Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide covers three related tasks on a Palo Alto firewall: exporting a copy of the configuration off the box (a backup — completely safe, read-only), saving named snapshots on the box , and loading and committing a configuration (a restore — this changes the running config and can lock you out or drop production traffic ).
This guide sets the Automatic Replies (out-of-office) configuration on multiple mailboxes at once, using Set-MailboxAutoReplyConfiguration in Exchange Online PowerShell. It turns auto-reply on (or schedules it), and writes the internal and external message text. It does not delete mail, move anything, or change mailbox permissions — but it does overwrite whatever auto-reply text and state each affected mailbox currently has, and there is no built-in "undo" that restores the previous message. If a user had their own carefully worded reply set, this replaces it. So capture the current state first (I show how below) and treat the change list as production data.
This is a read-only reporting script . It reads your Postfix/Dovecot mail log and your Fail2ban log, extracts the source IPs behind SMTP SASL failures, Postfix rejects and Dovecot auth failures, cross-references them against the IPs Fail2ban actually banned, and prints one ranked summary. It does not touch your firewall, your jails, your mail queue, or any config. There is nothing to undo except deleting the report file and removing the cron entry you add at the end.
This guide pairs two identical Palo Alto firewalls into an active-passive HA cluster : one firewall passes all traffic while the other sits in sync and takes over if the active one fails, reboots, or loses a monitored link. It does not load-balance — the passive box carries no production traffic until failover.
This guide installs Sanoid and configures it to take ZFS snapshots on a schedule (hourly, daily, monthly) and to automatically destroy snapshots older than the retention you set. Snapshots are your cheap, instant, on-box rollback points; the pruning half is what stops them from filling the pool forever.
This guide configures a GlobalProtect remote-access (SSL/TLS) VPN on a single Palo Alto firewall: remote users authenticate to a portal, download a client config, and connect through a gateway that drops them into an internal zone with an assigned IP. It is a set of GUI changes plus a commit — there is no shell script here, because on PAN-OS the correct path is the web interface, not a CLI hack.
This guide builds a read-only PowerShell script that enumerates your DHCP scopes, pulls the current IPv4 leases from each, writes them to a timestamped CSV, and (optionally) emails the file. It does not change any DHCP configuration — no scopes, reservations, options, or leases are created, modified, or deleted. The worst it can do is fill a disk with CSVs if you never prune them.
If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.
This guide builds a route-based site-to-site IPsec VPN on a Palo Alto firewall: an encrypted tunnel between your firewall and a remote peer so two private subnets can talk over the public internet. You configure it entirely as candidate configuration in the web GUI and make it live with a Commit .
This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.
This script applies one literal find-and-replace across every zone file in a directory (for example, retiring an old IP or NS name), bumps each changed zone's SOA serial so slaves pick up the change, validates every touched zone, and reloads BIND only if all of them pass . If any zone fails validation it restores the backups and aborts before touching the running server.
This guide creates two NAT policies on a Palo Alto firewall: a source NAT rule so hosts on your inside zone reach the internet behind the firewall's public interface address (hide-NAT / PAT), and a destination NAT rule that forwards an inbound public IP and port to an internal server (a port forward). Both change how traffic is translated and, paired with the security rules they require, change what traffic is allowed . A wrong NAT or a missing/overbroad security rule can expose an internal host or break outbound connectivity for a whole zone.
This guide builds a read-only report . The script enumerates the SMB shares on a Windows file server, then lists two things for each one: the share-level permissions (the "who can connect" layer) and the NTFS permissions on the folder behind it (the "who can touch the files" layer). It writes both to CSV so you can review access in a spreadsheet instead of clicking through the Security tab share by share.
