What projects can I do outside my work as sysadmin?

Lately, work has started to take over my life. There’s always the next project, and in helping the company, I’ve forgotten to invest in myself.

I love sysadmin and tech, and I want to spend my time learning or building projects that could automate my home, save me money, or even earn extra income. The projects I’ve been doing at home are related to work, so I worry that if I change jobs, I’ll lose that .

I’ve thought about fine-tuning AI, hosting a local AI agent, or creating home services to cut costs, but there are so many possibilities that I’m not sure where to start.

With my sysadmin and generalist background, what projects could I start that improve my skills, have income potential, and are realistic to tackle without a huge learning curve?

I have tried coding and that takes long time with fetures and features. My philosopy is small projects that makes me effective in my own economy. I have an idea on projects but no idea where to start

https://redd.it/1pw25hb
@r_systemadmin

Too Many Duo Prompts? How Do Teams Meet 2FA Compliance

I started at a company that uses Duo and it feels pretty intense: I approve a Duo push to SSH in, then another when I switch users, and another when I sudo. Basically every hop prompts a phone tap. If I'm signing into my computer, its a Duo tap. Any RDP session is a Duo tap. It probably takes me 15 minutes to get all of my terminals rolling in the morning.

Is this typical for companies achieving some compliance like CMMC, or is it configured extra-strict? What are other teams doing to meet 2FA requirements for SSH/admin access without so many prompts? I like Yubikey, but seems this IT department ignored me outright when I inquired about it. Tapping the phone bites IMO!

https://redd.it/1pw2vnu
@r_systemadmin

Has anyone been able to get Smartcard Login to work on Windows?

Really struggling with even knowing where to start looking on this one.

I'm a Junior SysAdmin and unfortunately the Senior ones haven't been too helpful on this.

I know E5 and E3s are going to include a PKI at some point and that is somehow relevant but I'm still struggling to understand exactly how that links in. For context, we are a hybrid environment.

I'm not even sure how to link a user's SmartCard to their AD profile or see what certs already exist on the profile!

If it helps at all, only about 400 devices out of 5000 need SmartCard based Logon. Most of the staff that will be logging on will have an E5. The devices in question will always be connected to our domain.

Is anyone able to give me a bit of a high level overview?

https://redd.it/1pw4kov
@r_systemadmin

Best 2025-2026 Document Scanners? - Looking for Suggestions

Hi everyone!

For anonymous purposes you can just refer to me as Cyb or Cyberius.

I currently work as an IT professional in a small-medium (\~200 employee) healthcare company, and we are a bit behind the times when it comes to hardware. One thing that we REALLY need to get up to date on is document scanners (Ricoh, Brother, etc.) as we still have ones dating back to \~2011.


The scanners that are being used currently are old KV-S1025 Panasonic Scanners that just aren't cutting it in terms of speed and other miscellaneous issues that we just can't seem to stay ahead on as the drivers and hardware are very dated. One scanner that does work pretty well is a Fujitsu Scanner Series 7xxx, but I believe this one is dated too so we want to try to find a better standard, if possible.


I have been doing some research online and in other subreddits, including this one, and was wondering what Document Scanners folks use at their workplace? Currently, I am leaning towards the Brother ADS Series but am fully open to suggestions.


Some other information that may help is the department that is in need of these scanners scan 100s of pages a day so something that is reliable and fast would be ideal to make sure their process is as smooth and efficient as possible.


Thank you!

https://redd.it/1pw7ulx
@r_systemadmin

MongoDB unauth exploit released, patch immediately

From: https://cyberplace.social/@GossiTheDog/115786817774728155

> Merry Christmas to everybody, except that dude who works for Elastic, who decided to drop an unauthenticated exploit for MongoDB (basically MySQL) on Christmas Day, that leaks memory and automates harvesting secrets (e.g. database passwords)

> CVE-2025-14847 aka MongoBleed

> Exp: https://github.com/joe-desimone/mongobleed/blob/main/mongobleed.py

> This one is incredibly widely internet facing and will very likely see mass exploitation and impactful incidents

> Impacts every MongoDB version going back a decade.

> Shodan dork: product:"MongoDB"



> The exploit is real and works, you can just run it and target specific offsets and/or keep running it until you get AWS secrets and such.

https://nvd.nist.gov/vuln/detail/CVE-2025-14847

> This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

https://redd.it/1pw913t
@r_systemadmin

Securely share files to me via a persistent link.

Hey guys, I'm looking for a solution that would allow people to securely share a file to me via a persistent link that I would drop in my email signature. There seems to be a ton of products out there that would either let me create links to share files with other people, or create one time links to request information from people, but I cant find one that would allow me to create one persistent link that people could click to upload the file to me. Do yall know of anything like that?

https://redd.it/1pwaadl
@r_systemadmin

Auditors want evidence of monitoring

We’re preparing for an audit and one of the requests is proof that monitoring is happening. We do logs/alerts and on call rotations, but none of it was designed with evidence in mind.


What do auditors actually accept as evidence of monitoring?

https://redd.it/1pwb75w
@r_systemadmin

plug and play site-to-site non-subnoscription VPN devices ?

Looking for a portable-ish solution - what are options to avoid monthly subnoscription software ?

0-3x/month need to remotely work on a PC for 24-48 hours. Different PC at the remote end each time. The ISP device at the remote end would not be in bridge mode and no static IP is possible.

I envision having the remote office staff pull a"target VPN gadget" out of a drawer, plug it in/turn it on, connect by ethernet to ISP modem/router, connect by ethernet or USB to PC and it's done for their involvement. When work on the PC is done, they unplug and store it. Portability for this "target gadget" to be used at a couple of locations without configuration would be a bonus. ISP devices range from Starlink to mobile carrier hotspot to cable or fiber combo modem/router.

The "admin gadget" at our end can require extra work for each connection. The target and admin gadgets must be configurable to recognize/allow access only via the other gadget.

TLDR: need to open an RDP-like connection between PCs with little assistance from end user, avoiding opening an actual RDP port on the ISP device.





https://redd.it/1pwb5dx
@r_systemadmin

NAS Fileserver?

One of our Servers needs to be replaced in 2026. It's for a small group in our office, but they have roughly 13tb of data on this server.

Right now they are in their own domain, and the server is hosting AD/DHCP for their network. The plan is to migrate that group of users into the Companies main domain, and let our main DC / DHCP take over. The question now is file storage.

We're a relatively small business. 130ish users, and day to day only 30 users max would accessing these files at a time. I don't really see the point in spending thousands on a server + CALs.

Does anyone here run a NAS as their "File Server"? I've heard / read good things about Synology. I almost feel like it's 6 in one hand, half dozen in the other.

Any insight would be helpful.

https://redd.it/1pwemoh
@r_systemadmin

SSL certificate expired on our domain and this is my first time fixing this.

I’m still pretty new to this and have mostly done desktop support. Our SSL certificate expired on the 23rd, and the person who normally handles this is out this week and next, so it fell to me. I just want to make sure I’m heading in the right direction.

I renewed the certificate, then learned I needed to generate and submit a CSR. I created the CSR through IIS Manager and submitted it to Network Solutions. It’s been almost six hours now, and the request is still in the “in validation” status. How long does this usually take?

https://redd.it/1pwfhd5
@r_systemadmin

IT ticketing system

Our IT team has been struggling to keep up with all the internal requests and tickets. We’re thinking about switching to a service desk or IT ticketing system that can make things more efficient and maybe automate some tasks. Something that can track assets and integrate with tools like Slack would be a bonus. Has anyone here tried tools like Jira Service Management, FreshService, Siit or GLPI? These are the tools we commonly hear or mentioned, I’d love to hear what worked for those and if any tips to remember.

https://redd.it/1pw6kwu
@r_systemadmin

Does anyone else see random Bitlocker recoveries after firmware updates?

We are a 100% Dell shop, and we have firmware delivered by Windows Update (for years) and Dell Command Update (introduced in the last few months).

I would say that about 10% of our fleet get the Bitlocker recovery screen after a firmware update. Admittedly, that means that about 90% never get the issue. It's easy enough to fix, but it's just a bit of a PITA.

Does anyone else periodically see this? Is it a bug? I mean, all devices are configured exactly the same, so I don't have a better explanation. Dell Command Update is explicitly configured to suspend Bitlocker, and ny understanding that firmware updates from Windows Update are configured by Microsoft/Dell to do the same.

https://redd.it/1pwizdk
@r_systemadmin

Difficulty connecting to Postgresql DB

Trying to connect to my VPS's postgresql DB from my Windows machine and having trouble.

\- Using DBeaver

\- SSH Tunnel connection works fine in DBeaver, it can connect successfully

\- When connecting the actual DB though and then testing the connection, I receive an EOFException - The connection attempt failed

\- The connection limit in the .conf file for postgresql is 100 and I have triple checked the credentials. I can access it fine when I SSH into my server via Powershell and use the psql command from the command line.

What would be the next debug step?

https://redd.it/1pwget9
@r_systemadmin

I’m stuck on a scan-to-folder setup. No router access, need to use Hostname instead of IP. Any tips?

Hey guys.

I’m currently helping my dad setting up a copier for a client (he lease the machines to them), and I’m trying to get their Scan-to-Folder/FTP working.

The problem is, I don’t have access to their router/DHCP settings, so I can’t set a static IP or a reservation for the destination PC. Right now, it’s on a dynamic IP for a wifi network, so as soon as that lease expires, the scanning is obviously going to break.

I want to set the copier to point to the PC's Hostname instead of the IP address so it actually stays connected, but currently this option is not working.

For those of you who do this often:

Is there a trick to getting the copier to actually resolve the name?
Or is there a way to set a different ip profile for the network

The machine is a Ricoh, Any advice is appreciated!

https://redd.it/1pwu9h9
@r_systemadmin

HA, data, file locks, integrity, philosophy, architecture...where to begin learning?

I am a network engineer and have been expanding my knowledge base. I have been in the Industry for 8 years but oddly never really dealt with data storage. Making load balancers balance and proxies proxy I fully understand; I make the data move. I have done that for years without a second though. But I realized something today that leads to something that turns out to be a lot more complex and sinister than I ever imagined...... Data integrity.

I got on a "throw up a bunch of services in containers in my homelab and make them redundant" kick lately. It was all fun and games until I threw one up that required persistent storage and was load balanced to the secondary server where the data wasn't stored. "No problem", I thought, "I will just write a little Bash noscript to sync the data over".

Fortunately, "professionalism" kicked in before I set out on that endeavor. I thought...

"What happens if the data on one becomes corrupt; should there be a master and slave"?

"What happens if there is a file lock on a data base"? (And, as a matter of fact, where the hell are the database "files"?).

"How much data can I stand to lose"?

"What exactly is the difference between syncing and backing up -- beyond philosophically archival)"?

"How do major providers globally load balance across clusters of DBs and services in hybrid Azure and AWS environments; Like how do the backends stay in sync? How do the clusters stay in sync? How much delay between propogation"?


"I have so many other questions I should ask Reddit on where to begin..."

tl;dr: I don't know shit about data storage and integrity. I would like to start learning from the fundamental level. But I don't really know where to begin, which search words to use, etc. Should I take some DB admin classes; like, is that where they teach this kind of stuff?

https://redd.it/1pwxho1
@r_systemadmin

Receiving Credentials securely from clients

We work with a lot of small businesses / non-tech-savvy users, and I keep running into the same issue: securely receiving credentials. Obviously, the best case would not having to receive credentials at all but many systems (DBs, web portals, decryption keys, etc.) still require exchanging secrets.

Most "best practice" tools (password managers, PGP, etc.) are great when both sides are already set up but they mostly focus on sending, not intake. In the real world, clients often default to sending us their credentials via Teams/Slack/email, and in the process either forget some info or just leaving a trail of unencrypted credentials forever.

So I ended up building a small tool to make credential intake easy: send a link to a simple form, they paste creds, it's end-to-end encrypted (you set an encryption secret, only you can decrypt answers). It's for transfer only, you still store them in your vault afterwards.

Disclaimer: I built it (credentialshare.com). Not trying to spam - genuinely curious: what's your workflow for securely receiving creds from non-technical clients, and what features would you expect from a tool like this? I'm using it 4-5 times a week now and it helps me a lot but it is still early stage so any feedback or improvement suggestions are greatly appreciated!



https://redd.it/1pwy2xt
@r_systemadmin

I just saved our company by unplugging and plugging it in again.

Hi guys,

being a small business (webhosting) sysadmin sucks. Being on-call sucks more. Not being on-call and supposed to fix stuff - sucks even more.

Just was at the doctors office, my leg was acting up again (despite being almost 30 i somehow have the condition of a 60 year old) - suddenly got a message via Zabbix that a server restarted according to plan and won't boot again, due to a Pwr Rail D error (thanks lenovo). Reboot via IPMI failed immediately. Still at the doctors, i sent another technician to check - no luck. He "tried" everything and he thinks it's a faulty board. My heart dropped, since this is catastrophic and the system needs to be ready asap again.

So, after the visit i immediately got to location and tried booting it. Didn't work.

Unplugged it. Plugged it in again. And - lo and behold - it booted without a problem.

Replaced hot-plug PSU for safety anyways.

Of course i got the usual talk about "saving the company" and being there when nobody else knew "the solution".

I am sad tho.

I'm just sad that somehow nobody uses basic troubleshooting anymore.


Stunning. :D


https://redd.it/1px1x19
@r_systemadmin

Thoughts on grads with Master's degrees?

Posted in another thread about how new grads aren't following the traditional career path.



It used to be, you'd get a bachelor's and then get job. After some time, you'd go back and get a master's. You'd then have the work experience and the education to go to the next level into senior or management level roles.



What graduates are doing now is, they're getting a bachelor's and then immediately going for the master's. Then they're entering the workforce with both a bachelor's and a master's degree with little or no work experience.



So on paper they appear overqualified (from an educational perspective) than other folks who might only have a bachelor's or certificates.



A fair amount of our IT help desk interns have masters degrees or are working on them but know next to nothing. A lot of them are still trying to figure out where in IT they want to specialize in but somehow already have master's degree. Some already come certified on top of having bachelor's and masters degrees.



Is this the new normal? Is the next generation of admins going to come with PhD's ready to be CTOs with none of the experience?

https://redd.it/1px3xwr
@r_systemadmin

Absolute not working properly

In my company we use absolute to track, and freeze laptops. I have set up a policy that will freeze devices that have been inactive for more than 60 days, however Absolute is freezing active devices and claiming they have been inactive for more than 60 days, when that is not true.

I can't seem to find the root cause, has this happened to anyone? If so, how did you fix it?

Thanks in advance.

https://redd.it/1px539n
@r_systemadmin

MTA -> MTA no STARTTLS option from large providers

I’ve noticed something kinda odd with server to server smtp (port 25).

From my MTA, gmail, icloud and other large providers are not advertising or supporting STARTTLS.

My server has proper dns records, PTR, ehlo hostname is proper FQDN, etc.

Haven’t found much info online but chatgpt suggests they suppress the option based on ip reputation?

Example (host and ip redacted)

$ telnet gmail-smtp-in.l.google.com 25
220 mx.google.com ESMTP ...
EHLO mail.example
250-mx.google.com at your service, [x.x.x.x]
250-SIZE 157286400
250-8BITMIME
250-ENHANCEDSTATUSCODES
250 SMTPUTF8
 

$ telnet mx01.mail.icloud.com 25
220 iCloud iscream SMTP proxy ...
EHLO mail.example
250-p00-iscream-smtp-bfcd5584b-7vfbt
250-SIZE 28311552
250-ETRN
250-ENHANCEDSTATUSCODES
250 8BITMIME

I know TLS is optional and not required, I’m just wondering if and why they would not advertise or support it based on ip reputation? Or is there another reason?

They support it when connecting on 587 to submission servers but that is different server and roles so i don’t think it’s relevant.


https://redd.it/1px6lbu
@r_systemadmin

How’s turnover where you work?

I joined IT back in 2013 and went straight to being a sysadmin, and have been up and around the role across jobs but it seems that after a few years the whole dept gets replaced. Do I just have bad luck?

First job was started because the whole dept quit. The company didn’t want to pay them so I got pulled in last minute to get everything under control but left because they stopped paying me after about a year.

Second job the company outsourced everyone, sent everyone to the streets and hired an MSP. CEO ended up getting prosecuted for embezzlement with said MSP.

Third job was toxic AF from the very top. We all left one by one a few weeks apart. Some went to competing companies together, myself included.

Fourth and current job had massive layoffs. 7 of my co-workers were laid off and I’m expected to pick up their work. The company assigned me a team I can look to but their job duties are so different that there’s not much they can do to help. They don’t really seem to want to learn anything either. I’m weighing my options on leaving as well.

Anyone else having this experience in IT?

Is IT not the kind of industry we can sit and cruise for a few years?

https://redd.it/1px6y3n
@r_systemadmin