Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide pairs two identical Palo Alto firewalls into an active-passive HA cluster : one firewall passes all traffic while the other sits in sync and takes over if the active one fails, reboots, or loses a monitored link. It does not load-balance — the passive box carries no production traffic until failover.
This guide installs Sanoid and configures it to take ZFS snapshots on a schedule (hourly, daily, monthly) and to automatically destroy snapshots older than the retention you set. Snapshots are your cheap, instant, on-box rollback points; the pruning half is what stops them from filling the pool forever.
This guide configures a GlobalProtect remote-access (SSL/TLS) VPN on a single Palo Alto firewall: remote users authenticate to a portal, download a client config, and connect through a gateway that drops them into an internal zone with an assigned IP. It is a set of GUI changes plus a commit — there is no shell script here, because on PAN-OS the correct path is the web interface, not a CLI hack.
This guide builds a read-only PowerShell script that enumerates your DHCP scopes, pulls the current IPv4 leases from each, writes them to a timestamped CSV, and (optionally) emails the file. It does not change any DHCP configuration — no scopes, reservations, options, or leases are created, modified, or deleted. The worst it can do is fill a disk with CSVs if you never prune them.
If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.
This guide builds a route-based site-to-site IPsec VPN on a Palo Alto firewall: an encrypted tunnel between your firewall and a remote peer so two private subnets can talk over the public internet. You configure it entirely as candidate configuration in the web GUI and make it live with a Commit .
This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.
This script applies one literal find-and-replace across every zone file in a directory (for example, retiring an old IP or NS name), bumps each changed zone's SOA serial so slaves pick up the change, validates every touched zone, and reloads BIND only if all of them pass . If any zone fails validation it restores the backups and aborts before touching the running server.
This guide creates two NAT policies on a Palo Alto firewall: a source NAT rule so hosts on your inside zone reach the internet behind the firewall's public interface address (hide-NAT / PAT), and a destination NAT rule that forwards an inbound public IP and port to an internal server (a port forward). Both change how traffic is translated and, paired with the security rules they require, change what traffic is allowed . A wrong NAT or a missing/overbroad security rule can expose an internal host or break outbound connectivity for a whole zone.
This guide builds a read-only report . The script enumerates the SMB shares on a Windows file server, then lists two things for each one: the share-level permissions (the "who can connect" layer) and the NTFS permissions on the folder behind it (the "who can touch the files" layer). It writes both to CSV so you can review access in a spreadsheet instead of clicking through the Security tab share by share.
This guide sets up a dead man's switch for a cron job: the job pings an external monitor every time it runs, and if that ping is late or reports a non-zero exit, the monitor pages you. It exists to catch the failure mode plain cron misses entirely — a job that silently never ran , or ran and failed on a box whose mail is broken.
CISA put two WordPress core flaws into its Known Exploited Vulnerabilities catalogue on 21 July, alongside a DD-WRT overflow and a Langflow bug. The pair that matters here — CVE-2026-63030 and CVE-2026-60137, chained under the name wp2shell — gives an anonymous attacker remote code execution against a stock WordPress install with a single HTTP request. No login, no plugin, no theme required. By the reporting in The Hacker News, exploitation was underway within hours of the public proof-of-concept, and watchTowr's honeypots logged tens of thousands of attempts.
This guide adds a Security policy rule to a Palo Alto Networks firewall running PAN-OS 11.x , managed locally (not from Panorama). A Security rule decides which sessions between zones are allowed or denied, in top-down order. Adding, reordering, or misscoping a rule changes what traffic passes the firewall the moment you commit , so a mistake here can either open a hole or cut production traffic — including your own management session.
