Europa's questions

I am going through Security Command Center in Google Cloud and I have the following security finding:

• Name: ORG_POLICY_LOCATION_RESTRICTION
• Description: The resource is outside of the locations set on the Resource Location Restriction policy
• Resource display name: default
• Resource full name: //compute.googleapis.com/projects/MYPROJECT/regions/us-east5/subnetworks/default
• Resource type: google.compute.Subnetwork

Next steps

Please visit this Google Cloud Platform page that will help you to resolve the location violation that is affecting the google.compute.Subnetwork resource default.

Please delete this resource in order to resolve the resource violation associated with 'gcp.resourceLocations' organisation policy.

Deletion

When I go to VPC networks I see a lot of default networks, but they cannot be deleted.

How can I delete them?

I have a Google Cloud Compute Engine Instance Template with a Startup Script.

In the startup script the server generates a certificate. After generating the certificate it sends a message to an API to tell a central system about the certificate. The request looks like this:

curl --location 'https://my-side.com/hello?hostname=$hostname' \
    --header 'Authorization: SUPER_SECRET_API_KEY'

The API key is stored as raw text in the Startup Script. Is this OK, or should it be moved to example secret store? If so, then how can I read the API key in the Startup Script?

I am writing a bash script that will generate a root certificate and a server certificate. The root certificate generation works, but the server certificate prompts me for input - however since this is a bash script it should just use the values from the config.

rootCA_openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
 
[ req_distinguished_name ]
countryName = NO
countryName_default = NO
stateOrProvinceName = Nordland
stateOrProvinceName_default = Nordland
organizationName = Lumina Ventures
organizationName_default = Lumina Ventures
commonName = Lumina Ventures Root CA 1
commonName_default = Lumina Ventures CA 1
 
[ v3_req ]
basicConstraints = CA:true
keyUsage = critical, keyCertSign

Genrsa

openssl genrsa -aes256 -out rootCA.key --passout pass:password 2048

Create a CSR (Certificate Signing Request) file for root CA certificate

openssl req -new -key rootCA.key -out rootCA.csr -config rootCA_openssl.cnf --passin pass:password

Generate root CA certificate file rootCA.pem

openssl x509 -req -in rootCA.csr -sha512 -signkey rootCA.key -out rootCA.pem -days 1095 -extensions v3_req -extfile rootCA_openssl.cnf --passin pass:password

server_openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[ req_distinguished_name ]
countryName = NO
countryName_default = NO
stateOrProvinceName = Nordland
stateOrProvinceName_default = Nordland
localityName = Lofoten
localityName_default = Lofoten
organizationName = Lumina Ventures
organizationName_default = Lumina Ventures
commonName = 80.50.50.20
commonName_default = 80.50.50.20
commonName_max = 64
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
 
[ alt_names ]
IP.1 = 80.50.50.20

Enter a passphrase when prompted

openssl genrsa -aes256 -out server.key --passout pass:password 2048

req (it stops here)

openssl req -new -key server.key -out server.csr -config server_openssl.cnf --passin pass:password

This prompts me with:

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
NO [NO]:

How can I use the default values in server config? I tried to add prompt = no to the [ req ] section but it gave me a new error:

Error making certificate request
4057E170FB7C0000:error:04000067:object identifier routines:OBJ_txt2obj:unknown object name:../crypto/objects/obj_dat.c:376:
4057E170FB7C0000:error:05800077:x509 certificate routines:X509_NAME_ENTRY_create_by_txt:invalid field name:../crypto/x509/x509name.c:252:name=countryName_default

The last thing I am going to do is to generate the certificate, however I am stuck at the openssl req

openssl x509 -req -in server.csr -sha256 -CA rootCA.pem -CAkey rootCA.key -out server.pem -days 1095 -extensions v3_req -extfile server_openssl.cnf

I am generating a root certificate with a bash script.

I have a rootCA_openssl.cnf file with the configuration data:

rootCA_openssl.cnf

[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[ req_distinguished_name ]
countryName = NO
countryName_default = NO
stateOrProvinceName = Stavanger
stateOrProvinceName_default = Stavanger
organizationName = Stavanger Info
organizationName_default = Stavanger Info
commonName = 88.5.44.3
commonName_default = 88.5.44.3

[ v3_req ]
basicConstraints = CA:true
keyUsage = critical, keyCertSign

Generate RSA

openssl genrsa -aes256 -out rootCA.key --passout pass:password 2048

Create a CSR (Certificate Signing Request) file for root CA certificate

When I try to generate a CSR file Ubuntu promps me with the configuration.

openssl req -new -key rootCA.key -out rootCA.csr -config rootCA_openssl.cnf --passin pass:password

This is what Ubuntu asks me for:

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
NO [NO]:

I am going to run the command in a bash script, so I cannot press enter on the keyboard for the questions.

How can I run openssl req without beeing asked for this?

After I have created a Virtual Machine that runs latest Ubuntu LTS I want to connect to it using SSH.

When I login to it I get this screen:

I get a new code from g.co/sc

When I enter that code into the SSH-in-browser the same screen appears again.

What am I doing wrong?

1) Setup of Virtual Machine

Machine Configuration

• Type: E2 Standard 4 (4 vCPU, 16 GB RAM)
• Display Device: Enable

Boot disk

• OS: Ubuntu LTS x86/64

Identity and API access

• Firewall: Allow HTTPS traffic

Security

• Shielded VM: Turn on Secure Boot

VM Access

• Control VM access through IAM permissions
• Require 2-Step Verification

Custom metadata

• enable-oslogin: true
• enable-oslogin-2fa: true

2) Permissions for vm

I have added myself to the following permissions:

• Compute Admin
• Compute Instance Admin
• Compute OS Admin Login
• Compute OS Login
• Compute Viewer
• Owner