Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This week produced two separate Linux kernel stories that are very easy to mash into one, and the triage note that landed on my desk did exactly that. They are not the same bug, they do not carry the same urgency, and treating them as one leads you to patch the wrong thing first. Let me pull them apart.
This guide configures Bandwidth Management (BWM) on a SonicWall running SonicOS 7 so that chosen traffic — VoIP, a line-of-business app, backups — gets a guaranteed or higher-priority slice of your WAN link, and everything else yields to it. BWM is the SonicWall's own internal QoS engine; it shapes traffic as it crosses the firewall. (The separate 802.1p / DSCP marking features ask downstream switches and your ISP to honour a priority tag — that is a different, additive topic I'll point to but not walk through.)
This guide builds a scheduled PowerShell job that reads the Security event log on every domain controller, pulls failed-logon events (Event ID 4625 ) from the previous day, keeps only the ones that happened outside your defined business hours (and optionally on weekends), and writes them to a dated CSV. Optionally it emails the file. It is a reporting job — it reads logs and writes a report file. It does not change Active Directory, disable accounts, or touch any policy.
Password-guessing against the submission port (587) is constant background noise on any internet-facing mail server. Each attempt shows up in your mail log as a SASL authentication failure, and the standard, boring, reliable way to act on a pattern of them is Fail2ban: it tails the log, counts failures per source IP, bans the IP in your firewall, and can email you when it does. This guide wires that up for the submission service specifically.
This guide locks down a bridged interface on a Cisco ASA so that only frames from MAC addresses you have explicitly listed are forwarded . You do it by adding static MAC entries for your approved devices and then turning off dynamic MAC learning on that interface, so anything the ASA hasn't been told about is silently dropped.
This guide turns on "Password must meet complexity requirements" for local accounts on a Windows machine, and shows how to set the related length and age rules in the same pass. It does it by exporting the local security policy to a text template with secedit , editing one line, and importing it back.
This guide builds a small bash script that reads your Postfix virtual-table configuration, copies the source files behind each file-based map ( hash: , lmdb: , btree: , cdb: , texthash: ) plus main.cf and master.cf , bundles them into a tarball, and encrypts that tarball with GnuPG so you can store it off-box safely. The purpose is a routine, restorable snapshot of your mail routing and alias data.
On 26 October, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog and refreshed its earlier PHP alert ("Critical Vulnerabilities in PHP Require Immediate Patching," from 21 October):
This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit , and commit is the point where your changes become live.
In a multi-domain forest, group membership sprawls across domain boundaries over the years: a universal or domain-local group in corp ends up holding users from emea , or Foreign Security Principals (FSPs) from a trusted external forest that nobody remembers adding. Before you clean any of that up, you need an accurate inventory. This guide gives you a read-only report of every group in one domain that contains members from another domain, plus a carefully gated way to remove the ones you've decided to drop.
A mail server with a missing or mismatched PTR record gets its mail deferred or rejected by the big providers. This guide gives you one small bash script that does two jobs: generate the PTR records you (or your IP owner) need to publish, and validate that what is published is correct — including the forward-confirmed reverse DNS (FCrDNS) check that mail servers actually care about.
This covers the three NAT jobs you actually do on a Check Point gateway: outbound Hide NAT so an internal network reaches the internet behind one address, a Static NAT one-to-one mapping for a published server, and a NAT exemption (no-NAT) rule so site-to-site VPN traffic is not translated. The exemption is the one people get wrong, and the one that quietly breaks a VPN.
Group Policy failures are quiet. A client silently stops applying a GPO, the setting it was enforcing drifts, and nobody notices until something breaks. This guide builds a scheduled report that reads each computer's Group Policy error events, groups them by computer and (where the event names it) by GPO, and drops a CSV and HTML file somewhere you'll actually look.
