Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide turns on Check Point Remote Access VPN so staff can connect from outside with the Check Point Endpoint Security VPN / Check Point Mobile client and reach internal networks over an encrypted IPsec tunnel. You do it in SmartConsole , not on the gateway shell — enabling the IPsec VPN blade, putting the gateway in the RemoteAccess community, assigning client IPs with Office Mode, adding an access rule, and installing policy.
This guide builds a read-only report: it collects the BitLocker encryption status of every fixed volume on a set of domain computers and writes it to a CSV. It does not enable, disable, or change BitLocker on anything. The only thing it creates on your side is the output file.
This guide builds a site-to-site IPsec VPN community in Check Point SmartConsole so traffic between two sites' encryption domains is tunnelled and encrypted. The main path assumes both peers are Check Point gateways managed by the same Management Server (SMS) on R81.20 ; I note where a third-party peer (an Interoperable Device ) differs.
This script reads the free space on the fixed local disks of the machine it runs on and emails you when any of them drops below a percentage you set. It is a lightweight stand-in for a monitoring platform — good for a handful of servers, not a replacement for one across a fleet.
This playbook installs Postfix on one or more target hosts and configures it as a send-only relay (a "smarthost" client) : local mail is handed to an upstream provider over an authenticated, TLS-encrypted SMTP submission connection, and the host does not accept mail from the network. Its purpose is to give servers a reliable way to send notifications, cron output, and application mail without each app talking to your provider directly.
If you only read one Linux kernel headline this week it was probably Phoronix noting that 7.2-rc5 fixes a longstanding bug in IPv4 over FireWire . File that under trivia. Nobody reading this blog is carrying mail over an IEEE 1394 cable, and it landed in a release candidate anyway. The actual reason to look at your kernel version this week is buried under a mountain of near-identical advisories.
This guide creates NAT rules on a Check Point gateway: Hide NAT (many internal hosts sharing one public address for outbound access) and Static NAT (a one-to-one map so a public address reaches an internal server). NAT rules rewrite the source or destination address of live traffic — get one wrong and you can break outbound Internet for a whole subnet or expose a server you didn't mean to.
This sets up a nightly one-way mirror of a local folder to a NAS SMB share using robocopy /MIR , followed by a second pass that lists any remaining differences as a verification step, all logged to a timestamped file and driven by a Scheduled Task.
This playbook drops a single sshd configuration file ( /etc/ssh/sshd_config.d/99-hardening.conf ) onto every host in your inventory and reloads the SSH service. It disables root login, disables password authentication, requires public-key auth, and tightens a handful of session and auth limits.
This guide builds an Access Control policy in SmartConsole and installs it onto a Check Point Security Gateway. Building the policy touches only the management database; installing it is the moment that changes how the gateway forwards traffic. A policy that ends in the implicit cleanup drop, or one that removes the rule you rely on, can cut production traffic and lock you out of management in one push.
This guide builds and deploys Windows Defender Firewall rules from a table (a CSV), using the NetSecurity PowerShell module, with netsh advfirewall shown as the older equivalent. The goal is a repeatable, idempotent way to push the same rule set to one host or many, instead of clicking through wf.msc on each box.
The standard, boring way to block IPs that hammer your mail server is Fail2ban. It watches the mail log, counts matching failures per source IP inside a time window, and when a source crosses a threshold it inserts a firewall rule to drop that IP for a while. You could write a bash script that greps the log and pipes IPs into nft , and I'll say where that fits at the end — but reinventing Fail2ban is more error-prone than configuring it, so that's what this guide does.
This guide publishes one internal server on one port to the internet through a SonicWall. You will create an address object for the server, pick or create a service (port) object, add an inbound NAT policy that rewrites the destination to the internal host, and add a WAN→LAN access rule that permits the traffic. Both pieces are required: the NAT policy alone forwards nothing without the matching access rule.
