An independent technical publication on cybersecurity, CISO leadership, infrastructure, enterprise architecture and open-source technology.https://vciso.ch/enhttps://vciso.ch/blog/how-this-site-is-built/https://vciso.ch/blog/how-this-site-is-built/A static Astro site on Cloudflare, with local search, opt-in comments and a strict Content-Security-Policy.Fri, 30 Oct 2026 00:00:00 GMTarchitectureopen-sourceastrocloudflarecspprivacyhttps://vciso.ch/blog/deploying-the-zscaler-zpa-app-connector-with-docker-a-practical-walkthrough/https://vciso.ch/blog/deploying-the-zscaler-zpa-app-connector-with-docker-a-practical-walkthrough/A working docker run command for the Zscaler Private Access App Connector, what each flag does, and what to check before you put it into production.Wed, 22 Jul 2026 06:48:02 GMTinfrastructurecybersecuritylinuxnetworksecurityzero-trusthttps://vciso.ch/blog/smtp-to-microsoft-graph/https://vciso.ch/blog/smtp-to-microsoft-graph/Exchange Online is retiring Basic Authentication for SMTP AUTH. SMTP2Graph accepts mail locally and sends it through the Microsoft Graph API, with no user license needed.Fri, 27 Feb 2026 12:04:48 GMTinfrastructuresmtplinuxmicrosofthttps://vciso.ch/blog/restrict-ssh-access-firewalld-ipsets/https://vciso.ch/blog/restrict-ssh-access-firewalld-ipsets/Allow SSH only from a list of trusted networks with a firewalld IPSet and a rich rule, then remove the default rule that leaves SSH open to the whole internet.Fri, 20 Feb 2026 07:34:21 GMTinfrastructurecybersecuritylinuxsecurityhttps://vciso.ch/blog/load-balancing-exchange-with-haproxy/https://vciso.ch/blog/load-balancing-exchange-with-haproxy/During a migration to Exchange Online, our load balancer could not take the extra traffic without a costly upgrade. HAProxy on a small Debian VM did the job: the full configuration.Fri, 01 Aug 2025 08:06:21 GMTinfrastructureexchangeexchange-onlinehaproxyload-balancerlinuxmicrosoftnetworkhttps://vciso.ch/blog/how-to-build-vpp-debian-packages-from-source-on-debian/https://vciso.ch/blog/how-to-build-vpp-debian-packages-from-source-on-debian/The steps I use to build FD.io VPP from source into .deb packages on Debian 12, from cloning the repository to make pkg-deb.Mon, 14 Apr 2025 05:17:29 GMTinfrastructurelinuxdebiannetworkvpphttps://vciso.ch/blog/erase-windows-formatted-usb-on-mac/https://vciso.ch/blog/erase-windows-formatted-usb-on-mac/Disk Utility often cannot erase a USB stick that held a Windows installer or uses an MBR layout. diskutil eraseDisk in Terminal wipes and reformats it in one step.Sun, 13 Apr 2025 08:46:58 GMTinfrastructureisomacntfshttps://vciso.ch/blog/proxmox-8-2-freezing-issue/https://vciso.ch/blog/proxmox-8-2-freezing-issue/Some Proxmox VE 8.2 hosts freeze and may not even reboot. Two kernel parameters, pcie_port_pm=off and libata.force=noncq, stop it until a fixed kernel is out.Fri, 14 Jun 2024 18:53:30 GMTinfrastructurelinuxproxmoxhttps://vciso.ch/blog/change-the-master-role-in-a-juniper-vc/https://vciso.ch/blog/change-the-master-role-in-a-juniper-vc/How to move the master role of a Juniper Virtual Chassis back to member 0 with a single command, and what to expect while it switches.Mon, 15 Jan 2024 19:15:30 GMTinfrastructurejunosqfxvirtual-chassisnetworkhttps://vciso.ch/blog/virtual-chassis-on-juniper-qfx5100-48s-6q/https://vciso.ch/blog/virtual-chassis-on-juniper-qfx5100-48s-6q/Step-by-step configuration of a preprovisioned two-member Virtual Chassis on Juniper QFX5100 switches, from serial numbers and VC ports to per-member management addresses.Sun, 14 Jan 2024 20:21:58 GMTinfrastructurejunosqfxvcvirtual-chassisnetworkhttps://vciso.ch/blog/mikrotik-display-bgp-advertised-routes-update/https://vciso.ch/blog/mikrotik-display-bgp-advertised-routes-update/RouterOS 7 now has a direct command to show the routes advertised to a BGP peer: /routing/bgp/advertisements print. An update to my earlier workaround.Sun, 31 Dec 2023 11:27:44 GMTinfrastructurebgpmikrotikrouterosnetworkhttps://vciso.ch/blog/configuring-snmp-on-proxmox/https://vciso.ch/blog/configuring-snmp-on-proxmox/Install snmpd on a Proxmox host, give it a minimal read-only configuration limited to one monitoring server, and start it at boot.Sun, 03 Dec 2023 08:39:50 GMTinfrastructurelinuxproxmoxhttps://vciso.ch/blog/red-hat-source-code-restrictions-threaten-centos-alternatives/https://vciso.ch/blog/red-hat-source-code-restrictions-threaten-centos-alternatives/In June 2023 Red Hat stopped publishing RHEL sources on git.centos.org. My take on what it means for Rocky Linux, AlmaLinux, Oracle Linux and open source.Sat, 24 Jun 2023 07:11:56 GMTinfrastructureopen-sourcenoteslinuxhttps://vciso.ch/blog/resolving-the-centos-warning-lc-ctype-utf8-error/https://vciso.ch/blog/resolving-the-centos-warning-lc-ctype-utf8-error/Logging in over SSH from a Mac to a CentOS server prints a setlocale LC_CTYPE warning. Setting LC_CTYPE in /etc/environment and generating the locale fixes it.Thu, 18 May 2023 09:37:34 GMTinfrastructurelocalelinuxhttps://vciso.ch/blog/exchange-error-400-event-15021/https://vciso.ch/blog/exchange-error-400-event-15021/After a reboot, Exchange returned HTTP 400 and logged event 15021 for 0.0.0.0:444. The Exchange Back End site in IIS had lost its certificate binding.Sat, 06 May 2023 19:22:40 GMTinfrastructureexchangemicrosofthttps://vciso.ch/blog/hyper-v-networking/https://vciso.ch/blog/hyper-v-networking/PowerShell commands to find the MAC address of a Hyper-V virtual machine's adapters, rename an adapter, and configure it as a VLAN trunk.Mon, 17 Apr 2023 15:26:40 GMTinfrastructurehyper-vnetworkmicrosoftvirtualizationhttps://vciso.ch/blog/how-internet-works-ip-transit-tiers-peering/https://vciso.ch/blog/how-internet-works-ip-transit-tiers-peering/How ISPs connect to each other through peering and paid IP transit, what Tier-1, Tier-2 and Tier-3 providers are, and why two providers on two routers is the topology to aim for.Mon, 16 Jan 2023 11:09:42 GMTinfrastructurebgpip-transitnetworkpeeringhttps://vciso.ch/blog/bgp-and-rpki-and-why-you-should-use-it/https://vciso.ch/blog/bgp-and-rpki-and-why-you-should-use-it/BGP trusts whatever routes its neighbours announce. RPKI lets you sign which AS may originate your prefixes and drop announcements that contradict it. What it protects against, what it does not, and how to deploy it.Sun, 15 Jan 2023 14:45:28 GMTinfrastructurecybersecuritybgpinternetroutingrpkinetworksecurityhttps://vciso.ch/blog/measuring-bandwidth-usage-95th-percentile/https://vciso.ch/blog/measuring-bandwidth-usage-95th-percentile/How 95th percentile billing works, why the top 36 hours of the month are free, and how it compares with a committed information rate and volume-based billing.Sun, 15 Jan 2023 11:09:24 GMTinfrastructure95thnetworkpercentileip-transithttps://vciso.ch/blog/umask-crash-course/https://vciso.ch/blog/umask-crash-course/How Linux permissions are written, how umask removes permissions from new files and directories, and how to read a value such as 022 or 027.Sat, 14 Jan 2023 14:41:53 GMTinfrastructurehowtolinuxumaskhttps://vciso.ch/blog/why-proxmox-is-the-best-hypervisor/https://vciso.ch/blog/why-proxmox-is-the-best-hypervisor/Proxmox VE is free, built on Debian, and covers clustering, high availability, Ceph storage and backups through one web interface. Why I recommend it over VMware and Hyper-V for small deployments, and where it falls short.Fri, 13 Jan 2023 14:57:07 GMTinfrastructureopen-sourcedebianlinuxproxmoxvirtualizationhttps://vciso.ch/blog/list-active-user-mailboxes-in-microsoft-exchange/https://vciso.ch/blog/list-active-user-mailboxes-in-microsoft-exchange/Exchange Management Shell one-liners that count the active user mailboxes, shared mailboxes and distribution groups in an Exchange 2016 organisation.Thu, 12 Jan 2023 08:14:55 GMTinfrastructuremicrosoftexchangehttps://vciso.ch/blog/generate-an-ssl-certificate-for-proxmox-gui/https://vciso.ch/blog/generate-an-ssl-certificate-for-proxmox-gui/Create a key and a SAN certificate request with OpenSSL, have it signed by your CA, and install the certificate in the Proxmox VE web interface.Tue, 03 Jan 2023 07:37:53 GMTinfrastructurelinuxopensslproxmoxsslpkivirtualizationhttps://vciso.ch/blog/increase-the-size-of-activesync/https://vciso.ch/blog/increase-the-size-of-activesync/Exchange limits ActiveSync to about 10 MB by default, so large attachments fail to open on mobile devices. Two values in the Sync web.config raise the limit.Tue, 20 Dec 2022 07:24:00 GMTinfrastructuremicrosoftexchangemobilityhttps://vciso.ch/blog/mikrotik-display-bgp-advertised-routes/https://vciso.ch/blog/mikrotik-display-bgp-advertised-routes/Before RouterOS had a proper command, seeing what you advertise to a BGP peer meant saving the sent attributes and reading them from a pcap. Kept for reference.Thu, 29 Sep 2022 23:31:00 GMTinfrastructurebgpmikrotikrouterosnetworkhttps://vciso.ch/blog/how-to-identify-your-rds-license-server/https://vciso.ch/blog/how-to-identify-your-rds-license-server/One PowerShell line shows which Remote Desktop license server an RD Session Host is configured to use.Thu, 10 Mar 2022 05:42:43 GMTinfrastructuremicrosofthttps://vciso.ch/blog/customize-teams-rooms-background/https://vciso.ch/blog/customize-teams-rooms-background/Set your own background image and colour on a Microsoft Teams Rooms device with a SkypeSettings.xml file, and the image size it expects for one or two screens.Tue, 25 May 2021 11:23:26 GMTinfrastructuremicrosofthttps://vciso.ch/blog/login-windows-yubikey-azure-active-directory/https://vciso.ch/blog/login-windows-yubikey-azure-active-directory/Use a FIDO2 security key such as a YubiKey 5 to sign in to an Azure AD joined Windows 10 device: the requirements, the Azure AD setting and the Intune profile.Sat, 22 May 2021 17:44:22 GMTinfrastructurecybersecuritymicrosoftsecurityidentityhttps://vciso.ch/blog/find-cisco-vtp-primary/https://vciso.ch/blog/find-cisco-vtp-primary/"VTP VLAN configuration not allowed when device is in CLIENT mode" means VLANs are managed elsewhere. One show command tells you which switch is the VTP primary.Fri, 21 May 2021 07:30:39 GMTinfrastructurenetworkciscohttps://vciso.ch/blog/hybrid-exchange-and-outlook-blank-popup/https://vciso.ch/blog/hybrid-exchange-and-outlook-blank-popup/Outlook 2016 shows a blank sign-in window and keeps asking for a password in a hybrid Exchange setup with Modern Authentication. The cause can be a missing autodiscover service principal name.Tue, 18 May 2021 21:59:32 GMTinfrastructuremicrosoft-365outlookmicrosofthttps://vciso.ch/blog/outlook-2016-disable-office-365-autodiscover/https://vciso.ch/blog/outlook-2016-disable-office-365-autodiscover/A single registry value, ExcludeExplicitO365Endpoint, stops Outlook 2016 from going straight to Office 365 during autodiscover, so it uses your own autodiscover records instead.Tue, 18 May 2021 16:34:42 GMTinfrastructuremicrosofthttps://vciso.ch/blog/generate-a-san-certificate/https://vciso.ch/blog/generate-a-san-certificate/Create a certificate request that covers several DNS names and IP addresses with an OpenSSL configuration file, then convert the signed certificate to PFX for Windows.Mon, 17 May 2021 19:12:23 GMTinfrastructurecybersecuritylinuxsecurityopensslpkihttps://vciso.ch/blog/bgp-on-windows-server-2019/https://vciso.ch/blog/bgp-on-windows-server-2019/Windows Server 2019 can speak BGP without third-party software. How to install the routing role, configure the router and a peer, announce prefixes and apply policies.Mon, 17 May 2021 09:32:44 GMTinfrastructuremicrosoftnetworkbgphttps://vciso.ch/blog/change-linux-console-keyboard-mapping/https://vciso.ch/blog/change-linux-console-keyboard-mapping/Set the console keyboard layout of a CentOS or other systemd-based Linux server with localectl, and list the keymaps you can choose from.Sat, 15 May 2021 10:47:59 GMTinfrastructurecentoslinuxhttps://vciso.ch/blog/error-install-jq-on-centos-7/https://vciso.ch/blog/error-install-jq-on-centos-7/The Microsoft Tunnel readiness script stops with "jq: command not found" on CentOS 7. jq is in EPEL, so enable that repository and install it.Fri, 30 Apr 2021 15:17:29 GMTinfrastructurelinuxcentosmicrosofthttps://vciso.ch/blog/certificate-error-0x80094001/https://vciso.ch/blog/certificate-error-0x80094001/An internal CA rejects a request with 0x80094001. The usual cause is a country name written out in full instead of its two-letter ISO 3166 code.Wed, 28 Apr 2021 12:12:50 GMTinfrastructuremicrosoftpkihttps://vciso.ch/blog/locate-your-certificate-authority/https://vciso.ch/blog/locate-your-certificate-authority/certutil -config - -ping lists the enterprise CAs published in Active Directory and checks that the one you pick is responding.Mon, 26 Apr 2021 18:30:17 GMTinfrastructuremicrosoftpki