Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide builds an Access Control policy in SmartConsole and installs it onto a Check Point Security Gateway. Building the policy touches only the management database; installing it is the moment that changes how the gateway forwards traffic. A policy that ends in the implicit cleanup drop, or one that removes the rule you rely on, can cut production traffic and lock you out of management in one push.
This guide builds and deploys Windows Defender Firewall rules from a table (a CSV), using the NetSecurity PowerShell module, with netsh advfirewall shown as the older equivalent. The goal is a repeatable, idempotent way to push the same rule set to one host or many, instead of clicking through wf.msc on each box.
The standard, boring way to block IPs that hammer your mail server is Fail2ban. It watches the mail log, counts matching failures per source IP inside a time window, and when a source crosses a threshold it inserts a firewall rule to drop that IP for a while. You could write a bash script that greps the log and pipes IPs into nft , and I'll say where that fits at the end — but reinventing Fail2ban is more error-prone than configuring it, so that's what this guide does.
This guide publishes one internal server on one port to the internet through a SonicWall. You will create an address object for the server, pick or create a service (port) object, add an inbound NAT policy that rewrites the destination to the internal host, and add a WAN→LAN access rule that permits the traffic. Both pieces are required: the NAT policy alone forwards nothing without the matching access rule.
This guide builds a script that connects to a list of remote Windows machines over PowerShell remoting (WinRM), reads the "installed programs" data out of each machine's registry, and writes one combined CSV inventory. It is read-only : it queries registry keys and creates a CSV on your admin workstation. It does not install, uninstall, or change anything on the target machines.
Everything in this guide is read-only . The awk , sort , and uniq commands here only read the Nginx access log and print summaries to your terminal — they do not modify, rotate, or delete the log, and they change nothing on the server. There is nothing to undo.
If you run Zimbra Collaboration and you've been putting off the 10.1 upgrade, the joint advisory from NSA, CISA and partners this week should end that debate. A Russian state-backed group — tracked variously as TA488, CL-STA-1114, and mapped loosely to LAUNDRY BEAR and Void Blizzard — spent roughly five months of 2025 reading Western mailboxes through CVE-2025-66376 , a stored XSS bug in the Classic Web Client that Zimbra didn't fix until 6 November 2025. As reported by The Hacker News and corroborated by BleepingComputer, the whole thing fired when a user viewed the message. No click, no attachment, no download.
SafeMode is SonicWall's out-of-band recovery boot. You enter it with the physical reset button, and from a small web page on the appliance you can reboot the current firmware, boot a backup image, upload firmware, export settings, or boot with factory default settings — which wipes the running configuration back to out-of-the-box defaults. This guide covers using SafeMode to factory reset and recover a firewall you're locked out of, or one whose config or firmware is corrupt.
Some services don't crash cleanly. The process stays alive, systemctl still calls it active , but it has stopped answering — a wedged worker pool, a deadlocked thread, a leaked connection table. systemd's own Restart=on-failure handles a process that exits , but it won't help you with one that's technically running and doing nothing. This guide sets up a periodic health check that catches that case, restarts the unit when it's genuinely stuck, and logs every decision so you can prove what happened at 3 a.m.
This guide has two parts. The check part is a read-only script that queries DNS for your published DKIM record and confirms it still matches the private key OpenDKIM signs with — safe to run any time, and safe to put on cron. The renewal part generates a new key under a new selector, has you publish a DNS record, and then switches signing over to it.
This guide turns on SonicWall's Content Filtering Service (CFS): the firewall inspects outbound HTTP/HTTPS requests, looks the destination category up against SonicWall's cloud database, and blocks or allows the request based on a profile you define. The purpose is category-based web filtering for a specific zone (typically your LAN).
This is a cmd.exe batch file that renames files in one folder by find-and-replace: it takes every file matching a mask (say *.txt ), swaps a substring in the filename (say draft → final ), and renames it. Its purpose is bulk cleanup of filenames — removing a stray word, fixing a prefix, changing a spelling — without you clicking through Explorer.
This sets up an unattended nightly job that dumps your MySQL/MariaDB databases and tars up a couple of directories, uploads both to an S3-compatible bucket with rclone , and then deletes backups in that bucket older than a retention window. Its purpose is a hands-off off-site copy that prunes itself so the bucket doesn't grow forever.
