Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

Security

Configure Interface Monitoring and Failover Detection on a SonicWall HA Pair

By default a SonicWall HA pair fails over when the active unit dies outright — power loss, hardware fault, a crash that stops the heartbeat. What it does not do out of the box is fail over when a single data interface loses link or when the upstream next hop goes away but the appliance itself is fine. Interface monitoring closes that gap: you tell the cluster which interfaces matter, and optionally give it an upstream target to probe, so a dead WAN or a pulled LAN cable forces the standby to take over.

7 min read
Windows

Find AD Computer Accounts That Have No DNS Record

This guide gives you a read-only PowerShell script that lists every enabled AD computer account and flags the ones whose DNS A record can't be resolved — the classic symptom of a machine that was renamed, rebuilt, or removed without cleaning up DNS, or a zone where scavenging has drifted out of sync with AD. It reads AD and queries DNS; it does not create, change, or delete anything.

8 min read
LinuxMail

Automate Failover Testing Between Primary and Secondary Mail Servers

Having two MX hosts is not the same as knowing failover works. The only way to trust it is to test it: confirm both hosts answer on port 25 and accept mail for your domain, and once in a while prove that when the primary is down, the secondary still takes the message and holds it. This guide gives you a small probe script you can run on a schedule, and a controlled live drill for the real thing.

10 min read
SecurityLinux

A Gitea Code-Injection Bug Is Being Exploited — Patch, Then Assume the Worst

CISA added CVE-2026-60004 , described as a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog on 25 August 2026. The KEV listing is the important part: CISA doesn't add things to that catalog on theory. It adds them when there's evidence of active exploitation in the wild. So this isn't "a bug was disclosed" — it's "somebody is using this against real servers right now."

3 min read
Security

Set Up Syslog Export for Compliance Auditing on a Cisco ASA

This guide configures a Cisco ASA to send its event logs to a central syslog server (or SIEM) so you have off-box, timestamped audit evidence. It changes the firewall's logging configuration only — it does not touch access rules, NAT, or routing — but you are still editing a production security appliance, so treat it accordingly.

7 min read
Windows

Daily Group Policy Failure Report from the Event Logs

This guide builds a scheduled PowerShell script that reads the Group Policy operational event log, collects the error events from the last 24 hours, and writes them to an HTML file (optionally emailed). It is a reporting tool: it never edits, links, or unlinks a GPO, and it makes no change to any policy or to the events themselves. The only thing it creates on the system is a report file and — if you follow the last section — a scheduled task.

9 min read
LinuxMailSecurity

Audit Postfix for Open Relay Vulnerabilities with Bash

This script reads your Postfix relay-control settings with postconf and flags configurations that could let outsiders relay mail through your server — the classic "open relay" that gets you onto blocklists and turns your box into a spam cannon. It is read-only. It changes nothing, writes nothing, and reloads nothing , so there is no config to back up and nothing to roll back. It simply reports.

9 min read
Security

Configure AntiDDoS Protection on a Palo Alto Firewall

This guide configures two related Palo Alto features: a Zone Protection profile (broad, per-zone flood defence applied at the edge, before a session is even created) and a DoS Protection profile + policy rule (granular defence for specific servers). Their whole job is to drop traffic once a rate threshold is crossed. That is the point — and also the danger. Set a Max Rate too low and you will drop legitimate production traffic; enable a block action and you will hold that drop for the block duration.

6 min read
WindowsSecurity

Automate Reporting of Expiring IIS Certificates Across a Farm

This guide builds a read-only report. The script reaches each IIS server in your farm over PowerShell remoting, reads the HTTPS (SSL) bindings, looks up the bound certificate in the local machine store, and emails you a list of anything expiring within a threshold you set. It does not install, bind, delete, or renew any certificate, and it makes no change to IIS or the certificate store. The only thing that persists is a scheduled task, if you choose to create one — and I show you how to remove that at the end.

8 min read
LinuxMail

Monitor Dovecot Process Memory and Alert on Runaway Processes

This guide sets up a small bash script, run on a schedule, that reads the resident memory (RSS) of every process inside the dovecot.service cgroup and warns you when one crosses a threshold you set. It only reads and reports — it writes a line to syslog and optionally sends an email. It does not kill processes, change Dovecot config, or touch any mailbox.

8 min read
SecurityLinux

PaperCut's RCE Chain Is a Reminder to Get Admin Consoles Off the Internet

Most of the people who read this blog run mail, not print servers, so let me be honest up front: if you don't have PaperCut NG or MF anywhere in your estate, you can close this tab. But a lot of us run it next to the mail infrastructure — it's the thing that meters departmental printing and holds scanned documents — and the way this one broke is worth understanding even if you're patched, because it rhymes with problems we already know from Zimbra.

3 min read
Security

Create and Manage Address Objects and Groups on Check Point R81.x

This guide creates and manages network objects — hosts, networks, address ranges — and gathers them into network groups in the Check Point management database. Those objects are the reusable building blocks you later reference in access rules and NAT. Creating an object by itself changes nothing on the gateway: the object does nothing until it is used in a rule and you Install Policy . The real risk is downstream — a wrong object dropped into an existing rule, or a policy install, can cut production traffic.

9 min read
WindowsSecurity

Find Disabled AD Users That Still Hold Group Membership

A disabled account is not a harmless account. If it still holds membership in security groups, it still carries the access rights those groups grant — file shares, application roles, delegated permissions. If that account is ever re-enabled (by mistake, or by an attacker who compromised a helpdesk process), it lights up with all its old access instantly. Periodically finding disabled users that still sit in security groups is a basic hygiene task, and it is easy to script.

8 min read