Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
Suricata is a deep-packet inspection engine. In IDS mode it watches a copy of the traffic on an interface and raises alerts; in IPS mode it actively blocks hosts or drops packets that match a rule. That second mode is the dangerous one: a noisy or badly tuned rule can block a legitimate host — including your own management workstation — and cut production traffic. Treat this as a change to a live firewall, not a lab toy.
This guide builds two small PowerShell scripts. The first captures the current Windows Firewall ruleset to a CSV baseline . The second re-reads the live rules and reports which ones were added, removed, or changed since that baseline. Both scripts are read-only — they use Get-* cmdlets only and change no firewall rules, so running the audit cannot break connectivity.
This script is a read-only audit . It walks your virtual mailbox tree and a couple of mail config directories and reports three things: mailbox files or directories that are readable or writable by group/other, mailbox files not owned by the expected mail user, config files that contain secrets but aren't locked down, and the service account's login shell. It changes nothing — no chmod , no chown , no account edits. Remediation is a separate, manual step at the end that you run deliberately, one finding at a time.
This guide builds a two-node pfSense high-availability (HA) pair: one primary firewall that carries traffic and one secondary that takes over automatically if the primary fails. CARP provides the shared virtual IP addresses your clients use as their gateway, pfsync copies the firewall state table between nodes so existing connections survive a failover, and XMLRPC config sync keeps the secondary's configuration in step with the primary.
An auditor asks the same question every year: who was in which distribution list on this date? Clicking through each group in the admin center does not scale past a handful of groups, and it produces nothing you can hand over. This guide scripts a clean, point-in-time CSV of every distribution group and its members.
This guide gives you a read-only Python script that parses a Postfix mail log and reports two things: authenticated senders (SASL users) who sent an unusually large number of messages or recipients — the classic signature of a compromised mailbox being used to blast spam — and source IPs that keep tripping "Relay access denied", which is relay probing. The script does not change anything : it reads the log, counts, and prints a report. It never touches Postfix config, never disables an account, never blocks an IP.
This guide sets up a read-only pull of the firewall's config.xml to a separate Linux host, scheduled nightly with cron, so you have off-box, dated copies of every configuration. The backup script itself never writes to the firewall — it only copies one file off it over SSH.
Before I start, one honesty note that shapes this whole guide: Active Directory has no merge operation . There is no Merge-ADUser cmdlet, and there never was. When people say "merge duplicate accounts," what they actually need is a repeatable process to find the duplicates, decide which one survives , copy the things that matter (mainly group memberships) onto the survivor , and then retire the other . That is what this guide automates. The detection half is safe and read-only. The consolidation half changes and can delete accounts, so it is gated hard.
The script below reads an X.509 certificate and prints a TLSA record . That is all it does: it computes a SHA-256 hash of the certificate's public key and formats it as a DNS TLSA resource record you can paste into your zone. It changes nothing on the machine, and it needs no elevated privileges — except that if your certificate file is only readable by root you will need sudo to read it.
If you run an on-premises Microsoft stack, SharePoint usually isn't the box you think about first — it sits next to Exchange, shares the same Active Directory, and gets patched on whatever cadence the Windows team keeps. This one is worth pulling forward, and not for the reason the headline gives.
This guide configures a Cisco AnyConnect (Secure Client) SSL remote-access VPN on an ASA so remote users can dial in, receive an internal IP from a pool, and reach inside subnets over an encrypted tunnel. It creates address pools, a group policy, a connection profile (tunnel-group), a split-tunnel ACL, a NAT exemption, and at least one VPN user.
On a busy Remote Desktop Session Host, local profiles pile up fast — every user who ever logged in leaves a folder under C:\Users , and a system drive fills quietly until logons start failing. This guide sets up an unattended, standard-supported cleanup of profiles that haven't been used in N days.
This sets up a weekly, unattended package upgrade on each server, then emails you a plain-text report of what was upgraded and whether a reboot is now pending. The upgrade step runs apt-get upgrade non-interactively, so it changes installed software on the host. Package upgrades are not cleanly reversible: apt has no "undo the last upgrade" button, so treat this with the same caution as any change to a running server.
