Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

WindowsSecurity

Daily Report of Off-Hours Logon Failures Across the Domain

This guide builds a scheduled PowerShell job that reads the Security event log on every domain controller, pulls failed-logon events (Event ID 4625 ) from the previous day, keeps only the ones that happened outside your defined business hours (and optionally on weekends), and writes them to a dated CSV. Optionally it emails the file. It is a reporting job — it reads logs and writes a report file. It does not change Active Directory, disable accounts, or touch any policy.

10 min read
LinuxMailSecurity

Catch SMTP Brute-Force on Port 587 with Fail2ban

Password-guessing against the submission port (587) is constant background noise on any internet-facing mail server. Each attempt shows up in your mail log as a SASL authentication failure, and the standard, boring, reliable way to act on a pattern of them is Fail2ban: it tails the log, counts failures per source IP, bans the IP in your firewall, and can email you when it does. This guide wires that up for the submission service specifically.

8 min read
Security

Enable MAC-Based Access Control on a Cisco ASA (Transparent Mode)

This guide locks down a bridged interface on a Cisco ASA so that only frames from MAC addresses you have explicitly listed are forwarded . You do it by adding static MAC entries for your approved devices and then turning off dynamic MAC learning on that interface, so anything the ASA hasn't been told about is silently dropped.

6 min read
WindowsSecurity

Enforce Local Account Password Complexity with a Script

This guide turns on "Password must meet complexity requirements" for local accounts on a Windows machine, and shows how to set the related length and age rules in the same pass. It does it by exporting the local security policy to a text template with secedit , editing one line, and importing it back.

8 min read
Security

Email Alerts for Failed Admin Logins on a Palo Alto Firewall

This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit , and commit is the point where your changes become live.

6 min read
WindowsSecurity

Find AD Security Groups With Cross-Domain Members for Cleanup

In a multi-domain forest, group membership sprawls across domain boundaries over the years: a universal or domain-local group in corp ends up holding users from emea , or Foreign Security Principals (FSPs) from a trusted external forest that nobody remembers adding. Before you clean any of that up, you need an accurate inventory. This guide gives you a read-only report of every group in one domain that contains members from another domain, plus a carefully gated way to remove the ones you've decided to drop.

9 min read
LinuxMail

Generate and Validate Reverse DNS (PTR) Records for Mail Server IPs

A mail server with a missing or mismatched PTR record gets its mail deferred or rejected by the big providers. This guide gives you one small bash script that does two jobs: generate the PTR records you (or your IP owner) need to publish, and validate that what is published is correct — including the forward-confirmed reverse DNS (FCrDNS) check that mail servers actually care about.

9 min read
Security

Configure Address Translation and NAT Exemption on Check Point

This covers the three NAT jobs you actually do on a Check Point gateway: outbound Hide NAT so an internal network reaches the internet behind one address, a Static NAT one-to-one mapping for a published server, and a NAT exemption (no-NAT) rule so site-to-site VPN traffic is not translated. The exemption is the one people get wrong, and the one that quietly breaks a VPN.

6 min read
Windows

Scheduled Report of Failed Group Policy Applications by GPO and Computer

Group Policy failures are quiet. A client silently stops applying a GPO, the setting it was enforcing drifts, and nobody notices until something breaks. This guide builds a scheduled report that reads each computer's Group Policy error events, groups them by computer and (where the event names it) by GPO, and drops a CSV and HTML file somewhere you'll actually look.

12 min read
SecurityLinuxMail

The Brotli RCE is an HTTP problem, not a TLS one

A memory-corruption bug in Google's Brotli decoder, CVE-2026-111497, got the scary framing it deserves — The Hacker News leads with the Node.js RCE and the long tail of affected software, and the oss-security list carried the coordination thread. Before you start grepping your mail stack in a panic, though, let me narrow the blast radius, because the triage instinct ("Brotli is in TLS, so my mail TLS is exposed") is wrong.

3 min read
Security

Create and Apply Traffic Shaping Queues on a FortiGate (FortiOS 7.x)

This guide builds interface-based traffic shaping on a FortiGate: you define traffic classes (the "queues"), group them into a shaping profile that gives each class a guaranteed floor and a maximum ceiling of the link's bandwidth, apply that profile to an egress interface, then steer traffic into the right class with a shaping policy. The purpose is simple QoS — keep latency-sensitive traffic (VoIP, for example) from being drowned out by bulk downloads.

9 min read
WindowsSecurity

Automate a Weekly NTFS Share Permission Drift Audit

Share permissions drift. Someone grants a contractor "just temporary" access, a helpdesk ticket adds a group to a folder, an app installer rewrites an ACL — and six months later nobody remembers why Everyone can write to the finance share. This guide builds a simple, read-only baseline of your NTFS share ACLs and a weekly job that tells you exactly what has changed since.

10 min read