Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

WindowsSecurity

Automate a Windows Server Hardening Baseline Check with PowerShell

This script is a read-only audit . It reports PASS/FAIL for a small set of well-known hardening settings — SMBv1 status, firewall profiles, Defender real-time protection, RDP Network Level Authentication, and the local Guest account — and writes the results to the screen and a CSV. It changes nothing. There is nothing to roll back, which is exactly why an audit script is the safe place to start before you touch any actual configuration.

9 min read
Security

Commit, Revert, and Audit Configuration Changes on Palo Alto

This guide covers the everyday change-control workflow on a Palo Alto firewall: staging a change in the candidate configuration , previewing exactly what will change, committing it to the running configuration, reverting an uncommitted change, rolling back to a previous committed version, and using Config Audit to diff two versions. None of this is a script you paste in blind — it is the vendor's own commit model, driven from the web UI and the CLI.

7 min read
Windows

Automate Expiring AD Password Notifications with PowerShell

This script reads every enabled AD user's password-expiry date, works out who expires within a window you set (say, the next 14 days), and emails each of those users a reminder. It reads Active Directory and sends mail — it does not change a single account, reset a password, or alter a policy. That makes it low-risk, but it can still misfire loudly: point it at the whole domain with a bad window and you can email hundreds of people at once, so treat the first live run as the dangerous part.

9 min read
Linux

Alert Before a Runaway Log File Fills Your Disk

A full disk is one of those failures that takes half your services down at once — the mail queue stops, the database goes read-only, journald starts dropping entries — and it almost always announces itself in advance as a slowly climbing df percentage. This guide sets up a small, boring watchdog that checks free space and the biggest offenders under your log directories, then emails you before the disk is full instead of after.

9 min read
Security

Configure App-ID and URL Filtering on a Palo Alto Firewall

This guide walks through building a URL Filtering security profile and adding App-ID application matching to a security policy rule on a standalone Palo Alto firewall, then attaching the profile to that rule so web traffic is classified by category and applications are matched by App-ID rather than by port. The purpose is to move from port-based rules toward application- and category-aware enforcement.

7 min read
Windows

Collect System Info from Remote PCs into a CSV with PowerShell

This guide builds a small PowerShell script that connects to a list of remote Windows PCs, reads their hardware and OS details (make, model, serial, CPU, RAM, disk free space, OS version, last boot), and writes one row per machine into a single CSV file. It is read-only. It queries WMI/CIM classes and creates no files, users, or registry keys on the remote machines, so there is nothing to undo on the targets — the only thing it writes is the CSV on your own machine.

9 min read
Linux

Roll Out an /etc/hosts or resolv.conf Change Across Servers with Ansible

This guide pushes a name-resolution change — either a static entry in /etc/hosts or an upstream DNS server change — to a group of servers at once using Ansible. Getting name resolution wrong across a fleet is one of the fastest ways to take down a whole environment: a bad /etc/hosts line or a dead DNS server means services can't find each other, monitoring goes dark, and package mirrors and time sync stop working.

8 min read
LinuxSecurity

The SCTP Use-After-Free You Probably Don't Run — But Might Load

A use-after-free landed on oss-security this week as CVE-2026-64564 , in the Linux kernel's SCTP code — specifically the ASCONF transport handling. The advisory and a follow-up describe it as local privilege escalation and container escape. Those two phrases are what make people forward a CVE to their whole team on a Friday, so it's worth stopping to ask what it actually means for the machines this blog is about: Postfix relays, Dovecot backends, Zimbra boxes, iRedMail stacks.

3 min read
Security

Back Up, Export, and Restore a Palo Alto Configuration

This guide covers three related tasks on a Palo Alto firewall: exporting a copy of the configuration off the box (a backup — completely safe, read-only), saving named snapshots on the box , and loading and committing a configuration (a restore — this changes the running config and can lock you out or drop production traffic ).

7 min read
WindowsMail

Bulk-Set Out-of-Office Auto-Replies with Exchange PowerShell

This guide sets the Automatic Replies (out-of-office) configuration on multiple mailboxes at once, using Set-MailboxAutoReplyConfiguration in Exchange Online PowerShell. It turns auto-reply on (or schedules it), and writes the internal and external message text. It does not delete mail, move anything, or change mailbox permissions — but it does overwrite whatever auto-reply text and state each affected mailbox currently has, and there is no built-in "undo" that restores the previous message. If a user had their own carefully worded reply set, this replaces it. So capture the current state first (I show how below) and treat the change list as production data.

8 min read
LinuxSecurityMail

Correlate Fail2ban, Postfix and Dovecot Logs Into One Report

This is a read-only reporting script . It reads your Postfix/Dovecot mail log and your Fail2ban log, extracts the source IPs behind SMTP SASL failures, Postfix rejects and Dovecot auth failures, cross-references them against the IPs Fail2ban actually banned, and prints one ranked summary. It does not touch your firewall, your jails, your mail queue, or any config. There is nothing to undo except deleting the report file and removing the cron entry you add at the end.

10 min read
Security

Set Up Active-Passive HA on a Palo Alto Firewall Pair

This guide pairs two identical Palo Alto firewalls into an active-passive HA cluster : one firewall passes all traffic while the other sits in sync and takes over if the active one fails, reboots, or loses a monitored link. It does not load-balance — the passive box carries no production traffic until failover.

6 min read
Linux

Schedule Automatic ZFS Snapshots and Pruning with Sanoid

This guide installs Sanoid and configures it to take ZFS snapshots on a schedule (hourly, daily, monthly) and to automatically destroy snapshots older than the retention you set. Snapshots are your cheap, instant, on-box rollback points; the pruning half is what stops them from filling the pool forever.

9 min read