Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
On 26 October, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog and refreshed its earlier PHP alert ("Critical Vulnerabilities in PHP Require Immediate Patching," from 21 October):
This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit , and commit is the point where your changes become live.
In a multi-domain forest, group membership sprawls across domain boundaries over the years: a universal or domain-local group in corp ends up holding users from emea , or Foreign Security Principals (FSPs) from a trusted external forest that nobody remembers adding. Before you clean any of that up, you need an accurate inventory. This guide gives you a read-only report of every group in one domain that contains members from another domain, plus a carefully gated way to remove the ones you've decided to drop.
A mail server with a missing or mismatched PTR record gets its mail deferred or rejected by the big providers. This guide gives you one small bash script that does two jobs: generate the PTR records you (or your IP owner) need to publish, and validate that what is published is correct — including the forward-confirmed reverse DNS (FCrDNS) check that mail servers actually care about.
This covers the three NAT jobs you actually do on a Check Point gateway: outbound Hide NAT so an internal network reaches the internet behind one address, a Static NAT one-to-one mapping for a published server, and a NAT exemption (no-NAT) rule so site-to-site VPN traffic is not translated. The exemption is the one people get wrong, and the one that quietly breaks a VPN.
Group Policy failures are quiet. A client silently stops applying a GPO, the setting it was enforcing drifts, and nobody notices until something breaks. This guide builds a scheduled report that reads each computer's Group Policy error events, groups them by computer and (where the event names it) by GPO, and drops a CSV and HTML file somewhere you'll actually look.
A memory-corruption bug in Google's Brotli decoder, CVE-2026-111497, got the scary framing it deserves — The Hacker News leads with the Node.js RCE and the long tail of affected software, and the oss-security list carried the coordination thread. Before you start grepping your mail stack in a panic, though, let me narrow the blast radius, because the triage instinct ("Brotli is in TLS, so my mail TLS is exposed") is wrong.
This guide builds interface-based traffic shaping on a FortiGate: you define traffic classes (the "queues"), group them into a shaping profile that gives each class a guaranteed floor and a maximum ceiling of the link's bandwidth, apply that profile to an egress interface, then steer traffic into the right class with a shaping policy. The purpose is simple QoS — keep latency-sensitive traffic (VoIP, for example) from being drowned out by bulk downloads.
Share permissions drift. Someone grants a contractor "just temporary" access, a helpdesk ticket adds a group to a folder, an app installer rewrites an ACL — and six months later nobody remembers why Everyone can write to the finance share. This guide builds a simple, read-only baseline of your NTFS share ACLs and a weekly job that tells you exactly what has changed since.
Postfix is good at retrying mail on its own, but over time a busy server collects two kinds of junk in its spool: messages that have been deferred for days and will never deliver, and partial or misplaced files left behind by a crash or an abrupt restart. This guide sets up a safe, scheduled cleanup for both — using Postfix's own tools, not manual file surgery.
By default a SonicWall HA pair fails over when the active unit dies outright — power loss, hardware fault, a crash that stops the heartbeat. What it does not do out of the box is fail over when a single data interface loses link or when the upstream next hop goes away but the appliance itself is fine. Interface monitoring closes that gap: you tell the cluster which interfaces matter, and optionally give it an upstream target to probe, so a dead WAN or a pulled LAN cable forces the standby to take over.
This guide gives you a read-only PowerShell script that lists every enabled AD computer account and flags the ones whose DNS A record can't be resolved — the classic symptom of a machine that was renamed, rebuilt, or removed without cleaning up DNS, or a zone where scavenging has drifted out of sync with AD. It reads AD and queries DNS; it does not create, change, or delete anything.
Having two MX hosts is not the same as knowing failover works. The only way to trust it is to test it: confirm both hosts answer on port 25 and accept mail for your domain, and once in a while prove that when the primary is down, the secondary still takes the message and holds it. This guide gives you a small probe script you can run on a schedule, and a controlled live drill for the real thing.
