Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

MailSecurity

Barracuda's Chained Root Bug: It's About Where Your Admin Interface Lives

Barracuda has published details of two vulnerabilities that, chained together, hand an attacker root on the appliance. The Hacker News has the full breakdown; BleepingComputer corroborates the disclosure. If you run a Barracuda Email Security Gateway in front of your mail flow — and plenty of shops still do, sitting it ahead of Postfix or a Zimbra edge — this is worth ten minutes of your attention today. But read past the CVSS scores before you panic, because the two numbers tell you more about how you're exposed than whether you're doomed.

3 min read
Security

Configure Administrative Role Separation on a Check Point Gateway (R81.x)

Shared-admin logins are the quiet risk in a lot of Check Point estates: everyone SSHes in as admin , everyone can do everything, and nobody can tell afterward who changed the routing table. Gaia's Role-Based Administration (RBA) fixes that at the OS level. This guide walks the standard clish procedure to create named accounts that can see or change only what their job requires.

7 min read
Mail

Find and Remove Orphaned Exchange Forwarding Rules

When you delete a mailbox, the forwarding that pointed at it from elsewhere doesn't clean itself up. A mailbox with ForwardingAddress set to a now-deleted user, or an inbox rule in someone else's mailbox that redirects to a departed colleague, just quietly starts dropping or bouncing mail. This guide scans the whole tenant for that leftover forwarding, reports it, and removes the mailbox-level cases safely.

8 min read
LinuxMail

Automate Daily DNS Checks for Your Mail Server Records

This guide builds a small bash script that queries your live DNS once a day and compares the MX , A , and AAAA records it gets back against the values you declare in a config file. If they don't match, it emails you. That's all it does.

9 min read
Security

Configure QoS and Bandwidth Prioritization on a SonicWall (SonicOS 7)

This guide configures Bandwidth Management (BWM) on a SonicWall running SonicOS 7 so that chosen traffic — VoIP, a line-of-business app, backups — gets a guaranteed or higher-priority slice of your WAN link, and everything else yields to it. BWM is the SonicWall's own internal QoS engine; it shapes traffic as it crosses the firewall. (The separate 802.1p / DSCP marking features ask downstream switches and your ISP to honour a priority tag — that is a different, additive topic I'll point to but not walk through.)

7 min read
WindowsSecurity

Daily Report of Off-Hours Logon Failures Across the Domain

This guide builds a scheduled PowerShell job that reads the Security event log on every domain controller, pulls failed-logon events (Event ID 4625 ) from the previous day, keeps only the ones that happened outside your defined business hours (and optionally on weekends), and writes them to a dated CSV. Optionally it emails the file. It is a reporting job — it reads logs and writes a report file. It does not change Active Directory, disable accounts, or touch any policy.

10 min read
LinuxMailSecurity

Catch SMTP Brute-Force on Port 587 with Fail2ban

Password-guessing against the submission port (587) is constant background noise on any internet-facing mail server. Each attempt shows up in your mail log as a SASL authentication failure, and the standard, boring, reliable way to act on a pattern of them is Fail2ban: it tails the log, counts failures per source IP, bans the IP in your firewall, and can email you when it does. This guide wires that up for the submission service specifically.

8 min read
Security

Enable MAC-Based Access Control on a Cisco ASA (Transparent Mode)

This guide locks down a bridged interface on a Cisco ASA so that only frames from MAC addresses you have explicitly listed are forwarded . You do it by adding static MAC entries for your approved devices and then turning off dynamic MAC learning on that interface, so anything the ASA hasn't been told about is silently dropped.

6 min read
WindowsSecurity

Enforce Local Account Password Complexity with a Script

This guide turns on "Password must meet complexity requirements" for local accounts on a Windows machine, and shows how to set the related length and age rules in the same pass. It does it by exporting the local security policy to a text template with secedit , editing one line, and importing it back.

8 min read
MailLinux

Bulk-Export Postfix Virtual Maps to an Encrypted Backup

This guide builds a small bash script that reads your Postfix virtual-table configuration, copies the source files behind each file-based map ( hash: , lmdb: , btree: , cdb: , texthash: ) plus main.cf and master.cf , bundles them into a tarball, and encrypts that tarball with GnuPG so you can store it off-box safely. The purpose is a routine, restorable snapshot of your mail routing and alias data.

9 min read
Security

Email Alerts for Failed Admin Logins on a Palo Alto Firewall

This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit , and commit is the point where your changes become live.

6 min read