Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide covers two related jobs on a SonicWall firewall: taking a full backup of the running configuration (and creating a restore point), and upgrading or rolling back firmware. The purpose is simple — never touch firmware or a risky rule change without a known-good copy you can boot back to.
This guide builds a read-only disk-space report. It uses PowerShell remoting ( Invoke-Command over WinRM) to query each server's local fixed disks and returns size, free space, and percent free as one combined table you can export to CSV or HTML. It does not write to, resize, or clean up any disk — it only reads WMI/CIM data.
This script reads your filesystem and reports two classes of risky files: world-writable files and directories (anyone on the box can modify them) and SUID/SGID binaries (they run with the owner's or group's privileges, often root). It writes a timestamped report and, optionally, a baseline you can diff against later. It does not change any permissions, delete anything, or modify a single file — it only runs find and writes a text report to a directory you choose.
Canonical shipped a batch of Linux kernel security fixes this month, and LWN flagged three stable kernel updates landing upstream in the same window. None of this is dramatic. It is the ordinary heartbeat of running Linux under a mail stack — but "ordinary" still means a reboot, and there are two details worth reading before you schedule one.
This guide configures SSL VPN (NetExtender) remote access on a SonicWall firewall: it opens an encrypted tunnel on the WAN so authorised users can dial in from the internet and reach an internal subnet. Everything here is done in the SonicOS web GUI as a full administrator account — there is no "script" to paste, but the changes are just as production-critical as one.
This script offboards one leaving user in a single pass: it disables their AD account, records and removes their group memberships (except the primary group), and moves the account into a disabled-users OU. A separate, clearly marked step sets mail forwarding on their mailbox. The point is a consistent, logged procedure so nothing gets missed and you can reconstruct exactly what changed.
This guide sets up two things: a small script that dumps your host's live packet-filter ruleset to a timestamped, versioned file, and a scheduled systemd timer to run it. It also shows the standard restore path. The backup part is read-only and safe. The restore part is not — reloading a ruleset replaces your firewall's entire running state in one transaction, and a bad ruleset can drop your SSH session and cut the host off the network instantly.
This guide walks through publishing one internal server to the Internet on a SonicWall running SonicOS 7 (7.0/7.1) — creating the address and service objects, an inbound NAT policy that translates your public IP to the server's private IP, and the access rule that permits the traffic. On a SonicWall the "script" is the vendor's own web GUI, so there is nothing to paste into a shell.
This guide builds an IPsec site-to-site VPN between two SonicWall firewalls (or a SonicWall and a compatible third-party peer) so two private subnets can route to each other over the public internet. It changes live firewall configuration: it adds a VPN policy, address objects, and — automatically — access rules that permit traffic between the two networks. Getting the phase 1/phase 2 parameters or the local/remote networks wrong can break routing or expose a subnet you didn't intend to.
This procedure recovers administrative access to a FortiGate when you have lost or forgotten the admin password. It uses FortiOS's built-in maintainer account, which lets you log in over the serial console immediately after a hard power cycle and reset the administrator password. That is the only thing it changes: one admin account's password. It does not erase your configuration.
This guide adds two FortiGuard security profiles — Web Filter and Application Control — to an existing firewall policy so the FortiGate inspects outbound traffic and blocks the categories and applications you choose. It's how you stop users reaching malware and phishing sites, or using peer-to-peer and proxy apps, on the way out to the internet.
This guide configures a FortiGate to forward its logs to an external syslog server and/or a FortiAnalyzer . The purpose is centralized retention and search — logs live off the box, survive a reboot or an RMA, and can be correlated across devices.
This guide walks a standalone FortiGate through a firmware upgrade — checking the supported upgrade path, backing up config, flashing the new image, and verifying it — with the least possible disruption. A firmware upgrade reboots the unit . On a single (non-HA) FortiGate there is no way to avoid a short traffic outage during that reboot; "without losing connectivity" here means without locking yourself out and without losing your configuration , not zero downtime. Only an HA pair gives you a near-seamless upgrade, and that is a different procedure (noted at the end).
