Notes
Short notes from building, maintaining, and securing systems. Written as I learn, so they stay practical.
A login failure can involve credentials, account state, Group Policy, workstation restrictions, DNS, Kerberos, network connectivity, or the domain controller itself. Starting with the component that appears to be failing is useful. Staying there after the evidence points somewhere else is where troubleshooting becomes inefficient.
The browser is not a trusted environment. Anyone with access to the page can inspect, modify, and resend requests. Client-side validation is useful for user experience. It is not useful for security.
Understanding how systems work requires building them, breaking them, and understanding why they failed. Documentation is not optional.
Small configuration decisions accumulate into larger security posture. Enabling SSH password authentication over the internet is a single configuration option. Leaving it enabled indefinitely is a habit, and that habit creates unnecessary risk.
Right now
