Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

SecurityLinux

PaperCut's RCE Chain Is a Reminder to Get Admin Consoles Off the Internet

Most of the people who read this blog run mail, not print servers, so let me be honest up front: if you don't have PaperCut NG or MF anywhere in your estate, you can close this tab. But a lot of us run it next to the mail infrastructure — it's the thing that meters departmental printing and holds scanned documents — and the way this one broke is worth understanding even if you're patched, because it rhymes with problems we already know from Zimbra.

3 min read
Security

Create and Manage Address Objects and Groups on Check Point R81.x

This guide creates and manages network objects — hosts, networks, address ranges — and gathers them into network groups in the Check Point management database. Those objects are the reusable building blocks you later reference in access rules and NAT. Creating an object by itself changes nothing on the gateway: the object does nothing until it is used in a rule and you Install Policy . The real risk is downstream — a wrong object dropped into an existing rule, or a policy install, can cut production traffic.

9 min read
WindowsSecurity

Find Disabled AD Users That Still Hold Group Membership

A disabled account is not a harmless account. If it still holds membership in security groups, it still carries the access rights those groups grant — file shares, application roles, delegated permissions. If that account is ever re-enabled (by mistake, or by an attacker who compromised a helpdesk process), it lights up with all its old access instantly. Periodically finding disabled users that still sit in security groups is a basic hygiene task, and it is easy to script.

8 min read
Security

Configure SSL Inspection and Certificate Pinning Exemptions on a FortiGate

This guide turns on SSL/TLS deep inspection on a FortiGate and then adds exemptions so that applications using certificate pinning (banking apps, Dropbox, Windows/Apple update services, and similar) keep working instead of failing silently. Deep inspection is a man-in-the-middle: the FortiGate decrypts HTTPS, scans it, and re-signs it with its own CA. That is powerful and also the single most disruptive thing you can enable on a firewall.

7 min read
MailWindows

Bulk-Update Exchange Mailbox Forwarding from a CSV

This guide sets mailbox-level forwarding (the ForwardingSmtpAddress / ForwardingAddress and DeliverToMailboxAndForward properties) on many mailboxes at once, reading the target address for each mailbox from a CSV file. It uses Set-Mailbox in Exchange Online PowerShell. This is not the same as an Outlook inbox rule — it is the server-side forwarding an admin sets, and it applies regardless of whether the user's Outlook is open.

8 min read
LinuxMailSecurity

Validate and Auto-Correct DMARC Records Across Domains

This guide builds a Python tool that looks up the _dmarc.<domain> TXT record for one or more domains, parses it, and reports where the DMARC policy is missing, malformed, or weaker than the baseline you set. In its default form it only reads DNS — it changes nothing. The optional second half pushes a corrected record through a DNS provider API (I use Cloudflare as the concrete example).

11 min read
Security

Synchronized Logging Across a Palo Alto HA Pair

This guide configures both members of a PAN-OS active/passive HA pair to forward their logs to a shared collector — an external syslog server (or Panorama) — so that no matter which unit is active, and no matter which one just failed over, you end up with one continuous log record. Be clear about what this is not : PAN-OS does not replicate the local log databases between HA peers. The active unit sees the traffic and writes traffic logs; the passive unit does not pass traffic and so has no traffic logs of its own. "Synchronized logging" here means both units point at the same external destination , and because HA config sync copies the running config to the peer, you configure it once on the active unit and the passive inherits it.

7 min read
Windows

Run Scheduled Tasks as SYSTEM With Highest Privileges

This guide creates a Windows scheduled task that runs a script non-interactively under NT AUTHORITY\SYSTEM with Run with highest privileges enabled. That combination gives the task the full rights of the local machine account and an unfiltered admin token — it is the most powerful context a local task can run in. Use it only for jobs that genuinely need it (patching, service restarts, disk maintenance), and keep the script it runs small and trusted, because anything that task does, it does with no guardrails.

8 min read
LinuxMail

Per-Domain Mail Volume Trends from Postfix Logs

This guide gives you a small Python 3 script that reads Postfix's delivery log lines, extracts the recipient domain and the delivery status ( sent , bounced , deferred , etc.) from each line, and prints a per-domain, per-day count as CSV so you can spot volume trends. It is read-only : it opens log files, counts lines, and writes nothing back to the system. It does not touch Postfix, the queue, or the logs themselves.

9 min read
SecurityLinuxMail

Three names on the KEV list, and why the kernel one is the one to chase

Two big enforcement stories broke on the same day, and both are worth reading, but neither is the thing that should change what you do this week. Help Net Security reported that the DOJ and FBI seized the infrastructure behind QScan and QTRouter , a pair of tools a Nanjing-linked outfit called QTFY used to build an obfuscation network out of hijacked IoT devices — the kind of story where NASA, the Federal Reserve and the U.S. Senate turn up on the victim list. Separately, Australian police, working with the FBI, arrested two men alleged to be part of TeamPCP , the crew that cloned the Shai-Hulud worm and poisoned open-source packages to harvest credentials at scale.

3 min read
Security

Enable and Configure IPS Signatures on a SonicWall (SonicOS 7)

This guide turns on Intrusion Prevention Service (IPS) on a SonicWall firewall running SonicOS 7 and sets what the firewall does when traffic matches a signature: log it (Detect) or drop it (Prevent). The purpose is to catch known exploit and attack traffic passing through the firewall.

6 min read
WindowsSecurity

Detect and Quarantine Suspicious File Extensions in Shared Folders

This guide builds a PowerShell script that scans an SMB shared folder for files whose extensions are commonly used to carry malware ( .exe , .scr , .js , .vbs , .bat , and so on), and moves any it finds into a locked-down quarantine folder outside the share, writing every action to a log. It is a crude, extension-based screen — a tripwire, not an antivirus engine. It does not inspect file contents and will not catch a malicious .docm or a renamed payload. Treat it as one layer, not the layer.

9 min read
Security

Two-Factor Admin Login on a Check Point Gaia Gateway

This guide points Gaia's administrator authentication (the WebUI, SSH, and console logins on a Check Point gateway) at an external RADIUS server that enforces a second factor — a push, an OTP, or an SMS code. The gateway itself has no built-in TOTP; it delegates authentication to RADIUS, and the RADIUS/MFA server is where the second factor actually lives. Get that mental model straight before you touch anything: if the RADIUS server is unreachable or misconfigured, admin login can fail.

6 min read