Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

LinuxSecurity

The SCTP Use-After-Free You Probably Don't Run — But Might Load

A use-after-free landed on oss-security this week as CVE-2026-64564 , in the Linux kernel's SCTP code — specifically the ASCONF transport handling. The advisory and a follow-up describe it as local privilege escalation and container escape. Those two phrases are what make people forward a CVE to their whole team on a Friday, so it's worth stopping to ask what it actually means for the machines this blog is about: Postfix relays, Dovecot backends, Zimbra boxes, iRedMail stacks.

3 min read
Security

Back Up, Export, and Restore a Palo Alto Configuration

This guide covers three related tasks on a Palo Alto firewall: exporting a copy of the configuration off the box (a backup — completely safe, read-only), saving named snapshots on the box , and loading and committing a configuration (a restore — this changes the running config and can lock you out or drop production traffic ).

7 min read
WindowsMail

Bulk-Set Out-of-Office Auto-Replies with Exchange PowerShell

This guide sets the Automatic Replies (out-of-office) configuration on multiple mailboxes at once, using Set-MailboxAutoReplyConfiguration in Exchange Online PowerShell. It turns auto-reply on (or schedules it), and writes the internal and external message text. It does not delete mail, move anything, or change mailbox permissions — but it does overwrite whatever auto-reply text and state each affected mailbox currently has, and there is no built-in "undo" that restores the previous message. If a user had their own carefully worded reply set, this replaces it. So capture the current state first (I show how below) and treat the change list as production data.

8 min read
LinuxSecurityMail

Correlate Fail2ban, Postfix and Dovecot Logs Into One Report

This is a read-only reporting script . It reads your Postfix/Dovecot mail log and your Fail2ban log, extracts the source IPs behind SMTP SASL failures, Postfix rejects and Dovecot auth failures, cross-references them against the IPs Fail2ban actually banned, and prints one ranked summary. It does not touch your firewall, your jails, your mail queue, or any config. There is nothing to undo except deleting the report file and removing the cron entry you add at the end.

10 min read
Security

Set Up Active-Passive HA on a Palo Alto Firewall Pair

This guide pairs two identical Palo Alto firewalls into an active-passive HA cluster : one firewall passes all traffic while the other sits in sync and takes over if the active one fails, reboots, or loses a monitored link. It does not load-balance — the passive box carries no production traffic until failover.

6 min read
Linux

Schedule Automatic ZFS Snapshots and Pruning with Sanoid

This guide installs Sanoid and configures it to take ZFS snapshots on a schedule (hourly, daily, monthly) and to automatically destroy snapshots older than the retention you set. Snapshots are your cheap, instant, on-box rollback points; the pruning half is what stops them from filling the pool forever.

9 min read
Security

Configure GlobalProtect Remote Access VPN on Palo Alto

This guide configures a GlobalProtect remote-access (SSL/TLS) VPN on a single Palo Alto firewall: remote users authenticate to a portal, download a client config, and connect through a gateway that drops them into an internal zone with an assigned IP. It is a set of GUI changes plus a commit — there is no shell script here, because on PAN-OS the correct path is the web interface, not a CLI hack.

6 min read
Windows

Automate DHCP Lease Reporting on Windows Server

This guide builds a read-only PowerShell script that enumerates your DHCP scopes, pulls the current IPv4 leases from each, writes them to a timestamped CSV, and (optionally) emails the file. It does not change any DHCP configuration — no scopes, reservations, options, or leases are created, modified, or deleted. The worst it can do is fill a disk with CSVs if you never prune them.

9 min read
SecurityWindows

When the Patch Wasn't the Patch: N-central's Auth Bypass Redux

If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.

3 min read
Security

Set Up a Site-to-Site IPsec VPN on a Palo Alto Firewall

This guide builds a route-based site-to-site IPsec VPN on a Palo Alto firewall: an encrypted tunnel between your firewall and a remote peer so two private subnets can talk over the public internet. You configure it entirely as candidate configuration in the web GUI and make it live with a Commit .

7 min read
WindowsSecurity

Automate a Daily Failed-Logon (4625) Report with PowerShell

This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.

9 min read
Linux

Bulk-Update BIND Zone Files and Reload Safely with a Script

This script applies one literal find-and-replace across every zone file in a directory (for example, retiring an old IP or NS name), bumps each changed zone's SOA serial so slaves pick up the change, validates every touched zone, and reloads BIND only if all of them pass . If any zone fails validation it restores the backups and aborts before touching the running server.

9 min read
Security

Configure Source and Destination NAT on a Palo Alto Firewall

This guide creates two NAT policies on a Palo Alto firewall: a source NAT rule so hosts on your inside zone reach the internet behind the firewall's public interface address (hide-NAT / PAT), and a destination NAT rule that forwards an inbound public IP and port to an internal server (a port forward). Both change how traffic is translated and, paired with the security rules they require, change what traffic is allowed . A wrong NAT or a missing/overbroad security rule can expose an internal host or break outbound connectivity for a whole zone.

7 min read