Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

Security

Set Up pfSense High Availability with CARP and pfsync

This guide builds a two-node pfSense high-availability (HA) pair: one primary firewall that carries traffic and one secondary that takes over automatically if the primary fails. CARP provides the shared virtual IP addresses your clients use as their gateway, pfsync copies the firewall state table between nodes so existing connections survive a failover, and XMLRPC config sync keeps the secondary's configuration in step with the primary.

7 min read
WindowsMail

Bulk-Export Exchange Distribution List Membership for Compliance

An auditor asks the same question every year: who was in which distribution list on this date? Clicking through each group in the admin center does not scale past a handful of groups, and it produces nothing you can hand over. This guide scripts a clean, point-in-time CSV of every distribution group and its members.

8 min read
LinuxMailSecurity

Detect Spam Relay Abuse from Postfix Mail Logs

This guide gives you a read-only Python script that parses a Postfix mail log and reports two things: authenticated senders (SASL users) who sent an unusually large number of messages or recipients — the classic signature of a compromised mailbox being used to blast spam — and source IPs that keep tripping "Relay access denied", which is relay probing. The script does not change anything : it reads the log, counts, and prints a report. It never touches Postfix config, never disables an account, never blocks an IP.

10 min read
SecurityLinux

Automate pfSense and OPNsense Config Backups Off the Box

This guide sets up a read-only pull of the firewall's config.xml to a separate Linux host, scheduled nightly with cron, so you have off-box, dated copies of every configuration. The backup script itself never writes to the firewall — it only copies one file off it over SSH.

9 min read
Windows

Find and Merge Duplicate Active Directory User Accounts

Before I start, one honesty note that shapes this whole guide: Active Directory has no merge operation . There is no Merge-ADUser cmdlet, and there never was. When people say "merge duplicate accounts," what they actually need is a repeatable process to find the duplicates, decide which one survives , copy the things that matter (mainly group memberships) onto the survivor , and then retire the other . That is what this guide automates. The detection half is safe and read-only. The consolidation half changes and can delete accounts, so it is gated hard.

9 min read
LinuxMailSecurity

Automate TLSA Record Generation for DANE and Verify It

The script below reads an X.509 certificate and prints a TLSA record . That is all it does: it computes a SHA-256 hash of the certificate's public key and formats it as a DNS TLSA resource record you can paste into your zone. It changes nothing on the machine, and it needs no elevated privileges — except that if your certificate file is only readable by root you will need sudo to read it.

8 min read
Security

Configure AnyConnect Remote Access VPN on a Cisco ASA

This guide configures a Cisco AnyConnect (Secure Client) SSL remote-access VPN on an ASA so remote users can dial in, receive an internal IP from a pool, and reach inside subnets over an encrypted tunnel. It creates address pools, a group policy, a connection profile (tunnel-group), a split-tunnel ACL, a NAT exemption, and at least one VPN user.

8 min read
Windows

Automatically Remove Stale User Profiles on an RDS Host

On a busy Remote Desktop Session Host, local profiles pile up fast — every user who ever logged in leaves a folder under C:\Users , and a system drive fills quietly until logons start failing. This guide sets up an unattended, standard-supported cleanup of profiles that haven't been used in N days.

8 min read
Linux

Automate a Weekly Patch-and-Report Routine for a Small Server Fleet

This sets up a weekly, unattended package upgrade on each server, then emails you a plain-text report of what was upgraded and whether a reboot is now pending. The upgrade step runs apt-get upgrade non-interactively, so it changes installed software on the host. Package upgrades are not cleanly reversible: apt has no "undo the last upgrade" button, so treat this with the same caution as any change to a running server.

8 min read
Security

Set Up a Site-to-Site IPsec VPN on a Cisco ASA

This guide builds a policy-based site-to-site IPsec VPN between two Cisco ASAs using IKEv2 , so hosts on your local LAN can reach hosts on a remote LAN over an encrypted tunnel across the public internet. It defines the crypto policy, a pre-shared key, the interesting-traffic ACL, the NAT exemption, and applies a crypto map to the outside interface.

8 min read
Windows

Automate Moving AD Users Between OUs From a CSV

This procedure reads a CSV of user accounts and their destination OUs, then moves each account to its target OU with PowerShell's Move-ADObject . Moving a user changes its distinguished name (DN). That matters because anything scoped by DN or OU — Group Policy links, delegated permissions, and OU-based filters — will start or stop applying to the account the moment it moves. The move itself does not delete the account or its group memberships, and it is reversible if you know where the account came from — which is why the script below records the original OU of every user before it touches anything.

8 min read
Linux

A Bash Wrapper to Run One Command Across Many Hosts Over SSH

This is a small bash wrapper that reads a list of hostnames from a file and runs the same command on all of them over SSH, several at a time in parallel , tagging every line of output with the host it came from. The purpose is to save you from looping through servers by hand when you want to check a value, restart a service, or gather a fact fleet-wide.

9 min read