Field notes on messaging, security, Microsoft 365, and complex communication platforms.https://rafaelpfister.ch/enhttps://rafaelpfister.ch/en/blog/exchange-online-throttles-and-blocks-outdated-exchange-2016-and-2019-starting-in-september-2026/https://rafaelpfister.ch/en/blog/exchange-online-throttles-and-blocks-outdated-exchange-2016-and-2019-starting-in-september-2026/Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.Mon, 07 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/when-the-log-fills-the-disk-properly-limiting-log4j2-rollingfile-using-totemomail-as-an-example/https://rafaelpfister.ch/en/blog/when-the-log-fills-the-disk-properly-limiting-log4j2-rollingfile-using-totemomail-as-an-example/A log volume filling up can bring down the entire gateway in the worst case. Why combining time- and size-based rotation without %i creates a single huge file, how strategy.max caps retention, the role of the log level, and where totemomail hides these values.Fri, 04 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/how-long-does-an-smtp-session-stay-open-connectiontimeout-00-10-00-in-exchange-and-the-systems/https://rafaelpfister.ch/en/blog/how-long-does-an-smtp-session-stay-open-connectiontimeout-00-10-00-in-exchange-and-the-systems/Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.Thu, 03 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/new-outlook-s-mime-signature-cannot-be-verified-in-secondary-account-attachments-missing/https://rafaelpfister.ch/en/blog/new-outlook-s-mime-signature-cannot-be-verified-in-secondary-account-attachments-missing/The new Outlook reports that the S/MIME signature cannot be verified in a secondary account for a shared mailbox and does not display attachments. This article explains the difference between Clear Signing and Opaque Signing, why attachments disappear from opaque-signed messages, why the new Outlook processes S/MIME only in the primary account, and what workarounds are available, including unpacking smime.p7m with PowerShell or OpenSSL.Thu, 03 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/port-forwarding-with-netsh-portproxy-access-internal-services-through-a-jump-host/https://rafaelpfister.ch/en/blog/port-forwarding-with-netsh-portproxy-access-internal-services-through-a-jump-host/Windows includes built-in TCP port forwarding with netsh interface portproxy. Combined with a VPN such as Tailscale, it lets you access an internal service, such as a NAS interface, from outside without exposing it publicly. Learn how to set up, secure, and remove forwarding, and where its limitations lie: no UDP, no additional encryption, and certificate and redirect pitfalls.Wed, 02 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/tailscale-exit-nodes-and-subnet-routes-compared-and-how-they-work-technically/https://rafaelpfister.ch/en/blog/tailscale-exit-nodes-and-subnet-routes-compared-and-how-they-work-technically/In Tailscale, exit nodes and subnet routers are two related but distinct operating modes. A subnet router selectively opens specific IP ranges, while an exit node routes all internet traffic through itself. What the difference means in practice, how Tailscale implements it through WireGuard, route approval, and SNAT, and where the limits of each option lie.Wed, 02 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/prerequisites-for-remote-powershell-to-work/https://rafaelpfister.ch/en/blog/prerequisites-for-remote-powershell-to-work/PowerShell remoting rarely fails because of the command itself, but rather because of prerequisites: the WinRM service, listener, firewall, authentication, and the specifics of local accounts. What needs to be configured on the target and client sides, how to check it with Test-WSMan, and why Access denied usually has nothing to do with the password.Tue, 01 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/rustdesk-setting-up-the-open-source-teamviewer-alternative/https://rafaelpfister.ch/en/blog/rustdesk-setting-up-the-open-source-teamviewer-alternative/RustDesk is open-source remote support software licensed under the AGPL, free of charge and self-hostable. Learn how to install the client on Windows (including unattended deployment via MSI), how connections work through the public rendezvous server, your own server, or a direct connection, which features are needed for day-to-day support, and where the limits of free use lie.Tue, 01 Sep 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/cve-2026-62911-why-85-percent-of-on-premises-exchange-servers-are-vulnerable-and-what-is/https://rafaelpfister.ch/en/blog/cve-2026-62911-why-85-percent-of-on-premises-exchange-servers-are-vulnerable-and-what-is/The BSI reports that around 85 percent of on-premises Exchange servers in Germany are vulnerable to CVE-2026-62911. This article explains the vulnerability technically: MRSProxy, missing Channel Binding, NTLM relay, and Orange Tsai’s Pwn2Own chain, along with context for the figures and the specific recommended actions.Mon, 31 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/essential-controls-for-totemomail-admins-stop-the-server-check-queues-and-clean-up-in-a/https://rafaelpfister.ch/en/blog/essential-controls-for-totemomail-admins-stop-the-server-check-queues-and-clean-up-in-a/The key controls for operating a totemomail gateway: stop the service via systemd and the Tanuki control script, count queue contents per repository, inspect individual messages, clean up in a controlled manner, and restart the service.Fri, 28 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/ndr-dsn-bounce-how-to-correctly-distinguish-non-delivery-notifications/https://rafaelpfister.ch/en/blog/ndr-dsn-bounce-how-to-correctly-distinguish-non-delivery-notifications/NDR, DSN, bounce, reject, backscatter: The terms surrounding failed delivery are often used interchangeably, but they refer to different things. What the RFCs define, who generates which notification, how a DSN is structured, and why the distinction between reject and bounce determines backscatter.Fri, 28 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/passwordless-linux-server-access-set-up-ssh-key-login-with-putty-pageant-and-more/https://rafaelpfister.ch/en/blog/passwordless-linux-server-access-set-up-ssh-key-login-with-putty-pageant-and-more/Admins who access Linux servers daily have to enter a username and password every time when using password login. An SSH key pair reduces this to a double-click: generate a key with PuTTYgen, store the public key on the server, and load Pageant. The same key works in WinSCP, MobaXterm, and OpenSSH, and if desired, takes you straight to a service account shell.Fri, 28 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/sending-mail-through-a-relay-checking-tls-and-authentication/https://rafaelpfister.ch/en/blog/sending-mail-through-a-relay-checking-tls-and-authentication/A one-pager for Application Managers whose applications send mail through a relay: Which three application settings matter (port, TLS mode, authentication), what the options are called in common environments, and how a single test email’s Received header proves that the connection is actually encrypted and authenticated.Fri, 28 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/smtp-load-testing-with-numbered-recipients-reliably-send-50-000-emails/https://rafaelpfister.ch/en/blog/smtp-load-testing-with-numbered-recipients-reliably-send-50-000-emails/A load test is only as good as its evaluation. With the -N option, smtp-source numbers every email via the recipient address without sacrificing throughput. Learn how to structure the run, how many sessions make sense, and how to automatically find missing numbers.Thu, 27 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/smtp-source-without-installing-postfix-extract-load-testing-tools-from-the-rpm/https://rafaelpfister.ch/en/blog/smtp-source-without-installing-postfix-extract-load-testing-tools-from-the-rpm/smtp-source and smtp-sink are part of Postfix, but they also run without an installed mail server. Learn how to extract the two tools from the package on RHEL, why running them from /tmp can fail because of the noexec mount option, and which libraries need to be included.Thu, 27 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/up-to-10-million-free-tokens-per-day-using-openai-s-data-sharing-program-with-cost-guardrails/https://rafaelpfister.ch/en/blog/up-to-10-million-free-tokens-per-day-using-openai-s-data-sharing-program-with-cost-guardrails/OpenAI gives organizations that share their API traffic for training a daily free allowance: depending on the tier, up to 10 million tokens. With prepaid credit, project limits, and a token budget in the code, usage remains free indefinitely.Thu, 27 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/analyze-email-headers-without-uploading-the-email-locally-in-the-browser-instead-of-in-a-web/https://rafaelpfister.ch/en/blog/analyze-email-headers-without-uploading-the-email-locally-in-the-browser-instead-of-in-a-web/Email headers contain internal hostnames, IP addresses, and personal data. Anyone who pastes them into an online tool sends this information to a third-party server. Why analysis does not need a server and what a tool running locally in the browser can do.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/compauth-in-microsoft-365-composite-authentication-and-all-reason-codes/https://rafaelpfister.ch/en/blog/compauth-in-microsoft-365-composite-authentication-and-all-reason-codes/Microsoft 365 supplements SPF, DKIM, and DMARC with its own evaluation: compauth. What Composite Authentication checks, what pass, softpass, fail, and none mean, and what causes each reason code, from 000 to 905.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/authmechanism-10-and-authas-internal-how-exchange-classifies-message-submission-in-the-header/https://rafaelpfister.ch/en/blog/authmechanism-10-and-authas-internal-how-exchange-classifies-message-submission-in-the-header/The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/f5-big-ip-as-an-outbound-proxy-for-bulk-email-delivery-persistence-snat-timeouts-and-dns/https://rafaelpfister.ch/en/blog/f5-big-ip-as-an-outbound-proxy-for-bulk-email-delivery-persistence-snat-timeouts-and-dns/A bulk delivery of 1,000 emails per minute runs through a BIG-IP as an outbound proxy to the provider relay. This article explains why sticky sessions provide no benefit here, how to properly resolve the provider hostname using an FQDN node, and which SNAT, timeout, and connection-limit settings actually determine throughput.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/internal-or-external-interpreting-exchange-hybrid-mail-headers-authas-messagedirectionality-and/https://rafaelpfister.ch/en/blog/internal-or-external-interpreting-exchange-hybrid-mail-headers-authas-messagedirectionality-and/In Exchange hybrid environments, header classification determines whether an email is treated as internal. Which headers carry the classification, how tenant attribution works through certificates and connectors, and how to identify a misrouted message.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/performing-a-bios-update-safely-a-guide-using-an-asrock-am5-example-including-bitlocker/https://rafaelpfister.ch/en/blog/performing-a-bios-update-safely-a-guide-using-an-asrock-am5-example-including-bitlocker/The complete BIOS update process using an ASRock AM5 board as an example: determine the version, verify the download using a hash, properly suspend BitLocker, boot into UEFI (even if F2 does nothing), update with Instant Flash, and configure settings sensibly after the update.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/vpn-split-tunneling-for-microsoft-teams-routing-media-traffic-around-the-tunnel/https://rafaelpfister.ch/en/blog/vpn-split-tunneling-for-microsoft-teams-routing-media-traffic-around-the-tunnel/Teams calls over a VPN suffer from latency, jitter, and the detour through the VPN gateway. This article explains which Microsoft networks and ports handle media traffic, why IP-based split tunneling is superior to app exclusions, and how to implement it in consumer VPNs, WireGuard, OpenVPN, and enterprise clients.Wed, 26 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/determining-a-mail-server-s-load-profile-bursts-peak-rates-and-recipient-structure-from-message/https://rafaelpfister.ch/en/blog/determining-a-mail-server-s-load-profile-bursts-peak-rates-and-recipient-structure-from-message/How many emails per minute does your mail server really process, and how high are the peaks? How to use PowerShell and Exchange Message Tracking to determine the real load profile: rates per minute and hour, burst duration, recipient structure, message sizes, and common analysis mistakes.Tue, 25 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/the-gpu-crash-0x060c201e-in-the-claude-desktop-app-debugging-all-the-way-to-the-minidump/https://rafaelpfister.ch/en/blog/the-gpu-crash-0x060c201e-in-the-claude-desktop-app-debugging-all-the-way-to-the-minidump/The Claude Desktop app on Windows exits completely with “GPU process gone: exitCode 101457950” (0x060C201E), often followed by the Store app repair dialog. The complete causal chain: Code Integrity blocks vk_swiftshader.dll, Chromium’s fallback chain runs out, and the built-in self-termination exits the app. With a permanent solution (switching to the classic installation without MSIX), self-diagnosis via the event log, and analysis down to the minidump.Tue, 25 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/planning-email-load-tests-a-comparison-of-tools-for-10-000-email-bursts-on-linux-and-windows/https://rafaelpfister.ch/en/blog/planning-email-load-tests-a-comparison-of-tools-for-10-000-email-bursts-on-linux-and-windows/Anyone migrating a gateway or sizing an email environment needs reliable figures rather than gut feelings. Which tools generate bursts of tens of thousands of emails, what a clean test plan looks like, and how to evaluate the results from logs.Mon, 24 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/rdp-printer-redirection-print-through-the-local-pc-instead-of-the-remote-computer/https://rafaelpfister.ch/en/blog/rdp-printer-redirection-print-through-the-local-pc-instead-of-the-remote-computer/Print jobs from the RDP session should go to the printer next to the user, not to the remote computer. The setting is found in three places: the RDP client, the .rdp file, and the target system. Also covers handling the “Unknown Publisher” warning and a troubleshooting checklist.Mon, 24 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/smtp-load-testing-with-apache-jmeter-in-practice-10-000-emails-five-rule-paths-one-html-report/https://rafaelpfister.ch/en/blog/smtp-load-testing-with-apache-jmeter-in-practice-10-000-emails-five-rule-paths-one-html-report/A complete load test from A to Z: a test plan with a message mix along the ruleset paths of an encryption gateway, a portable setup without installation, 10,000 emails in a burst, and analysis using the JMeter HTML report—including the issues that actually occurred.Mon, 24 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/how-to-read-and-understand-your-electricity-bill-an-ekz-bill-line-by-line/https://rafaelpfister.ch/en/blog/how-to-read-and-understand-your-electricity-bill-an-ekz-bill-line-by-line/Energy, grid use, metering, charges: What is really on a Swiss electricity bill, who sets each price, and which line items can be changed—plus an interactive sample bill based on the EKZ model.Thu, 20 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/is-joining-a-leg-worth-it-an-honest-sample-calculation/https://rafaelpfister.ch/en/blog/is-joining-a-leg-worth-it-an-honest-sample-calculation/A 20 percent discount on grid usage sounds like money. The calculation based on EKZ’s offering shows that, for electricity consumers only, the LEG under the grid operator model is virtually cost-neutral, while producers fare better. The full calculation with all the numbers.Thu, 20 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/new-tool-leg-price-calculator/https://rafaelpfister.ch/en/blog/new-tool-leg-price-calculator/Calculates in seconds what a local electricity community delivers financially: grid usage discount versus service fee, for consumers and solar producers. Preloaded with EKZ rates for 2026, all values adjustable, runs entirely in the browser.Thu, 20 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/what-are-legs-exactly-local-electricity-communities-explained/https://rafaelpfister.ch/en/blog/what-are-legs-exactly-local-electricity-communities-explained/Since 2026, neighbors have been allowed to sell solar power to one another via the public grid: Local Electricity Communities (LEGs) make it possible. How 15-minute allocation works, what the 20 or 40 percent grid usage discount means, and how LEGs, ZEVs, and vZEVs differ.Thu, 20 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/exchange-security-updates-for-august-2026-pwn2own-vulnerability-closed-owa-light-disabled/https://rafaelpfister.ch/en/blog/exchange-security-updates-for-august-2026-pwn2own-vulnerability-closed-owa-light-disabled/The August SU fixes seven vulnerabilities, including the Exchange exploit demonstrated at Pwn2Own 2026, and permanently disables OWA Light. Microsoft also explains why Exchange SUs are now released monthly and why Exchange SE CU1 is still delayed.Wed, 19 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/analyzing-exchange-mail-flow-message-tracking-smtp-logs-and-receive-connectors/https://rafaelpfister.ch/en/blog/analyzing-exchange-mail-flow-message-tracking-smtp-logs-and-receive-connectors/How to systematically determine where a message ended up in Exchange On-Premises, Hybrid, and Exchange Online: queries with sample output, how to read the SMTP log correctly, and the issues that regularly lead to incorrect conclusions.Tue, 11 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/rebuilding-apache-james-rule-sets-structurally-tools-and-methodology/https://rafaelpfister.ch/en/blog/rebuilding-apache-james-rule-sets-structurally-tools-and-methodology/Mailet rule sets that have grown over the years contain dead paths that no one recognizes anymore. Learn how to analyze the rule set as a graph, reliably find unreachable code, and design the migration so that a single Mailet keeps the rollback path open.Tue, 11 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/what-we-can-learn-from-the-natural-sciences-for-it-troubleshooting/https://rafaelpfister.ch/en/blog/what-we-can-learn-from-the-natural-sciences-for-it-troubleshooting/Falsifiability, control groups, confounding variables, and sampling bias: the method natural sciences have used for centuries solves exactly the problems where IT troubleshooting regularly fails, illustrated with examples from mail flow.Tue, 11 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/who-is-actually-delivering-mail-to-your-tenant-aggregating-sending-ip-addresses/https://rafaelpfister.ch/en/blog/who-is-actually-delivering-mail-to-your-tenant-aggregating-sending-ip-addresses/A single report shows which systems actually deliver mail to your tenant: forgotten connectors, applications sending directly, and service providers nobody documented, including the typical analysis errors involving pagination logic and interpretation.Tue, 11 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/common-causes-of-mail-loops-and-how-to-fix-them/https://rafaelpfister.ch/en/blog/common-causes-of-mail-loops-and-how-to-fix-them/How to systematically identify and fix SMTP mail loops in Exchange Online, hybrid environments, and upstream mail gateways using NDRs, headers, Message Trace, recipient objects, and connectors.Fri, 07 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/exo-migration-without-a-remote-move/https://rafaelpfister.ch/en/blog/exo-migration-without-a-remote-move/How to provision on-premises Exchange mailboxes in a controlled manner as new, empty Exchange Online mailboxes: PST backup, CSV approval, RemoteMailbox, synchronization, validation, and rollback.Fri, 07 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/guide-for-dns-administrators-mx-spf-dkim-dmarc-and-common-pitfalls/https://rafaelpfister.ch/en/blog/guide-for-dns-administrators-mx-spf-dkim-dmarc-and-common-pitfalls/Anyone managing a zone will usually receive ready-made mail records and only needs to publish them. What regularly goes wrong: the 255-byte limit for DKIM, duplicate SPF records, the lookup limit, MX pointing to a CNAME, automatically appended zone suffixes, and policies nobody enforces anymore.Tue, 04 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/renewing-a-certificate-on-the-cisco-sma/https://rafaelpfister.ch/en/blog/renewing-a-certificate-on-the-cisco-sma/Certificates can only be installed on the Cisco SMA through the CLI, and current AsyncOS versions validate the entire chain during import: without a stored root CA, the import fails. This article shows the paths to a new key pair, the OpenSSL approach in detail, how to handle OpenSSL 3's RC2-40-CBC error, and how to import the internal root CA into the appliance's trust store.Tue, 04 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/hin-platform-renewal-2026-access-gateway-client-and-the-deadlines-through-september-14/https://rafaelpfister.ch/en/blog/hin-platform-renewal-2026-access-gateway-client-and-the-deadlines-through-september-14/Firewall approval by August 14, Access Gateway version 4 from August 17, SAML endpoints, hardware tokens, and HIN Client by September 14. The mail gateway is not affected and will be replaced separately.Sat, 01 Aug 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/testing-smtp-on-linux-from-the-tcp-connection-to-delivered-email/https://rafaelpfister.ch/en/blog/testing-smtp-on-linux-from-the-tcp-connection-to-delivered-email/When an appliance stops delivering email, a manual SMTP test is more useful than any log. Learn how to check each layer using built-in tools, what different error patterns mean, and why a load balancer can distort diagnosis.Fri, 31 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/microsoft-entra-domain-services-ldap-and-kerberos-for-cloud-only-environments/https://rafaelpfister.ch/en/blog/microsoft-entra-domain-services-ldap-and-kerberos-for-cloud-only-environments/Entra ID does not speak LDAP or Kerberos. Microsoft Entra Domain Services provides a managed Active Directory domain that synchronizes users from Entra ID and offers traditional protocols. How it works, limitations, costs, and a real-world email gateway use case.Thu, 30 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/seppmail-admin-gui-ldap-authentication/https://rafaelpfister.ch/en/blog/seppmail-admin-gui-ldap-authentication/Starting with firmware 15.0.6, administrators of the SEPPmail appliance can authenticate against an external LDAP server such as Active Directory, including group mapping to the local admin group. Configuration under User > Advanced Settings, step by step.Wed, 29 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/seppmail-releases-15-0-6-and-15-0-6-1/https://rafaelpfister.ch/en/blog/seppmail-releases-15-0-6-and-15-0-6-1/In July 2026, SEPPmail released patch release 15.0.6 and hotfix 15.0.6.1. In addition to fixing vulnerabilities in PDF generation and PGP processing, the releases introduce a separate MFA field, LDAP authentication for the Admin GUI, and fixes for RuleEngine, webmail, and the REST API.Wed, 29 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/offloading-paperless-documents-to-cloud-storage/https://rafaelpfister.ch/en/blog/offloading-paperless-documents-to-cloud-storage/Paperless-ngx only needs the database, search index, and thumbnails locally; the documents themselves can reside in a cloud service. What the practical test showed and how to set it up with the ready-made template in three commands.Sun, 26 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/proton-drive-on-linux-status/https://rafaelpfister.ch/en/blog/proton-drive-on-linux-status/The official Linux client has been announced but is not yet available. On servers, Proton Drive can currently be mounted with Rclone; the new SDK indicates the technical direction. What is still missing is machine access limited to individual folders or tasks.Sun, 26 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/rclone-mount-inside-docker-container/https://rafaelpfister.ch/en/blog/rclone-mount-inside-docker-container/For a FUSE mount from a container to work on the host and in other containers, mount propagation, AppArmor, and recovery after failures must work together.Sun, 26 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/testing-cloud-mounts-with-generated-pdfs/https://rafaelpfister.ch/en/blog/testing-cloud-mounts-with-generated-pdfs/Before a service reads its files from the cloud through an Rclone mount, you should verify more than directory access. This test plan covers cold reads, warm reads, write operations, cache behavior, file integrity, and failures.Sun, 26 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/midea-v2-cloud-api-clarified-portasplit-home-assistant/https://rafaelpfister.ch/en/blog/midea-v2-cloud-api-clarified-portasplit-home-assistant/Local device protocols, private app endpoints, and the official partner API use similar version names. Source analysis separates these layers and puts the shutdown warning into context.Sat, 25 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/midea-portasplit-home-assistant-integration/https://rafaelpfister.ch/en/blog/midea-portasplit-home-assistant-integration/Local control requires two values from the Midea Cloud. Here is how to obtain the token and key, why losing them is problematic, and how owners can back up their existing setup.Fri, 24 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/midea-portasplit-home-assistant-setup-and-hardening/https://rafaelpfister.ch/en/blog/midea-portasplit-home-assistant-setup-and-hardening/From the right community integration to an IoT VLAN: How to set up PortaSplit, secure tokens and keys, and limit cloud and network access.Fri, 24 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/serverless-newsletter-cloudflare-workers-d1/https://rafaelpfister.ch/en/blog/serverless-newsletter-cloudflare-workers-d1/The open template provides signup, unsubscribe, queue, and database in your own Cloudflare account. A deploy button sets up Worker, D1, and CI without a local server.Wed, 22 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/securing-a-debian-vps-for-claude-code/https://rafaelpfister.ch/en/blog/securing-a-debian-vps-for-claude-code/A hardened Debian VPS keeps Claude Code sessions persistently available. This guide covers everything from user accounts and SSH keys to firewalls, data hygiene, tmux, and secure access from an iPhone.Tue, 21 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/entra-connect-sync-2-6-84-0/https://rafaelpfister.ch/en/blog/entra-connect-sync-2-6-84-0/The security release brings Passkey support and changes to app authentication, PowerShell, and Password Hash Sync. The previous version was withdrawn, so the update requires a phased decision.Fri, 17 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/ghost-sender-exchange-online-side-entrance/https://rafaelpfister.ch/en/blog/ghost-sender-exchange-online-side-entrance/Direct delivery to Exchange Online bypasses an upstream gateway if the tenant does not explicitly block it. The risk is real; the cause is an incomplete mail flow configuration.Wed, 15 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/exchange-server-security-updates-july-2026/https://rafaelpfister.ch/en/blog/exchange-server-security-updates-july-2026/Two cleanup tasks are needed after installation: safely remove the old CVE-2026-42897 mitigation and review overprivileged legacy groups in Active Directory.Tue, 14 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/microsoft-graph-powershell-mailbox-connection/https://rafaelpfister.ch/en/blog/microsoft-graph-powershell-mailbox-connection/EWS ends in Exchange Online on October 1, 2026. Learn how to register an app, authenticate a PowerShell script using a certificate, restrict access to individual mailboxes, and process messages and attachments through Microsoft Graph.Sat, 11 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/hin-mail-gateway-backup-disaster-recovery/https://rafaelpfister.ch/en/blog/hin-mail-gateway-backup-disaster-recovery/A cluster protects the HIN Mail Gateway against node failures, but it does not replace a backup. Configuration, key material, restore sequence and the changes introduced by Stargate are crucial.Wed, 08 Jul 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/totemomail-licensed-user-limit-reached-ldap-cleanup/https://rafaelpfister.ch/en/blog/totemomail-licensed-user-limit-reached-ldap-cleanup/Disabled AD accounts remain in totemomail and continue to consume licenses. With a verified LDAPS connection and the Cleanup Agent, Active Directory becomes the authoritative source.Fri, 26 Jun 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/hin-mailgateway-update-15-0-5-login-issue/https://rafaelpfister.ch/en/blog/hin-mailgateway-update-15-0-5-login-issue/After updating an HIN Mailgateway cluster to version 15.0.5, login fails on both nodes after a few minutes. This procedure restores the appliances to operation in a controlled manner.Fri, 19 Jun 2026 00:00:00 GMThttps://rafaelpfister.ch/en/blog/apache-james-exchange-online-mail-routing/https://rafaelpfister.ch/en/blog/apache-james-exchange-online-mail-routing/How totemomail stores and processes messages, how the underlying Apache James switches between processors, and what matters for a secure mail loop with Exchange Online.Wed, 17 Jun 2026 00:00:00 GMT