
• VLC
• Audacity
• QuickTime
• Java
• .Net
• Silverlight
• Air
• Shockwave
• Adobe Reader
• Google Drive

1.  Go to http://www.ninite.com website

2.  Click the applications you want to install and then download the Ninite installer
3.  Run the Ninite installer, it will download and install all of the apps for me automatically 

But wait, it gets EVEN EASIER.

Here is a Ninite URL with my core apps already pre-selected.  Just download and Run.

Or use my selections as a starting base and modify to your liking. 

http://ninite.com/?select=.net-7zip-air-audacity-chrome-googledrive-itunes-java-quicktime-reader-shockwave-silverlight-skype-vlc

Script to make Google drive your default Document folder for Windows 7 & Windows 8

Making Google Drive your default documents folder on a Windows machine  is a great idea, and is easy to do manually this cnet page already has instructions, but I'm interested in a way to  automate this so that we can quickly set this up on our staff laptops.


Here are the key lines from a script that we use.

Logged in as the teacher who is going to use the notebook,  we have a script that runs the following lines, (just one time for each teacher).

I'm using shlib.exe file from the Grim Admin site which you can find here.  More details can be found here under Option 2


To add the Google Drive Folder to show up in your Documents library, you can use this command in a batch file:

\\server\share\shlib add "%userprofile%\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms" "C:\Users\%username%\Google Drive" 

Here is the command line to set the Google Drive Library folder as the default document save location.

\\server\share\shlib setsaveloc "%userprofile%\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms" "C:\users\%username%\Google Drive"

One thing I couldn't get the script to do yet , is to move the Google Drive folder up so that it shows up FIRST in the Document Libraries folder,  so this has to be done by hand.  But I use this command to automatically open up the GUI windows to the correct location.  Then you just have to right click and move Google Drive to the top

\\server\share\shlib manage "%userprofile%\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms"

NOTICE for Windows 8.1
With the Windows 8.1 update,  Microsoft got rid of having Libraries show by default.  Here's some instructions from Cnet on how to do that.

Office 2010 KMS Client Activation troubleshooting

Occasionally we have an issue with Office 2010 not activating with our Office KMS activation server.


Here are the key steps we take to get it working quickly again from the client side. I'm assuming that the KMS server is working correctly.

The lines are run from the command prompt.  You need to start the command prompt with admin rights or you will get access denied errors.

1.  Make sure the time and timezone is set correctly on the client machine.  If the time is off by a lot it will not activate.

2. Launch a command window with elevated privileges.
(Type cmd in the search bar to locate the command window, Right click on cmd and click Run as administrator from the context menu, or select cmd and hit CTRL-SHIFT-ENTER on the keyboard. ◦Click Yes at the User Account Control prompt to open the command window with elevated privileges)


3. At the command prompt, change to the Office14 folder (this is where the ospp.vbs script is located by default)

cd \Program Files\Microsoft Office\Office14\

4.  You could start with manually trying to activate Office to see if the resulting error message is helpful for troubleshooting.  At the command prompt type:

cscript ospp.vbs /act

5. Run this command to manually specify the IP address of your Office KMS Server.

cscript ospp.vbs /sethst:10.80.0.8     (Use the IP address of your Office KMS Server)

4. Run this command to activate Office with the KMS server:

cscript ospp.vbs /act

More in-depth troubleshooting ideas can be found here if the above doesn't work for you
http://blogs.technet.com/b/office2010/archive/2009/12/18/volume-activation-tips-and-tricks.aspx

Troubleshooting Windows 7 or WIndows 8 OS Client Activations that use a KMS Server

Occasionally we have an issue with an existing Windows 7 or Windows 8 machines not being able to activate automatically from our KMS Server or a new machine not registering the first time.



Here are the key steps we take to get it working quickly again from the client side. I'm assuming of course that the KMS server is working correctly.

The lines are run from the command prompt.  You need to start the command prompt with admin rights or you will get access denied errors.

1.  Make sure the time and timezone is set correctly on the client machine.  If the time is off by a lot it will not activate.

2.  From a command prompt,  we can first try the obvious, and manually activate the client,  but I am assuming that this will fail.

slmgr /ato

3.  Next we can try and get some info about the status that might help to troubleshoot the problem.

slmgr /dlv show status

4.  Make sure Windows  is using a KMS key (not MAK).  You can uninstall and then reinstall the KMS key to be sure.

First uninstall the key, from the command prompt.

slmgr /upk  uninstall license

Then depending on if it is a Windows 8 or Windows 7 machine run one of the following commands.  You can get a list of Microsoft KMS Client keys here

slmgr /ipk NG4HW-VH26C-733KW-K6F98-J8CK4    (Windows 8  Pro KMS Key)

slgmr /ipk FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4  (Windows 7 Pro KMS Key)

5.  Then you can manually tell the client where to find the KMS server

slmgr /skms 10.80.0.24    (Use the internal IP address of your KMS server

6.  And now run slmgr /at again to try and register.

For more in-depth troubleshooting,  you can try this page
http://bjornhouben.wordpress.com/2013/09/05/microsoft-troubleshooting-key-management-service-kms-activation/

Thriving in the Workplace

National Taiwan University - Global MBA presentation

Google SSL breaks Safe Search Web filtering

Google has recently changed their search to force it to always use a secure SSL connection by redirecting to  https://.  The problem is that our Barracuda web filter,  and most web filters that I know of will not be able to enforce the Google safe search because of this change.  This is a problem for our school  and trying to protect staff and students from accidentally pulling up inappropriate images while doing a Google image search.  Even just typing some random characters can l pull up inappropriate images unless Google safe search is turned on.



Google doesn't label their safe search pull down in a very clear way either.  The pull down says "Safe Search" , so you would assume that safe search is on,  but really it isn't.  If you select the pull down and select "Filter Explicit Results",  then it will say "Safe
Search On",  which is really on now.





It would be nice if  Google just defaulted to Safe Search being on,  and then giving people the option of turning it off, or giving a warning that you are about to view material for people 18 years or older.  That is how yahoo does it.






Luckily for us we are also using Google Apps for Education (GAFE) with Chrome browsers and so most students and staff are logged into their Chrome Browser and from the GAFE Administrator we have set Safe search on for all users.  But of course,  this only works if the user is using the Chrome browser, AND they are logged in to Chrome browser with their school account.

Hopefully Barracuda will have a fix for this soon!!

Has this caused problems for anyone else?

October 2013 PL Google Presentation

My October 4, 2013 Google Apps Presentation at Morrison PL Days
on Search, Sync, App Launcher, Keep, Gmail, Drive, Chrome, Alerts, News, and Google Plus

Rubicon Training Presentation October 2012

My October Rubicon Training for Morrison PL Days presentation

Going Google Presentation

My Google Presentation on Chrome Browser, Gmail, Google Drive, and Search from Morrison October PL

Powerschool for Parents Presentation

Meet the teacher Night - Introducing Powerschool to Parents