Coursera Notes: Stanford 'Start-up Engineering' (Lectures 5-8)

These are just some of my notes from Coursera's 'Start-up Engineering' course, taught by Balaji Srinivasan from Stanford.

This is a continuation of my existing series of notes.

Market Research, Wire-framing and Design

• Idea  Mock-up
  Mock-up  Prototype
  Prototype  Program
  Program  Product
  Product  Business
  Business  Profit
• Execution! It is not the idea, but the execution that matters. Sales rather than technology is what builds a business.
• Market! Market will draw a product from a team, whether or not it is quality or the team is good.
• An idea exists within a maze. A simple sentence is not enough to describe an idea; an idea is defined by the regulations, markets, and competition.
• Execution mindset. This is essentially writing a to-do list and regularly checking off items. Rinse and repeat.
• Market Research:
1. News coverage and research papers. Google Books, SEC filings and Wikipedia.
2. Back-of-envelope estimate of market size. Look for relevant statistics.
3. Validate. Google keyword planner and Facebook advertiser tools help determine if there is actually a market need.
4. Do a basic launch page with basic SEO. Use wireframes.
5. Ad-word to discover the market. The launch page will then gauge market interest.
• MVP or Minimum Viable Product.
• Remember, a start-up aims to be very ambitious and scale rapidly.
• Two features of successful start-ups:
1. Exhibit economies of scale. Cost of production per unit decreases as more units are built (but revenue stays the same). We can then determine a break-even point and therefore the minimal capital required.
2. Attack/Pursue large markets. Different pricing will attract different markets, but low price points require automation and industrial efficiency to make profits (because customer service is expensive). It may be better to charge higher initially to counter risks. Market sizing calculations should be done early and often.
• Once a market and broad perspective has been set, versions and features need to be prioritized. Remember, it is execution and sales that matter!
• Rough guide to prioritizing versions and features:
• How much are they willing to pay for certain features or versions?
• Which features are required in each version? What features make sense to bundle together?
• Estimate the time and cost to build each feature. Is it feasible to implement the feature now, or wait for more funding?
• Find the most popular features.
• Calculate the market size for each feature.
• Wireframing tools: omnigraffle, lucid chart, jet strap and popapp.
• Copy-writing:
• Home-page message must allow a customer to immediately figure out what the product is. This is a priority if this is going to be a major source of potential customers.
• Work backwards from the press release (write the release then build the product). This allows you to figure out which features are making the news and which are not.
• Find your competitors and explain why they are terrible options. Use this insight when explaining the benefits of your product.
• Simple, factual and concise statements.
• Call to action. Allow the customer to do something once they visit your website.
• Vector graphics are better to work with.
• In design remember Alignment, Repetition, Contrast and Proximity.
• Start with a font heavy design (it is easier to do and images can always come later)

Mobile

• Assumption behind the mobile phenomenon is that everything is going to be on the internet. The internet is going from a novelty to a utility.
• Build for HTML5 and then move to native apps. HTML5 ensure your application works on all devices (and Android will soon utilise HTML5 and Javascript instead of native applications).
• Internet of Things is the idea that every device will have it's own IP address. This offers a huge potential market.
• Quantified self is the measuring of human beings and our actions. This is the collection of metrics that may revolutionize diagnosis and medicine.
• One way to build mobile-aware applications is user-agent sniffing. This approach has the problems that a client can fake their own user-agent, and that the user-agent is inherently unreliable.
• CSS media queries and Responsive web design allows the application of conditional styles depending on screen size. This is much more reliable, but does not have ubiquitous support (yet).
• Some constraints with mobile include:
• Unreliable networks (the fallacies of distributed computing)
• Debugging requires logging (and bug reporting)
• Minimization of user input (difficult problem to solve; how to collect everything you need without overwhelming the user)
• Minimize the time to result (if you take too long the user will go elsewhere)

HTML / CSS / Javascript

• HTML is the skeleton of a web application. It provides the structure of a page and the semantics. It is a set of finite elements with attributes.
• CSS is the look and layout of a web application. It edits the element and attributes for styling and formatting.
• Javascript is the dynamics and behavior of a web application. It allows you to provide client-side validation, pulling in content, playing games and much more.
• Some useful tools include jsfiddle.net and Chrome Developer Tools.

Deployment, DNS and Custom Domains

• Your code production environments should be along the lines of Development -> Staging -> Production
• Separating environments bring the following benefits:
• Testing of features before they reach the customer
• Roll back of code in case of major bugs
• Restore code or data in case of catastrophic crashes of the server
• Incorporate contributions from multiple engineers
• Perform AB testing of features
• DNS (Domain Name System) converts IP address into human readable hostnames. The system first looks locally in a program, then the OS, then the ISP and then finally a trusted internet DNS server.

Windows Batch Script to lockdown firewall and only allow a few websites with dynamic IP addresses (nslookup)

This script was pretty much an extension of my earlier work on locking down windows. The problem is that that script only really worked for locking down static IP addresses. If you had a dynamic IP address you would have to manually change the firewall rules.

This script will delete the old firewall rules, find the new IP address of a host and create a new rule using that IP address.

@ECHO OFF
netsh advfirewall set domainprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set privateprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set publicprofile firewallpolicy allowinbound,allowoutbound 

netsh advfirewall firewall delete rule name=all dir=out protocol=tcp remoteport=80,8080,8443,443 profile=any 

for /f "tokens=1*" %%k in ('nslookup example.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="example" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

for /f "tokens=1*" %%k in ('nslookup learning.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="learning" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound

By saving this script somewhere secure you can create an event run by the inbuilt Windows Task Scheduler to run this script daily. This way you never have to worry about updating your firewalls when IP addresses change!

Bridge Networking in CentOS 6.3

Bridge networking is a useful technique to allow Virtual Guests to access your networking hardware. This guide was written in mind for CentOS 6.3 but should be applicable to other Linux versions (with modifications).

1. Copy the file /etc/sysconfig/networking-scripts/ifcfg-eth0 as br0

   cp /etc/sysconfig/networking-scripts/ifcfg-eth0 /etc/sysconfig/networking-scripts/ifcfg-br0

   
   
2. Edit the file /etc/sysconfig/networking-scripts/ifcfg-eth0 and add the line:
   

   BRIDGE=br0

   You can also delete the lines:
   

   BOOTPROTO
   IPADDR
   GATEWAY
   DNS1
   DNS2

3. Edit the file /etc/sysconfig/networking-scripts/ifcfg-br0 and edit the lines:
   

   DEVICE=br0
   TYPE=Bridge

   You can also delete the lines:
   

   HWADDR
   UUID

4. Restart your network:
   

   service network restart

    

References

• Howtoforge.com guide to Virtualisation with KVM
• Cyberciti post on KVM Bridging
• The isborken blog on setting up a headless KVM

SSH Hardening on CentOS 6.3

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, network hardening, services hardening and clearing out orphaned packages.

This post outlines how you can harden your SSH server.

1. Strengthen your IP table firewall rules by editing /etc/sysconfig/iptables and adding or changing the line (NOTE: Any old SSH rule will be using port 22; change it accordingly):
   

   -A INPUT -m state --state NEW -s network/mask -p tcp --dport 4444 -j ACCEPT

   where network/mask is replaced with your actual network and mask values i.e 10.0.0.0/24
2. Since SSH uses the TCP wrappers library we will need to allow the service in /etc/hosts.allow

   sshd: 10.0.0.

   
   
3. Edit /etc/ssh/sshd_config with the following changes:
   

   # Use Port 4444 instead of Port 22
   Port 4444
   
   # Ensure we use Protocol 2 by default
   Protocol 2
   
   # Set idle timeouts (15 minutes)
   ClientAliveInterval 900
   ClientAliveCountMax 0
   
   # Disable rhost behaviour
   IgnoreRhosts yes
   
   # Do not trust other hosts
   HostbasedAuthentication no
   
   # Do not allow root logins
   PermitRootLogin no
   
   # Do not allow empty passwords
   PermitEmptyPasswords no
   
   #Disable environment alteration
   PermitUserEnvironment no
   
   #Disable X11 forwarding
   X11Forwarding no
   
   # Disable TCP forwarding
   AllowTCPForwarding no
   
   # Log level
   LogLevel INFO

4. Restart everything
   
   

   service sshd restart
   service iptables restart
   service network restart

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS
• This guide from sysadminwiki
• The security nut blog

Setting up a CentOS 6 server: Network Hardening

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, and clearing out orphaned packages.

This post will focus on hardening your networking infrastructure.

1. Disable wireless networking in the kernel by running the following loop:

for i in $(find /lib/modules/`uname -r`/kernel/drivers/net/wireless -name "*.ko" -type f ) ; do
echo blacklist $i >> /etc/modprobe.d/blacklist-wireless ; done

2. OPTIONAL: I also disabled the loading of bluetooth drivers by modifying the command loop. I replaced 'net/wireless' with 'bluetooth' and save it under a different filename.
3. Edit /etc/sysctl.conf to secure the network within the kernel.
   

   # Disables packet forwarding
   net.ipv4.ip_forward = 0
   
   # Source route verification
   net.ipv4.conf.all.rp_file = 1
   net.ipv4.conf.default.rp_file = 1
   
   # Don't accept source routing
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
   # Not a router, so do not send redirects
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   
   # Not a router, so do not accept redirects
   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   net.ipv4.conf.all.secure_redirects = 0
   net.ipv4.conf.default.secure_redirects = 0
   
   # Log all packets with impossible addresses to the kernel log
   net.ipv4.conf.all.log_martians = 1
   
   # Ignore all ICMP ECHO and TIMESTAMP requests sent via broadcast/multicast
   # And protect against ICMP attacks
   net.ipv4.icmp_echo_ignore_broadcasts = 1
   net.ipv4.icmp_ignore_bogus_error_messages = 1
   
   # Protect against SYN flood attacks, and controls the use of SYN cookies
   net.ipv4.tcp_syncookies = 1
   net.ipv4.tcp_synack_retries = 2
   
   # This is not  a router so don't accept IPv6 solicitations
   net.ipv6.conf.all.router_solicitations = 0
   net.ipv6.conf.default.router_solicitations = 0
   
   # Do not accept IPv6 preferences from the router
   net.ipv6.conf.all.accept_ra_rtr_pref = 0
   net.ipv6.conf.default.accept_ra_rtr_pref = 0
   
   # Do not accept IPv6 prefix information from the router
   net.ipv6.conf.all.accept_ra_pinfo = 0
   net.ipv6.conf.default.accept_ra_pinfo = 0
   
   # Do not accept Hop Limit settings from router
   net.ipv6.conf.all.accept_ra_defrtr = 0
   net.ipv6.conf.default.accept_ra_defrtr = 0
   
   # Do not accept configuration from router
   net.ipv6.conf.all.autoconf = 0
   net.ipv6.conf.default.autoconf = 0
   
   # Not a router so don't sent IPv6 solicitations
   net.ipv6.conf.all.dad_transmits = 0
   net.ipv6.conf.default.dad_transmits = 0
   
   #Assign only one address per interface
   net.ipv6.conf.all.max_addresses = 1
   net.ipv6.conf.default.max_addresses = 1

4. OPTIONAL: While we are in /etc/sysctl.conf we may as well add a few hardening parameters for the kernel:
   

   # Controls System Request Debugging
   kernel.sysrq = 0
   
   # Append PID to core filename in a core dump (useful to determine what happened)
   kernel.core_users_pid = 1
   
   # Activate ExecShield
   kernel.exec-shield = 1
   kernel.randomize_va_space = 1

5. OPTIONAL: If you are going to use bridge interfaces then disable packet filtering. This way we will use the Virtual Machine's firewall rules instead of defining complex rules on the host.
   

   net.bridge.bridge_nf_call_ip6tables = 0
   net.bridge.bridge_nf_call_iptables = 0
   net.bridge.bridge_nf_call_arptables = 0

6. Disable automatic loading of IPv6 in the kernel by editing /etc/modprobe.d/dist.conf with:
   

   install ipv6 /bin/true

   While we are here, we will also disable the loading of uncommon networking protocols:
   

   install dccp /bin/true
   install sctp /bin/true
   install rds /bin/true
   install tipc /bin/true

7. Disable IPv6 interfaces by modifying /etc/sysconfig/network:
   

   NETWORKING_IPV6=no
   IPV6INIT=no
   IPV6_AUTOCONF=no

   You can also turn off avahi and zeroconf by adding the line:
   

   NOZEROCONF=yes

   (NOTE: If you are not going to use zeroconf you may as well uninstall it with yum remove avahi avahi-autoipd. The avahi-libs package is required by other programs so you may still need it)
8. Add the following line to every file that matches the pattern /etc/sysconfig/network-scripts/ifcfg-* with:
   

   IPV6INIT=no

9. Deny all TCP Wrapper services by default. Edit /etc/hosts.deny and enter the following as the only entry:
   

   ALL: ALL

10. OPTIONAL: If you wish, only allow TCP Wrapper services (like SSH) to run on the localhost loopback interface. Edit /etc/hosts.allow and enter the following:
    

    ALL: localhost

11. Edit IP tables (the firewall) to automatically drop packets that do not match a given rule. Edit the files /etc/sysconfig/iptables & /etc/sysconfig/ip6tables
    

    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]

12. Restrict ICMP messages by removing any lines in /etc/sysconfig/iptables containing the following:
    

    -p icmp

    and replace it with:
    

    -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
    -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

13. To log all dropped packets in the system replace the following line in /etc/sysconfig/iptables:
    

    -A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibited

    with:
    

    -A INPUT -j LOG
    -A INPUT -j DROP-A FORWARD-j LOG
    -A FORWARD -j DROP

    You will need to write the same in the equivalent IPv6 file (in /etc/sysconfig/ip6tables)
14. You may have NFS installed; if you don't need it then uninstall it:
    
    

    yum remove portmap nfs-utils

    
    NOTE: If you are running virtual machines then it will need the libraries provided by portmap. Instead turn off the services:
    

    chkconfig portreserve off
    chkconfig rpcgssd off
    chkconfig rpcidmapd off
    chkconfig rpcbind off
    chkconfig rpcsvcgssd off
    chkconfig nfs off
    chkconfig nfslock off

15. Finally, to check what is running on your server:
    
    
    • This will show all services:
      

      netstat -tulp

    • This will show only services with active connection
      

      netstat -ant

    • This will show you the routing table
      

      route

    • This will show you if any program is actively pulling raw packets, and is a sign that there is a network sniffer. Note that on a fresh system that a positive result may just be the DHCP client (if you use one).
      
      

      cat /proc/net/packet

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS
• This guide from sysadminwiki

Troubleshooting USB mobile internet in Ubuntu

Most mobile broadband USB sticks come with two partitions; one with the installer and the other with the actual connection device. When you plug in the USB, the operating system will first mount the installer partition (which usually contains the installers for Windows and Mac). The installer will insert code that will automatically switch the USB to skip the installer and mount the connection device directly. Unfortunately most manufacturers don't support Linux, so new USB devices won't work straight away.

This guide will provide some tips to get your troublesome USB broadband stick working. This guide will focus on Ubuntu (11.04 in particular), however most of this guide should be applicable to other distro's as well (as long as it has usb_modeswitch installed). The particular device I will be configuring is the Huawei Technologies K3771 USB device given by Vodafone Australia.

First we will go through some troubleshooting tips for those new to the game, and by step 3 we will begin applying our fix.

1. Plug-in your device, open up a terminal (or command prompt) and type in the following command:
   
   

   nm-tool

   
   This will open up a list of internet devices; eth stands for ethernet and is usually your wired/wireless connections. We are looking for entries with wwan, GSM, 3G or Mobile Broadband in this list. If your device is detected here but does not work then it is a software issue that is outside the scope of this guide.
    
2. Now we need to see if your device is even detected by the system. Unplug your device, wait a second and in the terminal type in:
   
   

   lsusb > ~/usb1.txt

   
   When the command finishes plug the device back in, wait ALOT of seconds (wait until LEDs start flashing) and type in:
   
   

   lsusb > ~/usb2.txt

   
   Now to see if anything changed. Type in the command:
   
   

   diff ~/usb1.txt ~/usb2.txt

   
   You should now see something like:
   
   

   6a7> Bus 002 Device 008: ID 12d1:14c4 Huawei Technologies Co., Ltd

   
   If nothing pops up on the terminal, then either you jumped the gun too early with the second lsusb OR your device simply isn't playing nice. This is outside the scope of this guide and I suggest you hit up the guys at libusb or kernel developers to track this problem down. But before you do just cross your fingers and try:
   
   

   sudo /usr/sbin/update-usbids

   
   This will update the id list of USB devices your system will support; hopefully it will be in there!!
    
3. So now the hard part starts. The line we got from lsusb gives us some useful information about the device. The ID of a device can be split into two parts; the first part (12d1) is the vendor code, and the second part (14c4) is the product code. Unfortunately, in this case the product code points to the installer partition of the device. We need to manually tell the system to switch over to the mobile broadband part (this is what the installer does automatically for Windows and Mac). To do this we run the following command:
   
   

   sudo gedit /lib/udev/rules.d/40-usb_modeswitch.rules

   
   This will bring up a text editor with a list of all the USB devices that the system will automatically switch. We now need to add our device to this list. Either add to the end of the file or do a search to find similar devices and add:
   
   

   # This is just a comment. Replace this text with information of your device
   ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14c4", RUN+="usb_modeswitch '%b/%k'"

   
   Replace the vendor and product id's with whatever lsusb produced. It should look like:
   
   

   # Vodafone (Huawei) K3771
   ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14c4", RUN+="usb_modeswitch '%b/%k'"

   
   Ok, so now we are telling the system to switch our device.... switch to what? Remember, no matter how fancy they get computers are always very, very stupid machines. The mobile broadband device has it's own product id that we must link to the installer id. This is where it gets tricky; you need to figure out what this id is and at this stage I have no other advice other than to Google and pray. Luckily for me I know that my device id is 12d1:14ca. Now we need to create a custom usb_modeswitch rule.....
    
4. Navigate to the directory /usr/share/usb_modeswitch/ by running the following command in a terminal:
   
   

   cd /usr/share/usb_modeswitch/

   
   If you perform an ls you will see that this directory contains a file called configPack.tar.gz. This file contains all the switching rules; we need to edit it to add our device. First back up the file through:
   
   

   sudo cp configPack.tar.gz configPack-ORIGINAL.tar.gz

   
   Now we will extract the scripts through running:
   
   

   sudo mkdir configPack/; sudo tar xzf configPack.tar.gz -C configPack/

   
   Run the command to open a text file for our new rule (replace the 12d1:14c4 part with the id of your device):
   
   

   sudo gedit configPack/12d1\:14c4

   
   This will open a completely blank document. Add the following text (remember to customise for your particular device!):
   
   

   ##########################################
   # Vodafone (Huawei) K3771 (again, this is just a comment)
   #
   # Our settings discovered by lsusb (the '0x' part just
   # tells the system how to interpret the number
   DefaultVendor= 0x12d1
   DefaultProduct=0x14c4
   #
   # Our target product that we will switch to
   TargetVendor= 0x12d1
   TargetProduct= 0x14ca
   #
   # Some misc values that I don't really understand and am
   # not game enough to change...
   CheckSuccess=20
   MessageContent="55534243123456780000000000000011062000000100000000000000000000"

   
   Now we need to repack the rules and clean up our mess:
   
   

   cd configPack/; sudo tar -czf ../configPack.tar.gz *; cd ../; sudo rm -rf configPack/

   
   You can check the contents of the file by running the following command:
   
   

   sudo file-roller configPack.tar.gz

    
5. Now restart your machine and, fingers crossed, the system will now correctly detect your device!

References

Some useful links for those who want to trace something more specific:

• usb_modeswitch usage details; straight from the source!
• The actual github commit for usb_modeswitch that will fix my specific Huawei K3771 problem
• Alot of this guide is based on the work done by AlexFish; goes into more depth than mine!
• The post that gave me the original tip-off; pdc pointed me in the right direction!

UFW: Uncomplicated Fire Wall

Back when I used Red Hat Linux and Fedora I had to use the iptables tool to create a secure box over the Internet. It's been a few years since, and now I gladly find that the CLI has a new simplified firewall tool: ufw. This tool takes away the onerous task of creating the long chain rules required for iptables and compresses them into easy to decipher statements.

Here is a little script I used for my machine to lock away the whole internet except for the companies web-application:


#!/bin/bash
#
# Accept all outgoing packets from this machine by default
sudo ufw default allow outgoing
#
# Deny all incoming packets to this machine by default
sudo ufw default deny incoming
#
# Only accept outgoing connections to port 80 (www) to the following IP addresses
sudo ufw allow out to 1.2.3.4 port 80
sudo ufw allow out to 10.0.0.1 port 80
#
# Other reject all other connections to port 80
sudo ufw reject out 80
#
# Turns on the firewall and adds it to the boot-up script
sudo ufw enable

Configure Windows via a batch script

While I primarily use *nix based systems at home and work, I am sometimes called upon to administer Windows boxes. I have finally decided to do some basic research to figure out how to automate these tasks; behold, my Windows configuration batch script!!!

Note: This script must be executed with Administrator privileges.

@ECHO OFF
net user Guard /add
sc config "CertPropSvc" start= disabled
sc config "Browser" " start= disabled
sc config "UxSms" start= disabled
sc config "DPS" start= disabled
sc config "TrkWks" start= disabled
sc config "IKEEXT" start= disabled
sc config "PcaSvc" start= disabled
sc config "EMDMgmt" start= disabled
sc config "RasAuto" start= disabled
sc config "RasMan" start= disabled
sc config "RemoteRegistry" start= disabled
sc config "SCardSvr" start= disabled
sc config "SCPolicySvc" start= disabled
sc config "LanmanServer" start= disabled
sc config "TabletInputService" start= disabled
sc config "TermService" start= disabled
sc config "WebClient" start= disabled
sc config "idsvc" start= disabled
sc config "wcncsvc" start= disabled
sc config "WMPNetworkSvc" start= disabled
sc config "WinRM" start= disabled
sc config "WinHttpAutoProxySvc" start= disabled
sc config "AppMgmt" start= disabled
sc config "WdiServiceHost" start= disabled
sc config "WdiSystemHost" start= disabled
netsh advfirewall firewall add rule name="Rule1" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=10.0.0.60 profile=any
netsh advfirewall firewall add rule name="MAIL" dir=out action=allow protocol=tcp remoteport=110,143,993,995,25,587,465 remoteip=any profile=any
netsh advfirewall firewall add rule name="LOCAL" dir=out action=allow protocol=tcp remoteport=any remoteip=localsubnet profile=any
netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set publicprofile state on

A quick rundown of what this code actually does:

• The program sc is a program that interacts with windows services. I use the config keyword to disable some services from starting.
• The netsh program does multiple things, one of which is to configure the windows firewall. In this script I add a couple of rules and apply them to the domain.
• The second line of the batch script creates a new user.

References:

• Windows Knowledge Base article about how to use 'netsh advfirewall' instead of 'netsh firewall'
• Grand Stream Dreams blog post about how to interact with windows firewall via batch scripts
• Stack overflow Q&A about creating users from the command line
• Paradineshift article about how to disable services via a batch script