Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
Arctic Wolf Labs, via The Hacker News , has tied a run of June 2026 intrusions to CVE-2026-0257 , an authentication bypass (CVSS 7.8) in the portal and gateway components of PAN-OS. The affiliates behind Qilin (also called Agenda) used it as their way in, then deployed ransomware. BleepingComputer reported the same activity.
This guide sets the security level on each ASA interface (its trust ranking, 0–100) and applies extended access lists to control which traffic is allowed into an interface. On an ASA, traffic from a higher-security interface to a lower one is permitted by default, but the moment you apply an inbound access-group to an interface, the ASA enforces that ACL and drops everything the ACL doesn't explicitly permit — there is an implicit deny ip any any at the end of every ACL. A single applied ACL can therefore cut production traffic and lock you out of management in one command.
This script is a read-only audit . It reports PASS/FAIL for a small set of well-known hardening settings — SMBv1 status, firewall profiles, Defender real-time protection, RDP Network Level Authentication, and the local Guest account — and writes the results to the screen and a CSV. It changes nothing. There is nothing to roll back, which is exactly why an audit script is the safe place to start before you touch any actual configuration.
This guide covers the everyday change-control workflow on a Palo Alto firewall: staging a change in the candidate configuration , previewing exactly what will change, committing it to the running configuration, reverting an uncommitted change, rolling back to a previous committed version, and using Config Audit to diff two versions. None of this is a script you paste in blind — it is the vendor's own commit model, driven from the web UI and the CLI.
This script reads every enabled AD user's password-expiry date, works out who expires within a window you set (say, the next 14 days), and emails each of those users a reminder. It reads Active Directory and sends mail — it does not change a single account, reset a password, or alter a policy. That makes it low-risk, but it can still misfire loudly: point it at the whole domain with a bad window and you can email hundreds of people at once, so treat the first live run as the dangerous part.
A full disk is one of those failures that takes half your services down at once — the mail queue stops, the database goes read-only, journald starts dropping entries — and it almost always announces itself in advance as a slowly climbing df percentage. This guide sets up a small, boring watchdog that checks free space and the biggest offenders under your log directories, then emails you before the disk is full instead of after.
This guide walks through building a URL Filtering security profile and adding App-ID application matching to a security policy rule on a standalone Palo Alto firewall, then attaching the profile to that rule so web traffic is classified by category and applications are matched by App-ID rather than by port. The purpose is to move from port-based rules toward application- and category-aware enforcement.
This guide builds a small PowerShell script that connects to a list of remote Windows PCs, reads their hardware and OS details (make, model, serial, CPU, RAM, disk free space, OS version, last boot), and writes one row per machine into a single CSV file. It is read-only. It queries WMI/CIM classes and creates no files, users, or registry keys on the remote machines, so there is nothing to undo on the targets — the only thing it writes is the CSV on your own machine.
This guide pushes a name-resolution change — either a static entry in /etc/hosts or an upstream DNS server change — to a group of servers at once using Ansible. Getting name resolution wrong across a fleet is one of the fastest ways to take down a whole environment: a bad /etc/hosts line or a dead DNS server means services can't find each other, monitoring goes dark, and package mirrors and time sync stop working.
A use-after-free landed on oss-security this week as CVE-2026-64564 , in the Linux kernel's SCTP code — specifically the ASCONF transport handling. The advisory and a follow-up describe it as local privilege escalation and container escape. Those two phrases are what make people forward a CVE to their whole team on a Friday, so it's worth stopping to ask what it actually means for the machines this blog is about: Postfix relays, Dovecot backends, Zimbra boxes, iRedMail stacks.
This guide covers three related tasks on a Palo Alto firewall: exporting a copy of the configuration off the box (a backup — completely safe, read-only), saving named snapshots on the box , and loading and committing a configuration (a restore — this changes the running config and can lock you out or drop production traffic ).
This guide sets the Automatic Replies (out-of-office) configuration on multiple mailboxes at once, using Set-MailboxAutoReplyConfiguration in Exchange Online PowerShell. It turns auto-reply on (or schedules it), and writes the internal and external message text. It does not delete mail, move anything, or change mailbox permissions — but it does overwrite whatever auto-reply text and state each affected mailbox currently has, and there is no built-in "undo" that restores the previous message. If a user had their own carefully worded reply set, this replaces it. So capture the current state first (I show how below) and treat the change list as production data.
This is a read-only reporting script . It reads your Postfix/Dovecot mail log and your Fail2ban log, extracts the source IPs behind SMTP SASL failures, Postfix rejects and Dovecot auth failures, cross-references them against the IPs Fail2ban actually banned, and prints one ranked summary. It does not touch your firewall, your jails, your mail queue, or any config. There is nothing to undo except deleting the report file and removing the cron entry you add at the end.
