Shore Up
Ketan AagjaDirector of IT · 22+ years in infrastructure, security & mail systems

Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.

Windows

Bulk-Update AD User Attributes from a CSV

This guide reads a CSV of users and writes two attributes back to Active Directory for each one: Title and Department . Nothing is created or deleted — existing user objects have those two fields overwritten with the values in your file. That overwrite is a real change: if the CSV has a wrong value in a row, that user's title or department is now wrong until you fix it. There is no built-in "undo," so the safety step below is to export the current values first so you can put them back.

9 min read
Linux

Auto-Restart Failing systemd Services with Backoff

This guide configures systemd to automatically restart a service when it fails, with an increasing delay between attempts (backoff), and to fire an alert when it exhausts its retries and stays down. Nothing here touches your application's data — it only changes how systemd supervises the unit — but a badly tuned restart loop can hammer CPU, disk, or an upstream database by relaunching a broken process over and over, so treat the values as production settings, not guesses.

8 min read
Security

Configure Remote Access VPN on a Check Point Gateway

This guide turns on Check Point Remote Access VPN so staff can connect from outside with the Check Point Endpoint Security VPN / Check Point Mobile client and reach internal networks over an encrypted IPsec tunnel. You do it in SmartConsole , not on the gateway shell — enabling the IPsec VPN blade, putting the gateway in the RemoteAccess community, assigning client IPs with Office Mode, adding an access rule, and installing policy.

6 min read
Linux

"Automate Linux User Offboarding: Lock, Archive, Revoke"

This is a bash script that offboards a single local Linux user on a standalone server: it locks the account, expires it so no login (password or key) succeeds, kills any live sessions, backs up the user's crontab, disables their SSH authorized_keys , and archives their home directory to a tarball. It does not delete the account or the home directory — removal is left as a deliberate, manual step so you have an undo path.

10 min read
Security

Set Up a Site-to-Site VPN Community on Check Point (R81.20)

This guide builds a site-to-site IPsec VPN community in Check Point SmartConsole so traffic between two sites' encryption domains is tunnelled and encrypted. The main path assumes both peers are Check Point gateways managed by the same Management Server (SMS) on R81.20 ; I note where a third-party peer (an Interoperable Device ) differs.

7 min read
Windows

Monitor Free Disk Space and Email an Alert with PowerShell

This script reads the free space on the fixed local disks of the machine it runs on and emails you when any of them drops below a percentage you set. It is a lightweight stand-in for a monitoring platform — good for a handful of servers, not a replacement for one across a fleet.

8 min read
Linux

Deploy a Postfix Relay with Ansible

This playbook installs Postfix on one or more target hosts and configures it as a send-only relay (a "smarthost" client) : local mail is handed to an upstream provider over an authenticated, TLS-encrypted SMTP submission connection, and the host does not accept mail from the network. Its purpose is to give servers a reliable way to send notifications, cron output, and application mail without each app talking to your provider directly.

8 min read
LinuxSecurity

The FireWire Fix Is Noise — RefluXFS Is Why You Should Reboot

If you only read one Linux kernel headline this week it was probably Phoronix noting that 7.2-rc5 fixes a longstanding bug in IPv4 over FireWire . File that under trivia. Nobody reading this blog is carrying mail over an IEEE 1394 cable, and it landed in a release candidate anyway. The actual reason to look at your kernel version this week is buried under a mountain of near-identical advisories.

3 min read
Security

Configure Automatic and Manual NAT on a Check Point Firewall

This guide creates NAT rules on a Check Point gateway: Hide NAT (many internal hosts sharing one public address for outbound access) and Static NAT (a one-to-one map so a public address reaches an internal server). NAT rules rewrite the source or destination address of live traffic — get one wrong and you can break outbound Internet for a whole subnet or expose a server you didn't mean to.

7 min read
Windows

Automate a Nightly Robocopy Mirror to a NAS with Verification

This sets up a nightly one-way mirror of a local folder to a NAS SMB share using robocopy /MIR , followed by a second pass that lists any remaining differences as a verification step, all logged to a timestamped file and driven by a Scheduled Task.

9 min read
LinuxSecurity

Harden SSH Across a Fleet with Ansible

This playbook drops a single sshd configuration file ( /etc/ssh/sshd_config.d/99-hardening.conf ) onto every host in your inventory and reloads the SSH service. It disables root login, disables password authentication, requires public-key auth, and tightens a handful of session and auth limits.

8 min read