Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

SecurityLinuxMail

Three names on the KEV list, and why the kernel one is the one to chase

Two big enforcement stories broke on the same day, and both are worth reading, but neither is the thing that should change what you do this week. Help Net Security reported that the DOJ and FBI seized the infrastructure behind QScan and QTRouter , a pair of tools a Nanjing-linked outfit called QTFY used to build an obfuscation network out of hijacked IoT devices — the kind of story where NASA, the Federal Reserve and the U.S. Senate turn up on the victim list. Separately, Australian police, working with the FBI, arrested two men alleged to be part of TeamPCP , the crew that cloned the Shai-Hulud worm and poisoned open-source packages to harvest credentials at scale.

3 min read
Security

Enable and Configure IPS Signatures on a SonicWall (SonicOS 7)

This guide turns on Intrusion Prevention Service (IPS) on a SonicWall firewall running SonicOS 7 and sets what the firewall does when traffic matches a signature: log it (Detect) or drop it (Prevent). The purpose is to catch known exploit and attack traffic passing through the firewall.

6 min read
WindowsSecurity

Detect and Quarantine Suspicious File Extensions in Shared Folders

This guide builds a PowerShell script that scans an SMB shared folder for files whose extensions are commonly used to carry malware ( .exe , .scr , .js , .vbs , .bat , and so on), and moves any it finds into a locked-down quarantine folder outside the share, writing every action to a log. It is a crude, extension-based screen — a tripwire, not an antivirus engine. It does not inspect file contents and will not catch a malicious .docm or a renamed payload. Treat it as one layer, not the layer.

9 min read
Security

Two-Factor Admin Login on a Check Point Gaia Gateway

This guide points Gaia's administrator authentication (the WebUI, SSH, and console logins on a Check Point gateway) at an external RADIUS server that enforces a second factor — a push, an OTP, or an SMS code. The gateway itself has no built-in TOTP; it delegates authentication to RADIUS, and the RADIUS/MFA server is where the second factor actually lives. Get that mental model straight before you touch anything: if the RADIUS server is unreachable or misconfigured, admin login can fail.

6 min read
MailSecurity

Remove Stale Exchange Mailbox Delegates and Restore Security

This guide finds and removes delegate access that a former or reassigned user still holds on other people's mailboxes in Exchange Online — the four kinds that actually let one account read or send as another: Full Access , Send As , Send on Behalf , and folder-level (calendar) delegate permissions. Its purpose is offboarding hygiene: when someone leaves or changes roles, their standing access to shared and personal mailboxes should go with them.

9 min read
MailLinux

Report Mail Users Over Quota with Cron

This is a read-and-report job. It runs doveadm quota get to list every mail user's quota usage, picks out the ones over a percentage you set, and emails you a summary. It does not change quotas, delete mail, or touch mailboxes — nothing here is destructive.

9 min read
MailSecurity

The Zimbra SNMP hole: who's actually exposed to CVE-2026-73570

Shadowserver's scans put the count at 274 internet-facing Zimbra instances already compromised through CVE-2026-73570, up from 155 flagged on August 20. That's the headline, and both Help Net Security and BleepingComputer reported it on the same Monday. If you run Zimbra Collaboration Suite on the public internet and you haven't moved to v10.1.20, this is your problem now, not next sprint.

3 min read
Security

Traffic Shaping and Bandwidth Management on a Palo Alto Firewall

This guide sets up QoS (Quality of Service) on a Palo Alto firewall so you can guarantee bandwidth to important traffic (say VoIP), cap bandwidth for greedy traffic (backups, streaming), and prioritise real-time flows during congestion. QoS on PAN-OS is enforced on the egress direction of an interface, which is the single most important thing to understand before you build anything — I cover it below.

6 min read
WindowsSecurity

Automate NTFS Permission Audits and Detect Oversharing on File Servers

This guide gives you a PowerShell script that walks a share tree, reads the NTFS access control list (ACL) on each folder, and reports every place where a broad identity — Everyone , Authenticated Users , Domain Users , BUILTIN\Users — has been granted Write, Modify, or Full Control. That combination is the classic definition of "oversharing," and this script's only job is to find it and write it to a CSV. It reads permissions. It does not change a single ACE.

9 min read
Linux

Monitor systemd Socket Activation and Alert on Queue Depth

When systemd hands a listening socket to a service, the kernel keeps completed connections in an accept queue until the service calls accept() on them. If the service falls behind — thread-starved, blocked on a slow database, whatever — that queue fills. Past the socket's backlog it silently drops or refuses connections. This guide sets up a small, read-only monitor that watches the accept-queue depth on your listening sockets and raises an alert before you hit that wall.

9 min read
Security

Configure DNS Security and Threat Prevention on a FortiGate (FortiOS 7.x)

This guide configures the FortiGate's own DNS resolver to use FortiGuard servers, builds a DNS Filter security profile (FortiGuard category blocking, botnet C&C domain blocking, and an optional static domain block list), and applies that profile to an outbound firewall policy. The purpose is to stop clients from resolving known-malicious, botnet, and unwanted-category domains before a connection is ever made.

8 min read
WindowsSecurity

A Daily Report of Failed RDP Logons Across Your Servers

This guide builds a read-only PowerShell script that pulls failed logon events (Security log Event ID 4625 ) from a list of servers, keeps the ones that look like RDP attempts, and writes them to a dated HTML/CSV report you can review each morning. It optionally emails that report. It creates nothing and deletes nothing on the target servers — it only reads their Security logs.

10 min read
MailLinux

Automate Postfix Transport Map Updates Without Downtime

This guide gives you a small bash script that rebuilds a Postfix transport map from its flat-file source, validates the configuration, and reloads Postfix so the new routing takes effect. postfix reload re-reads configuration and recycles daemons gracefully — it does not drop in-flight SMTP connections or stop the queue, which is why we use it instead of restart .

8 min read