Shore Up

Security

Security

Two-Factor Admin Login on a Check Point Gaia Gateway

This guide points Gaia's administrator authentication (the WebUI, SSH, and console logins on a Check Point gateway) at an external RADIUS server that enforces a second factor — a push, an OTP, or an SMS code. The gateway itself has no built-in TOTP; it delegates authentication to RADIUS, and the RADIUS/MFA server is where the second factor actually lives. Get that mental model straight before you touch anything: if the RADIUS server is unreachable or misconfigured, admin login can fail.

6 min read
MailSecurity

Remove Stale Exchange Mailbox Delegates and Restore Security

This guide finds and removes delegate access that a former or reassigned user still holds on other people's mailboxes in Exchange Online — the four kinds that actually let one account read or send as another: Full Access , Send As , Send on Behalf , and folder-level (calendar) delegate permissions. Its purpose is offboarding hygiene: when someone leaves or changes roles, their standing access to shared and personal mailboxes should go with them.

9 min read
MailSecurity

The Zimbra SNMP hole: who's actually exposed to CVE-2026-73570

Shadowserver's scans put the count at 274 internet-facing Zimbra instances already compromised through CVE-2026-73570, up from 155 flagged on August 20. That's the headline, and both Help Net Security and BleepingComputer reported it on the same Monday. If you run Zimbra Collaboration Suite on the public internet and you haven't moved to v10.1.20, this is your problem now, not next sprint.

3 min read
Security

Traffic Shaping and Bandwidth Management on a Palo Alto Firewall

This guide sets up QoS (Quality of Service) on a Palo Alto firewall so you can guarantee bandwidth to important traffic (say VoIP), cap bandwidth for greedy traffic (backups, streaming), and prioritise real-time flows during congestion. QoS on PAN-OS is enforced on the egress direction of an interface, which is the single most important thing to understand before you build anything — I cover it below.

6 min read
WindowsSecurity

Automate NTFS Permission Audits and Detect Oversharing on File Servers

This guide gives you a PowerShell script that walks a share tree, reads the NTFS access control list (ACL) on each folder, and reports every place where a broad identity — Everyone , Authenticated Users , Domain Users , BUILTIN\Users — has been granted Write, Modify, or Full Control. That combination is the classic definition of "oversharing," and this script's only job is to find it and write it to a CSV. It reads permissions. It does not change a single ACE.

9 min read
Security

Configure DNS Security and Threat Prevention on a FortiGate (FortiOS 7.x)

This guide configures the FortiGate's own DNS resolver to use FortiGuard servers, builds a DNS Filter security profile (FortiGuard category blocking, botnet C&C domain blocking, and an optional static domain block list), and applies that profile to an outbound firewall policy. The purpose is to stop clients from resolving known-malicious, botnet, and unwanted-category domains before a connection is ever made.

8 min read
WindowsSecurity

A Daily Report of Failed RDP Logons Across Your Servers

This guide builds a read-only PowerShell script that pulls failed logon events (Security log Event ID 4625 ) from a list of servers, keeps the ones that look like RDP attempts, and writes them to a dated HTML/CSV report you can review each morning. It optionally emails that report. It creates nothing and deletes nothing on the target servers — it only reads their Security logs.

10 min read
LinuxSecurity

OVSwrap (CVE-2026-64531): a local-root kernel bug hiding in a very large patch wave

On 21 August 2026 Canonical pushed out a broad set of kernel security notices, and threaded through most of them is one identifier: CVE-2026-64531 , nicknamed OVSwrap , an Open vSwitch flaw in the Linux kernel that leads to local root. The oss-security post that carries the name declines AI crawlers , so I only have its subject line to confirm the classification — Linux kernel / OVS, local privilege escalation. The details of the write-up I can't quote, and won't guess at.

3 min read
Security

Enable and Tune Suricata IDS/IPS on pfSense

Suricata is a deep-packet inspection engine. In IDS mode it watches a copy of the traffic on an interface and raises alerts; in IPS mode it actively blocks hosts or drops packets that match a rule. That second mode is the dangerous one: a noisy or badly tuned rule can block a legitimate host — including your own management workstation — and cut production traffic. Treat this as a change to a live firewall, not a lab toy.

7 min read
WindowsSecurity

Audit Windows Firewall Rules and Report Drift From a Baseline

This guide builds two small PowerShell scripts. The first captures the current Windows Firewall ruleset to a CSV baseline . The second re-reads the live rules and reports which ones were added, removed, or changed since that baseline. Both scripts are read-only — they use Get-* cmdlets only and change no firewall rules, so running the audit cannot break connectivity.

10 min read
LinuxMailSecurity

Audit Mail User Permissions and Find Over-Privileged Accounts

This script is a read-only audit . It walks your virtual mailbox tree and a couple of mail config directories and reports three things: mailbox files or directories that are readable or writable by group/other, mailbox files not owned by the expected mail user, config files that contain secrets but aren't locked down, and the service account's login shell. It changes nothing — no chmod , no chown , no account edits. Remediation is a separate, manual step at the end that you run deliberately, one finding at a time.

11 min read
Security

Set Up pfSense High Availability with CARP and pfsync

This guide builds a two-node pfSense high-availability (HA) pair: one primary firewall that carries traffic and one secondary that takes over automatically if the primary fails. CARP provides the shared virtual IP addresses your clients use as their gateway, pfsync copies the firewall state table between nodes so existing connections survive a failover, and XMLRPC config sync keeps the secondary's configuration in step with the primary.

7 min read
LinuxMailSecurity

Detect Spam Relay Abuse from Postfix Mail Logs

This guide gives you a read-only Python script that parses a Postfix mail log and reports two things: authenticated senders (SASL users) who sent an unusually large number of messages or recipients — the classic signature of a compromised mailbox being used to blast spam — and source IPs that keep tripping "Relay access denied", which is relay probing. The script does not change anything : it reads the log, counts, and prints a report. It never touches Postfix config, never disables an account, never blocks an IP.

10 min read
SecurityLinux

Automate pfSense and OPNsense Config Backups Off the Box

This guide sets up a read-only pull of the firewall's config.xml to a separate Linux host, scheduled nightly with cron, so you have off-box, dated copies of every configuration. The backup script itself never writes to the firewall — it only copies one file off it over SSH.

9 min read
LinuxMailSecurity

Automate TLSA Record Generation for DANE and Verify It

The script below reads an X.509 certificate and prints a TLSA record . That is all it does: it computes a SHA-256 hash of the certificate's public key and formats it as a DNS TLSA resource record you can paste into your zone. It changes nothing on the machine, and it needs no elevated privileges — except that if your certificate file is only readable by root you will need sudo to read it.

8 min read
Security

Configure AnyConnect Remote Access VPN on a Cisco ASA

This guide configures a Cisco AnyConnect (Secure Client) SSL remote-access VPN on an ASA so remote users can dial in, receive an internal IP from a pool, and reach inside subnets over an encrypted tunnel. It creates address pools, a group policy, a connection profile (tunnel-group), a split-tunnel ACL, a NAT exemption, and at least one VPN user.

8 min read
Security

Set Up a Site-to-Site IPsec VPN on a Cisco ASA

This guide builds a policy-based site-to-site IPsec VPN between two Cisco ASAs using IKEv2 , so hosts on your local LAN can reach hosts on a remote LAN over an encrypted tunnel across the public internet. It defines the crypto policy, a pre-shared key, the interesting-traffic ACL, the NAT exemption, and applies a crypto map to the outside interface.

8 min read
Security

Configure Interface Security Levels and Access Lists on a Cisco ASA

This guide sets the security level on each ASA interface (its trust ranking, 0–100) and applies extended access lists to control which traffic is allowed into an interface. On an ASA, traffic from a higher-security interface to a lower one is permitted by default, but the moment you apply an inbound access-group to an interface, the ASA enforces that ACL and drops everything the ACL doesn't explicitly permit — there is an implicit deny ip any any at the end of every ACL. A single applied ACL can therefore cut production traffic and lock you out of management in one command.

9 min read
WindowsSecurity

Automate a Windows Server Hardening Baseline Check with PowerShell

This script is a read-only audit . It reports PASS/FAIL for a small set of well-known hardening settings — SMBv1 status, firewall profiles, Defender real-time protection, RDP Network Level Authentication, and the local Guest account — and writes the results to the screen and a CSV. It changes nothing. There is nothing to roll back, which is exactly why an audit script is the safe place to start before you touch any actual configuration.

9 min read
LinuxSecurity

Automate TLS Cipher and Protocol Scanning of Your Own Services

This guide sets up an automated, repeatable scan of the TLS protocols and cipher suites your own services advertise — the sort of thing you'd otherwise do by hand before a PCI review or after a config change. It uses testssl.sh , a widely-used bash script that connects to a service and negotiates handshakes to see what's on offer (TLS 1.0–1.3, weak ciphers, known issues like ROBOT/BEAST reporting, cert details).

9 min read
Security

Commit, Revert, and Audit Configuration Changes on Palo Alto

This guide covers the everyday change-control workflow on a Palo Alto firewall: staging a change in the candidate configuration , previewing exactly what will change, committing it to the running configuration, reverting an uncommitted change, rolling back to a previous committed version, and using Config Audit to diff two versions. None of this is a script you paste in blind — it is the vendor's own commit model, driven from the web UI and the CLI.

7 min read
Security

Configure App-ID and URL Filtering on a Palo Alto Firewall

This guide walks through building a URL Filtering security profile and adding App-ID application matching to a security policy rule on a standalone Palo Alto firewall, then attaching the profile to that rule so web traffic is classified by category and applications are matched by App-ID rather than by port. The purpose is to move from port-based rules toward application- and category-aware enforcement.

7 min read
LinuxSecurity

The SCTP Use-After-Free You Probably Don't Run — But Might Load

A use-after-free landed on oss-security this week as CVE-2026-64564 , in the Linux kernel's SCTP code — specifically the ASCONF transport handling. The advisory and a follow-up describe it as local privilege escalation and container escape. Those two phrases are what make people forward a CVE to their whole team on a Friday, so it's worth stopping to ask what it actually means for the machines this blog is about: Postfix relays, Dovecot backends, Zimbra boxes, iRedMail stacks.

3 min read
Security

Back Up, Export, and Restore a Palo Alto Configuration

This guide covers three related tasks on a Palo Alto firewall: exporting a copy of the configuration off the box (a backup — completely safe, read-only), saving named snapshots on the box , and loading and committing a configuration (a restore — this changes the running config and can lock you out or drop production traffic ).

7 min read
LinuxSecurityMail

Correlate Fail2ban, Postfix and Dovecot Logs Into One Report

This is a read-only reporting script . It reads your Postfix/Dovecot mail log and your Fail2ban log, extracts the source IPs behind SMTP SASL failures, Postfix rejects and Dovecot auth failures, cross-references them against the IPs Fail2ban actually banned, and prints one ranked summary. It does not touch your firewall, your jails, your mail queue, or any config. There is nothing to undo except deleting the report file and removing the cron entry you add at the end.

10 min read
Security

Set Up Active-Passive HA on a Palo Alto Firewall Pair

This guide pairs two identical Palo Alto firewalls into an active-passive HA cluster : one firewall passes all traffic while the other sits in sync and takes over if the active one fails, reboots, or loses a monitored link. It does not load-balance — the passive box carries no production traffic until failover.

6 min read
Security

Configure GlobalProtect Remote Access VPN on Palo Alto

This guide configures a GlobalProtect remote-access (SSL/TLS) VPN on a single Palo Alto firewall: remote users authenticate to a portal, download a client config, and connect through a gateway that drops them into an internal zone with an assigned IP. It is a set of GUI changes plus a commit — there is no shell script here, because on PAN-OS the correct path is the web interface, not a CLI hack.

6 min read
LinuxSecurity

Automate a Read-Only Security Audit Report for a Linux Server

This guide builds a single bash script that takes a read-only snapshot of a server's security posture — logged-in users, listening sockets, running services, UID 0 accounts, the effective SSH config, pending updates, SUID/SGID binaries, and world-writable files — and writes it to a timestamped text file. It inspects and records; it never edits config, kills processes, changes permissions, or installs anything.

10 min read
SecurityWindows

When the Patch Wasn't the Patch: N-central's Auth Bypass Redux

If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.

3 min read
Security

Set Up a Site-to-Site IPsec VPN on a Palo Alto Firewall

This guide builds a route-based site-to-site IPsec VPN on a Palo Alto firewall: an encrypted tunnel between your firewall and a remote peer so two private subnets can talk over the public internet. You configure it entirely as candidate configuration in the web GUI and make it live with a Commit .

7 min read
WindowsSecurity

Automate a Daily Failed-Logon (4625) Report with PowerShell

This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.

9 min read
Security

Configure Source and Destination NAT on a Palo Alto Firewall

This guide creates two NAT policies on a Palo Alto firewall: a source NAT rule so hosts on your inside zone reach the internet behind the firewall's public interface address (hide-NAT / PAT), and a destination NAT rule that forwards an inbound public IP and port to an internal server (a port forward). Both change how traffic is translated and, paired with the security rules they require, change what traffic is allowed . A wrong NAT or a missing/overbroad security rule can expose an internal host or break outbound connectivity for a whole zone.

7 min read
WindowsSecurity

Automate a Network Share Permissions Audit with PowerShell

This guide builds a read-only report . The script enumerates the SMB shares on a Windows file server, then lists two things for each one: the share-level permissions (the "who can connect" layer) and the NTFS permissions on the folder behind it (the "who can touch the files" layer). It writes both to CSV so you can review access in a spreadsheet instead of clicking through the Security tab share by share.

9 min read
SecurityLinuxMail

wp2shell Is Already in the KEV List — Patching Won't Un-Own You

CISA put two WordPress core flaws into its Known Exploited Vulnerabilities catalogue on 21 July, alongside a DD-WRT overflow and a Langflow bug. The pair that matters here — CVE-2026-63030 and CVE-2026-60137, chained under the name wp2shell — gives an anonymous attacker remote code execution against a stock WordPress install with a single HTTP request. No login, no plugin, no theme required. By the reporting in The Hacker News, exploitation was underway within hours of the public proof-of-concept, and watchTowr's honeypots logged tens of thousands of attempts.

3 min read
Security

Create Security Policy Rules on a Palo Alto Firewall (PAN-OS 11.x)

This guide adds a Security policy rule to a Palo Alto Networks firewall running PAN-OS 11.x , managed locally (not from Panorama). A Security rule decides which sessions between zones are allowed or denied, in top-down order. Adding, reordering, or misscoping a rule changes what traffic passes the firewall the moment you commit , so a mistake here can either open a hole or cut production traffic — including your own management session.

7 min read
Security

Upgrade a Check Point Gateway with CPUSE, Step by Step

CPUSE (the Gaia Deployment Agent) is Check Point's built-in tool for importing, verifying, and installing hotfixes and major-version upgrades on a Gaia gateway. In this guide I use it to take one gateway from one major version to the next. A major-version install reboots the box and replaces the running OS image — while it runs, that gateway passes no traffic and its management is offline. Treat it as a full outage, not a quick patch.

7 min read
WindowsSecurity

Audit Local Administrators Across Many Windows Machines

This is a read-only audit. It pulls a list of computers from Active Directory, connects to each one over PowerShell Remoting (WinRM), reads the membership of the local Administrators group, and writes everything to a single CSV you can open in Excel. It creates nothing and changes nothing on the target machines, so there is no destructive step and nothing to roll back — the only thing produced is the report file on your own workstation.

9 min read
Security

Troubleshoot Check Point Traffic with fw monitor and cpview

fw monitor is Check Point's kernel packet-capture tool: it shows you a packet at four fixed points as the gateway inspects it, so you can tell where a flow is being dropped. cpview is a live, top-style performance dashboard for CPU, memory, connections, and throughput. Both are diagnostic and read-only — neither changes your policy or configuration.

7 min read
LinuxSecurity

Samba's July batch: one domain-takeover bug hiding behind a pile of DoS

Ubuntu and Debian both shipped a Samba fix on 28 July 2026 — USN-8621-1 on the Ubuntu side, DSA-6401-1 on Debian's. It's a fat advisory: eight CVEs in one go. But counting CVEs is the wrong way to read it. Seven of the eight are denial-of-service, and exactly one of them is the reason you should stop reading and go patch.

3 min read
Security

Configure ClusterXL High Availability on Check Point R81.20

This guide builds a ClusterXL High Availability (Active/Standby) pair from two Check Point gateways: two physical or virtual firewalls share one set of virtual IPs, and if the active member fails, the standby takes over the traffic and the connections. Its purpose is redundancy, not more throughput — HA mode passes traffic through one member at a time.

6 min read
LinuxSecurity

Automate a Nightly Git Snapshot of /etc for Change Tracking

I like knowing exactly what changed under /etc and when — after a package upgrade, after I "just tweaked one thing," after someone else touched a box. A nightly git snapshot gives me a dated, diffable trail I can read with git log and git diff . It is not a substitute for real config management, but it is cheap, honest history.

8 min read
Security

"Back Up a Check Point Gaia System: Backup, Snapshot, and Migrate Export"

Check Point gives you three different ways to save the state of a Gaia machine, and admins mix them up constantly. They are not interchangeable. This guide walks all three on Gaia R81.20 (standalone Security Management Server or gateway, not a Multi-Domain Server), driven from Gaia clish with a bit of expert mode. If you run MDS the paths and tools differ — stop and read the Multi-Domain guide instead.

7 min read
Security

Configure Remote Access VPN on a Check Point Gateway

This guide turns on Check Point Remote Access VPN so staff can connect from outside with the Check Point Endpoint Security VPN / Check Point Mobile client and reach internal networks over an encrypted IPsec tunnel. You do it in SmartConsole , not on the gateway shell — enabling the IPsec VPN blade, putting the gateway in the RemoteAccess community, assigning client IPs with Office Mode, adding an access rule, and installing policy.

6 min read
Security

Set Up a Site-to-Site VPN Community on Check Point (R81.20)

This guide builds a site-to-site IPsec VPN community in Check Point SmartConsole so traffic between two sites' encryption domains is tunnelled and encrypted. The main path assumes both peers are Check Point gateways managed by the same Management Server (SMS) on R81.20 ; I note where a third-party peer (an Interoperable Device ) differs.

7 min read
LinuxSecurity

The FireWire Fix Is Noise — RefluXFS Is Why You Should Reboot

If you only read one Linux kernel headline this week it was probably Phoronix noting that 7.2-rc5 fixes a longstanding bug in IPv4 over FireWire . File that under trivia. Nobody reading this blog is carrying mail over an IEEE 1394 cable, and it landed in a release candidate anyway. The actual reason to look at your kernel version this week is buried under a mountain of near-identical advisories.

3 min read
Security

Configure Automatic and Manual NAT on a Check Point Firewall

This guide creates NAT rules on a Check Point gateway: Hide NAT (many internal hosts sharing one public address for outbound access) and Static NAT (a one-to-one map so a public address reaches an internal server). NAT rules rewrite the source or destination address of live traffic — get one wrong and you can break outbound Internet for a whole subnet or expose a server you didn't mean to.

7 min read
LinuxSecurity

Harden SSH Across a Fleet with Ansible

This playbook drops a single sshd configuration file ( /etc/ssh/sshd_config.d/99-hardening.conf ) onto every host in your inventory and reloads the SSH service. It disables root login, disables password authentication, requires public-key auth, and tightens a handful of session and auth limits.

8 min read
Security

Create and Install a Security Policy on a Check Point Gateway (R81.x)

This guide builds an Access Control policy in SmartConsole and installs it onto a Check Point Security Gateway. Building the policy touches only the management database; installing it is the moment that changes how the gateway forwards traffic. A policy that ends in the implicit cleanup drop, or one that removes the rule you rely on, can cut production traffic and lock you out of management in one push.

8 min read
WindowsSecurity

Automate Windows Firewall Rule Deployment with PowerShell and netsh

This guide builds and deploys Windows Defender Firewall rules from a table (a CSV), using the NetSecurity PowerShell module, with netsh advfirewall shown as the older equivalent. The goal is a repeatable, idempotent way to push the same rule set to one host or many, instead of clicking through wf.msc on each box.

9 min read
LinuxMailSecurity

Automatically Ban Abusive IPs in Postfix with Fail2ban

The standard, boring way to block IPs that hammer your mail server is Fail2ban. It watches the mail log, counts matching failures per source IP inside a time window, and when a source crosses a threshold it inserts a firewall rule to drop that IP for a while. You could write a bash script that greps the log and pipes IPs into nft , and I'll say where that fits at the end — but reinventing Fail2ban is more error-prone than configuring it, so that's what this guide does.

7 min read
Security

Configure Port Forwarding to an Internal Server on a SonicWall

This guide publishes one internal server on one port to the internet through a SonicWall. You will create an address object for the server, pick or create a service (port) object, add an inbound NAT policy that rewrites the destination to the internal host, and add a WAN→LAN access rule that permits the traffic. Both pieces are required: the NAT policy alone forwards nothing without the matching access rule.

6 min read
MailSecurity

The Zimbra Patch Is the Easy Part — Go Read Your Audit Log

If you run Zimbra Collaboration and you've been putting off the 10.1 upgrade, the joint advisory from NSA, CISA and partners this week should end that debate. A Russian state-backed group — tracked variously as TA488, CL-STA-1114, and mapped loosely to LAUNDRY BEAR and Void Blizzard — spent roughly five months of 2025 reading Western mailboxes through CVE-2025-66376 , a stored XSS bug in the Classic Web Client that Zimbra didn't fix until 6 November 2025. As reported by The Hacker News and corroborated by BleepingComputer, the whole thing fired when a user viewed the message. No click, no attachment, no download.

4 min read
Security

Factory Reset and Recover a SonicWall with SafeMode

SafeMode is SonicWall's out-of-band recovery boot. You enter it with the physical reset button, and from a small web page on the appliance you can reboot the current firmware, boot a backup image, upload firmware, export settings, or boot with factory default settings — which wipes the running configuration back to out-of-the-box defaults. This guide covers using SafeMode to factory reset and recover a firewall you're locked out of, or one whose config or firmware is corrupt.

6 min read
Security

Set Up Content Filtering (CFS) on a SonicWall

This guide turns on SonicWall's Content Filtering Service (CFS): the firewall inspects outbound HTTP/HTTPS requests, looks the destination category up against SonicWall's cloud database, and blocks or allows the request based on a profile you define. The purpose is category-based web filtering for a specific zone (typically your LAN).

6 min read
Security

Configure High Availability on a SonicWall Pair

This guide pairs two identical SonicWall appliances into an Active/Standby High Availability cluster: the Primary handles all traffic, the Secondary sits synchronized and idle, and if the Primary fails the Secondary takes over the firewall's identity and keeps traffic flowing. That is the whole purpose — surviving a hardware failure without hand-rebuilding a box.

6 min read
WindowsSecurity

Automate DNS Record Audits on Windows DNS with PowerShell

This guide builds a read-only audit of a Microsoft DNS server: it enumerates the zones, exports every resource record to CSV, and produces a short report of records that look stale (dynamic records whose aging timestamp is older than a threshold you set). The audit script itself creates nothing and deletes nothing — its worst case is a CSV file on disk.

9 min read
Security

Back Up and Restore SonicWall Settings and Firmware Safely

This guide covers two related jobs on a SonicWall firewall: taking a full backup of the running configuration (and creating a restore point), and upgrading or rolling back firmware. The purpose is simple — never touch firmware or a risky rule change without a known-good copy you can boot back to.

6 min read
LinuxSecurity

Audit World-Writable Files and SUID Binaries with Bash

This script reads your filesystem and reports two classes of risky files: world-writable files and directories (anyone on the box can modify them) and SUID/SGID binaries (they run with the owner's or group's privileges, often root). It writes a timestamped report and, optionally, a baseline you can diff against later. It does not change any permissions, delete anything, or modify a single file — it only runs find and writes a text report to a directory you choose.

9 min read
LinuxSecurityMail

The July kernel respin: reboot, and mind your out-of-tree modules

Canonical shipped a batch of Linux kernel security fixes this month, and LWN flagged three stable kernel updates landing upstream in the same window. None of this is dramatic. It is the ordinary heartbeat of running Linux under a mail stack — but "ordinary" still means a reboot, and there are two details worth reading before you schedule one.

3 min read
Security

Set Up SSL VPN Remote Access on a SonicWall (NetExtender)

This guide configures SSL VPN (NetExtender) remote access on a SonicWall firewall: it opens an encrypted tunnel on the WAN so authorised users can dial in from the internet and reach an internal subnet. Everything here is done in the SonicOS web GUI as a full administrator account — there is no "script" to paste, but the changes are just as production-critical as one.

7 min read
LinuxSecurity

Automate iptables/nftables Backup and Restore

This guide sets up two things: a small script that dumps your host's live packet-filter ruleset to a timestamped, versioned file, and a scheduled systemd timer to run it. It also shows the standard restore path. The backup part is read-only and safe. The restore part is not — reloading a ruleset replaces your firewall's entire running state in one transaction, and a bad ruleset can drop your SSH session and cut the host off the network instantly.

9 min read
FirewallsSecurity

Create Access Rules and NAT Policies on a SonicWall (SonicOS 7)

This guide walks through publishing one internal server to the Internet on a SonicWall running SonicOS 7 (7.0/7.1) — creating the address and service objects, an inbound NAT policy that translates your public IP to the server's private IP, and the access rule that permits the traffic. On a SonicWall the "script" is the vendor's own web GUI, so there is nothing to paste into a shell.

6 min read
FirewallsSecurity

Configure a Site-to-Site VPN on a SonicWall (SonicOS 7)

This guide builds an IPsec site-to-site VPN between two SonicWall firewalls (or a SonicWall and a compatible third-party peer) so two private subnets can route to each other over the public internet. It changes live firewall configuration: it adds a VPN policy, address objects, and — automatically — access rules that permit traffic between the two networks. Getting the phase 1/phase 2 parameters or the local/remote networks wrong can break routing or expose a subnet you didn't intend to.

6 min read
FirewallsSecurity

Recover Admin Access to a Locked-Out FortiGate

This procedure recovers administrative access to a FortiGate when you have lost or forgotten the admin password. It uses FortiOS's built-in maintainer account, which lets you log in over the serial console immediately after a hard power cycle and reset the administrator password. That is the only thing it changes: one admin account's password. It does not erase your configuration.

7 min read
FirewallsSecurity

Configure Web Filtering and Application Control on a FortiGate

This guide adds two FortiGuard security profiles — Web Filter and Application Control — to an existing firewall policy so the FortiGate inspects outbound traffic and blocks the categories and applications you choose. It's how you stop users reaching malware and phishing sites, or using peer-to-peer and proxy apps, on the way out to the internet.

7 min read
FirewallsSecurity

Upgrade FortiGate Firmware Without Losing Connectivity

This guide walks a standalone FortiGate through a firmware upgrade — checking the supported upgrade path, backing up config, flashing the new image, and verifying it — with the least possible disruption. A firmware upgrade reboots the unit . On a single (non-HA) FortiGate there is no way to avoid a short traffic outage during that reboot; "without losing connectivity" here means without locking yourself out and without losing your configuration , not zero downtime. Only an HA pair gives you a near-seamless upgrade, and that is a different procedure (noted at the end).

7 min read
FirewallsSecurity

Back Up and Restore a FortiGate Configuration the Safe Way

This guide backs up a FortiGate's running configuration to a file you can store off-box, and restores that file when you need to roll back or rebuild. A backup is harmless. A restore is not: restoring a full configuration overwrites everything on the unit and reboots it. If the file is for a different model or firmware, or was captured with private-data encryption you can't unlock, the restore can leave the box unreachable.

7 min read
FirewallsSecurity

Set Up Active-Passive HA Between Two FortiGate Firewalls

This guide builds an FGCP active-passive cluster from two FortiGate firewalls: one unit passes all traffic while the second stays fully configured and idle, ready to take over within seconds if the primary fails. The two units share one configuration, one set of virtual MAC addresses, and appear on the network as a single firewall.

8 min read
FirewallsSecurity

Configure a Virtual IP for Port Forwarding on a FortiGate

A Virtual IP (VIP) on a FortiGate is how you take traffic arriving at a public address and port and redirect it to an internal host — classic destination NAT (port forwarding). This guide walks the standard one-to-one VIP with port forwarding, both in the GUI and the CLI, and shows how to verify and roll it back.

7 min read
FirewallsSecurity

Set Up SSL VPN Remote Access for Staff on a FortiGate

This walks through a standard tunnel-mode SSL VPN on a FortiGate running FortiOS 7.4 , the kind you hand to remote staff with FortiClient. I'll do it in the GUI (the normal path on a FortiGate) and give the equivalent CLI so you can review or script it. Web-mode (clientless) portals are being wound down by Fortinet, so this guide is tunnel mode only.

8 min read
FirewallsSecurity

Create and Correctly Order Firewall Policies on a FortiGate

FortiGate evaluates IPv4 policies top to bottom, first match wins . A correct rule in the wrong position does nothing, or worse, a broad "allow" above a specific "deny" quietly opens traffic you meant to block. This guide covers creating a standard IPv4 policy and placing it in the right spot, on FortiOS 7.4 (the same steps apply across 7.2–7.6, but menu labels and CLI keywords can shift between minor versions, so confirm against your build).

7 min read
FirewallsSecurity

Route-Based Site-to-Site IPsec VPN Between Two FortiGates

This guide builds a route-based IPsec tunnel between two FortiGate firewalls so the LAN behind Site A can reach the LAN behind Site B and vice versa. "Route-based" means each end gets a virtual tunnel interface, and you steer traffic into the tunnel with a static route plus firewall policies — the mainstream FortiOS approach for a permanent office-to-office link.

9 min read
WindowsMailSecurity

Automate New-User Onboarding in Active Directory

This guide builds a PowerShell script that onboards one new employee in four steps: it creates an Active Directory user account , adds them to security groups , provisions an on-premises Exchange mailbox , and creates their home folder on a file server and sets NTFS permissions . The purpose is to replace the error-prone click-through in Active Directory Users and Computers with one repeatable, reviewable run.

10 min read
WindowsSecurity

Clean Up Stale Computer Accounts in Active Directory with PowerShell

This guide finds Active Directory computer accounts that haven't logged in for a long time and retires them in three deliberate stages: report , disable and move to a holding OU , then delete . The purpose is to keep AD tidy and reduce the attack surface of forgotten machine accounts without accidentally killing a computer that's simply been powered off for a while.

8 min read
WindowsSecurity

Automate Certificate Expiry Checks on Windows with PowerShell

An expired TLS certificate is the kind of outage that is entirely preventable and still catches everyone. This guide builds a small PowerShell script that reads the certificates in a server's own store, flags any that expire soon, and then schedules it to run daily so you hear about it weeks in advance instead of from a monitoring alert at 2 a.m.

9 min read
WindowsSecurity

Automate a Ping and Port Sweep of a Subnet with PowerShell

This guide builds a small PowerShell script that walks every address in a /24 subnet, sends one ICMP echo (a ping) to each, and — for the hosts that answer — tests a short list of TCP ports and does a reverse-DNS lookup. The output is a CSV inventory: IP, up/down, resolved name, and which ports were open. It is read-only. It does not log into, change, or write anything on the machines it probes.

8 min read
WindowsSecurity

Rotate Local Admin Passwords Across Machines with PowerShell

This guide gives you a PowerShell script that connects to a list of Windows machines over WinRM and sets a brand-new random password on the built-in local Administrator account of each one , then writes the results to a CSV so you have the new credentials. Its purpose is to kill shared, static, "same password everywhere" local admin accounts.

9 min read
WindowsSecurity

Automate Mapped-Drive Setup with a Logon Batch Script

This guide sets up a .bat logon script that runs net use to attach network shares to fixed drive letters (for example S: and H: ) every time a user signs in on a domain-joined Windows machine. Its purpose is consistent, hands-off drive mapping so users don't set them up manually.

7 min read
WindowsSecurity

Reset and Unlock AD User Accounts in Bulk with PowerShell

This guide resets the passwords of a list of Active Directory user accounts, clears any lockout on them, and flags each account to require a new password at the next sign-in. The usual reason is a batch of expired or compromised accounts, or a group of seasonal staff coming back online.

8 min read
WindowsSecurity

Email a Daily Windows Event Log Error Summary with PowerShell

This guide builds a small PowerShell script that reads the last 24 hours of Critical and Error events from the System and Application logs, writes them to an HTML file, and emails that file to you. It's a read-only report: it does not clear, modify, or delete any event log. The only things it creates on the system are the HTML report files in a folder you choose and — in the last section — a scheduled task.

10 min read
WindowsSecurity

Bulk-Disable and Archive Inactive AD Accounts with PowerShell

This procedure finds enabled user accounts that have not logged on for a set number of days , disables them, stamps a note in the account's description, and moves them into a dedicated "archive" OU so they are out of your working OUs but not deleted. Its purpose is routine account hygiene: a disabled, quarantined account can't be used for a logon, which shrinks your attack surface, but nothing is destroyed and everything is reversible.

9 min read
WindowsSecurity

Find and Report AD Accounts That Have Never Logged In

This guide gives you a PowerShell script that reads Active Directory and produces a report (on screen and as a CSV) of user accounts that have never authenticated against any domain controller. It changes nothing — it does not disable, delete, or edit a single account. Its purpose is to hand you a clean list of candidates for review before you decide what to do with them.

9 min read
WindowsSecurity

Automate Active Directory User Creation from a CSV with PowerShell

This guide builds a PowerShell script that reads a CSV file of people and creates a matching Active Directory user account for each row — name, logon name, OU placement, and an initial password. Its purpose is to save you from clicking through Active Directory Users and Computers a hundred times when you onboard a class, a department, or a new office.

8 min read
WindowsSecurity

Unlock a Locked-Out Active Directory Account with PowerShell

This guide uses the Unlock-ADAccount cmdlet to clear the locked-out state on an Active Directory user account — the state a user lands in after too many bad password attempts trip your domain lockout policy. Unlocking lets them log in again immediately; it does not change or reset their password.

7 min read
WindowsSecurity

Batch-Create Active Directory Users from CSV with PowerShell

This guide gives you a PowerShell script that reads a CSV file of new employees and creates one Active Directory user account per row, with a per-row try/catch so that one bad line doesn't halt the whole batch. Its purpose is bulk onboarding — creating dozens or hundreds of accounts without clicking through the console each time.

8 min read
WindowsSecurity

Update Active Directory User Details with PowerShell

This guide changes existing Active Directory user objects: it sets the email address, job title, and department on one account or a batch of accounts. It does not create or delete anything. But it overwrites whatever those attributes held before, and Active Directory keeps no built-in undo — if you set the wrong department on 200 people, the only way back is to set it again with the correct value. So treat the write as permanent unless you record the old values first (I show how below).

8 min read
WindowsSecurity

Add and Remove an AD User from Groups with PowerShell

These commands add a user account to an Active Directory security or distribution group, or remove it from one, using the ActiveDirectory PowerShell module. Group membership is how most access is granted in AD, so getting it right matters: adding a user to the wrong group can hand out access it should not have, and removing a user from a group can cut off access to file shares, mailboxes, or applications immediately at their next logon or token refresh.

7 min read
LinuxSecurity

Build a Service Health Dashboard with Cron and Static HTML

This guide builds a small read-only status page. A bash script checks whether a list of systemd services are active and whether a few HTTP endpoints answer, then writes a plain HTML file that your web server already serves. Cron re-runs it every few minutes so the page stays current. Nothing here restarts, reconfigures, or stops any service — it only reads state and writes one HTML file.

10 min read
LinuxSecurity

Ship Logs to a Central Syslog Server with rsyslog

This guide configures rsyslog on your Linux hosts to forward their system logs over the network to one central collector, and configures that collector to receive them and file each sender's logs into its own directory. The point is to have every machine's logs in one place so you can search, retain, and back them up centrally.

9 min read
LinuxSecurity

Inventory Installed Packages and Services Across Servers over SSH

This guide gives you a small bash script that logs into a list of servers over SSH, and on each one dumps two things to a text file on your control machine: the list of installed packages (via dpkg-query on Debian/Ubuntu or rpm on RHEL/Alma) and the list of systemd service unit files. The purpose is a point-in-time software and service inventory you can diff, audit, or archive.

9 min read
LinuxSecurity

Sync Two Directories in Near-Real-Time with inotifywait and rsync

This guide builds a small daemon that watches a source directory with inotifywait and, whenever a file there changes, runs rsync to mirror those changes into a destination directory. The result is one-way, near-real-time replication: destination follows source, never the other way around.

8 min read
LinuxSecurity

Automate SSL Certificate Expiry Monitoring Across Many Domains

This guide builds a small bash script that connects to a list of hostnames over TLS, reads the expiry date from each certificate, and emails you a summary of anything expiring within a threshold you choose (30 days by default). It is a read-only monitor : it makes outbound TLS connections and sends mail. It does not touch, renew, or modify any certificate, and it changes nothing on the servers it checks.

10 min read
LinuxSecurity

Automate DNS Record Checks and Alert on Drift with dig

This is a read-only monitor . The script queries DNS with dig , compares each answer against a baseline file you control, and prints (and by cron, emails) a line for every record that no longer matches. It changes no DNS records, no zone files, and no configuration — the worst it can do is send you an email or write to a file you point it at. Because of that there is nothing to roll back on the DNS side.

10 min read
LinuxSecurity

Automate Debian/Ubuntu Package Updates With a Safe Reboot

This guide sets up a small script, run by a systemd timer, that does three things on a schedule: refreshes the package lists ( apt-get update ), installs available upgrades non-interactively, and — only if the upgrade left the system needing a reboot — reboots the machine during a maintenance window.

9 min read
LinuxSecurity

Detect and Report Failed SSH Login Attempts with a Log-Parsing Script

This guide builds a read-only bash script that parses your SSH log, counts failed password attempts, and prints a summary of the busiest source IP addresses and the usernames they tried. Its purpose is visibility — spotting brute-force patterns — not blocking. It does not change firewall rules, ban anyone, edit config, or delete anything. Running it and re-running it leaves your system exactly as it was.

9 min read
LinuxSecurity

Automate UFW Firewall Rules From a Config File

This guide gives you a small bash script that reads a plain-text config file and passes each line to ufw , so your firewall rules live in one readable, version-controllable file instead of your shell history. It adds the rules you list; it does not remove rules that aren't in the file.

8 min read
LinuxSecurity

Replace a Cron Job with a systemd Timer, Logging, and Failure Alerts

This guide replaces a cron job with three small systemd units: a service that runs your task, a timer that schedules it, and a small notification service that emails you when the task fails. The point is to get the two things cron does not give you for free — the task's output captured in the journal, and an alert when it exits non-zero.

8 min read
LinuxSecurity

Harden a Fresh Ubuntu Server with a First-Boot Bash Script

This script applies a standard first-boot baseline to a fresh Ubuntu server: it creates a non-root sudo user with your SSH key, turns on the UFW firewall (allowing only SSH), disables direct root login and SSH password authentication, enables automatic security updates, and installs fail2ban to throttle SSH brute-forcing. Its purpose is to take a default cloud or VM image from "wide open with a root password" to a sane, keys-only baseline in one pass.

10 min read
LinuxSecurity

Automate MySQL/MariaDB Backups With Rotation and a Restore Test

Two scripts here. The first ( mysql-backup.sh ) makes a gzipped mysqldump of every database on the server, drops the file in /var/backups/mysql , and deletes any dump older than a retention window. The second ( mysql-restore-test.sh ) proves a backup is usable by loading the newest dump for one database into a throwaway database, counting the tables, and dropping that throwaway again.

9 min read
LinuxSecurity

Schedule and Verify PostgreSQL Backups with pg_dump and Retention

This guide sets up a bash script that runs pg_dump (and pg_dumpall for cluster-wide roles) on a schedule, writes each backup to a directory with a timestamped filename, and then deletes any backup older than a retention window. The purpose is a hands-off nightly logical backup you can restore from.

8 min read
LinuxSecurity

Auto-Clean Old Files When a Disk Fills Up

This script checks how full a filesystem is with df . If it is at or above a percentage you set, it deletes files older than a chosen age from one directory you designate — typically a cache, spool, or temp directory — using find . Its purpose is to keep a disk from filling up unattended, not to be a general cleanup tool.

9 min read
LinuxSecurity

Automate fail2ban Jail Reports to Slack with Bash

This script reads fail2ban's current state — the list of active jails and how many IPs each one has banned — and posts a short text summary to a Slack channel through an incoming webhook. Its purpose is visibility: you get a scheduled report of what fail2ban is blocking without SSHing in to run fail2ban-client status by hand.

7 min read
LinuxSecurity

Automate Let's Encrypt Renewal with a Deploy Hook

Certbot renews your certificates on a timer, but a renewed certificate sitting on disk does nothing until the service using it reloads and reads the new file. This guide sets up a deploy hook — a small script Certbot runs only when a certificate actually changes — so the reload happens automatically and only when it needs to.

7 min read
WindowsSecurity

Reset an Active Directory User Password with PowerShell

This guide resets the password on one Active Directory user account, and optionally unlocks the account and forces the user to change the password at next logon. That is the entire scope: a targeted, single-user reset — the kind of thing you do a dozen times a week at a help desk.

8 min read
LinuxSecurity

Automate Daily Encrypted Backups With rsync and cron

This guide builds a small shell script that runs once a night from cron. Each run it makes a compressed tar archive of one source directory, encrypts that archive to a GPG public key , deletes the plaintext copy, then pushes the encrypted file to a remote server over SSH with rsync . The result is a backup that is encrypted at rest (GPG) and in transit (SSH). Only someone holding the matching GPG private key can read it — so keep that private key off the backup box.

8 min read
MailSecurity

Set Up SPF, DKIM and DMARC on Postfix with OpenDKIM

Getting mail to authenticate is three separate jobs that people lump together: SPF says which hosts may send for your domain, DKIM cryptographically signs your outbound mail, and DMARC tells receivers what to do when the first two disagree with the From header. SPF and DMARC are pure DNS. DKIM needs a signing daemon wired into Postfix. This guide walks all three.

8 min read
LinuxSecurity

Provision Linux Users and Groups from a CSV with Bash

Creating one Linux account by hand is fine. Creating thirty from a spreadsheet a manager emailed you is a job for a script. This walks through a small, boring, reliable bash script that reads a CSV and provisions local users and their groups with the standard shadow-utils tools.

10 min read
LinuxSecurity

NTFS-3G Gets a Pile of Overflows — But Ask Where You Actually Mount NTFS

Debian shipped DSA-6389-1 for ntfs-3g on 15 July, and Ubuntu followed with USN-8554-1 the next day. Between them they close a batch of nine CVEs: seven heap buffer overflows (CVE-2026-42616, 42617, 42618, 46569, 46570, 46572 and 56135) and two out-of-bounds reads (CVE-2026-46571 and 56136). The overflows can lead to arbitrary code execution; the reads can leak memory contents.

3 min read