Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
Shared-admin logins are the quiet risk in a lot of Check Point estates: everyone SSHes in as admin , everyone can do everything, and nobody can tell afterward who changed the routing table. Gaia's Role-Based Administration (RBA) fixes that at the OS level. This guide walks the standard clish procedure to create named accounts that can see or change only what their job requires.
When you delete a mailbox, the forwarding that pointed at it from elsewhere doesn't clean itself up. A mailbox with ForwardingAddress set to a now-deleted user, or an inbox rule in someone else's mailbox that redirects to a departed colleague, just quietly starts dropping or bouncing mail. This guide scans the whole tenant for that leftover forwarding, reports it, and removes the mailbox-level cases safely.
This guide builds a small bash script that queries your live DNS once a day and compares the MX , A , and AAAA records it gets back against the values you declare in a config file. If they don't match, it emails you. That's all it does.
This week produced two separate Linux kernel stories that are very easy to mash into one, and the triage note that landed on my desk did exactly that. They are not the same bug, they do not carry the same urgency, and treating them as one leads you to patch the wrong thing first. Let me pull them apart.
This guide configures Bandwidth Management (BWM) on a SonicWall running SonicOS 7 so that chosen traffic — VoIP, a line-of-business app, backups — gets a guaranteed or higher-priority slice of your WAN link, and everything else yields to it. BWM is the SonicWall's own internal QoS engine; it shapes traffic as it crosses the firewall. (The separate 802.1p / DSCP marking features ask downstream switches and your ISP to honour a priority tag — that is a different, additive topic I'll point to but not walk through.)
This guide builds a scheduled PowerShell job that reads the Security event log on every domain controller, pulls failed-logon events (Event ID 4625 ) from the previous day, keeps only the ones that happened outside your defined business hours (and optionally on weekends), and writes them to a dated CSV. Optionally it emails the file. It is a reporting job — it reads logs and writes a report file. It does not change Active Directory, disable accounts, or touch any policy.
Password-guessing against the submission port (587) is constant background noise on any internet-facing mail server. Each attempt shows up in your mail log as a SASL authentication failure, and the standard, boring, reliable way to act on a pattern of them is Fail2ban: it tails the log, counts failures per source IP, bans the IP in your firewall, and can email you when it does. This guide wires that up for the submission service specifically.
This guide locks down a bridged interface on a Cisco ASA so that only frames from MAC addresses you have explicitly listed are forwarded . You do it by adding static MAC entries for your approved devices and then turning off dynamic MAC learning on that interface, so anything the ASA hasn't been told about is silently dropped.
This guide turns on "Password must meet complexity requirements" for local accounts on a Windows machine, and shows how to set the related length and age rules in the same pass. It does it by exporting the local security policy to a text template with secedit , editing one line, and importing it back.
This guide builds a small bash script that reads your Postfix virtual-table configuration, copies the source files behind each file-based map ( hash: , lmdb: , btree: , cdb: , texthash: ) plus main.cf and master.cf , bundles them into a tarball, and encrypts that tarball with GnuPG so you can store it off-box safely. The purpose is a routine, restorable snapshot of your mail routing and alias data.
On 26 October, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog and refreshed its earlier PHP alert ("Critical Vulnerabilities in PHP Require Immediate Patching," from 21 October):
This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit , and commit is the point where your changes become live.
In a multi-domain forest, group membership sprawls across domain boundaries over the years: a universal or domain-local group in corp ends up holding users from emea , or Foreign Security Principals (FSPs) from a trusted external forest that nobody remembers adding. Before you clean any of that up, you need an accurate inventory. This guide gives you a read-only report of every group in one domain that contains members from another domain, plus a carefully gated way to remove the ones you've decided to drop.
