Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
A mail loop is a message that never lands: a misconfigured relay that points back at itself, two autoresponders bouncing the same notice back and forth, or a forward that feeds an address into its own alias. Postfix leaves clear fingerprints for this in its log, and a small parser turns those fingerprints into a report you can read in the morning.
Barracuda has published details of two vulnerabilities that, chained together, hand an attacker root on the appliance. The Hacker News has the full breakdown; BleepingComputer corroborates the disclosure. If you run a Barracuda Email Security Gateway in front of your mail flow — and plenty of shops still do, sitting it ahead of Postfix or a Zimbra edge — this is worth ten minutes of your attention today. But read past the CVSS scores before you panic, because the two numbers tell you more about how you're exposed than whether you're doomed.
Shared-admin logins are the quiet risk in a lot of Check Point estates: everyone SSHes in as admin , everyone can do everything, and nobody can tell afterward who changed the routing table. Gaia's Role-Based Administration (RBA) fixes that at the OS level. This guide walks the standard clish procedure to create named accounts that can see or change only what their job requires.
When you delete a mailbox, the forwarding that pointed at it from elsewhere doesn't clean itself up. A mailbox with ForwardingAddress set to a now-deleted user, or an inbox rule in someone else's mailbox that redirects to a departed colleague, just quietly starts dropping or bouncing mail. This guide scans the whole tenant for that leftover forwarding, reports it, and removes the mailbox-level cases safely.
This guide builds a small bash script that queries your live DNS once a day and compares the MX , A , and AAAA records it gets back against the values you declare in a config file. If they don't match, it emails you. That's all it does.
This week produced two separate Linux kernel stories that are very easy to mash into one, and the triage note that landed on my desk did exactly that. They are not the same bug, they do not carry the same urgency, and treating them as one leads you to patch the wrong thing first. Let me pull them apart.
This guide configures Bandwidth Management (BWM) on a SonicWall running SonicOS 7 so that chosen traffic — VoIP, a line-of-business app, backups — gets a guaranteed or higher-priority slice of your WAN link, and everything else yields to it. BWM is the SonicWall's own internal QoS engine; it shapes traffic as it crosses the firewall. (The separate 802.1p / DSCP marking features ask downstream switches and your ISP to honour a priority tag — that is a different, additive topic I'll point to but not walk through.)
This guide builds a scheduled PowerShell job that reads the Security event log on every domain controller, pulls failed-logon events (Event ID 4625 ) from the previous day, keeps only the ones that happened outside your defined business hours (and optionally on weekends), and writes them to a dated CSV. Optionally it emails the file. It is a reporting job — it reads logs and writes a report file. It does not change Active Directory, disable accounts, or touch any policy.
Password-guessing against the submission port (587) is constant background noise on any internet-facing mail server. Each attempt shows up in your mail log as a SASL authentication failure, and the standard, boring, reliable way to act on a pattern of them is Fail2ban: it tails the log, counts failures per source IP, bans the IP in your firewall, and can email you when it does. This guide wires that up for the submission service specifically.
This guide locks down a bridged interface on a Cisco ASA so that only frames from MAC addresses you have explicitly listed are forwarded . You do it by adding static MAC entries for your approved devices and then turning off dynamic MAC learning on that interface, so anything the ASA hasn't been told about is silently dropped.
This guide turns on "Password must meet complexity requirements" for local accounts on a Windows machine, and shows how to set the related length and age rules in the same pass. It does it by exporting the local security policy to a text template with secedit , editing one line, and importing it back.
This guide builds a small bash script that reads your Postfix virtual-table configuration, copies the source files behind each file-based map ( hash: , lmdb: , btree: , cdb: , texthash: ) plus main.cf and master.cf , bundles them into a tarball, and encrypts that tarball with GnuPG so you can store it off-box safely. The purpose is a routine, restorable snapshot of your mail routing and alias data.
On 26 October, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog and refreshed its earlier PHP alert ("Critical Vulnerabilities in PHP Require Immediate Patching," from 21 October):
