{
    "version": "https://jsonfeed.org/version/1",
    "title": "Random tech stuff",
    "description": "",
    "home_page_url": "https://blog.antonin.verrier.eu",
    "feed_url": "https://blog.antonin.verrier.eu/feed.json",
    "user_comment": "",
    "author": {
        "name": "Antonin Verrier"
    },
    "items": [
        {
            "id": "https://blog.antonin.verrier.eu/openssh-authorizedkeysfile-and-winbind/",
            "url": "https://blog.antonin.verrier.eu/openssh-authorizedkeysfile-and-winbind/",
            "title": "[OpenSSH] AuthorizedKeysFile and winbind",
            "summary": "<p>A tale about OpenSSH, \"winbound\" users and the <code>%u</code> variable expansion.</p>\n",
            "content_html": "<p>A tale about OpenSSH, \"winbound\" users and the <code>%u</code> variable expansion.</p>\n<hr>\n<p><em>(</em><em>Tested on Debian 13 Trixie)</em></p>\n<p>Quick note about something I spent waaaaayyyyy too long figuring out.</p>\n<p>Let's imagine you want to have some form of central management for AuthorizedKeysFile, so you configure OpenSSH like that:</p>\n<p><code>AuthorizedKeysFile /etc/ssh/keys/%u</code></p>\n<p>And then you users actually come from an Active Directory domain, so you have winbind, who will give you usernames like <code>DOMAIN\\johndoe</code>.</p>\n<p>Well, the <code>%u</code> will actually be expanded by OpenSSH as <code>DOMAINjohndoe</code>  (notice the missing slash) for the purposes of SSH login, even if the user actually only logs-in as <code>johndoe</code>.</p>\n<p>Meanwhile, <a href=\"https://github.com/jbeverly/pam_ssh_agent_auth\">pam_ssh_agent_auth</a> (PAM module which allow, for example, pseudo password-less sudo) will actually expand <code>%u</code> to <code>DOMAIN\\johndoe</code>.</p>",
            "author": {
                "name": "Antonin Verrier"
            },
            "tags": [
                   "sysadmin",
                   "openssh",
                   "opensource",
                   "linux"
            ],
            "date_published": "2026-05-11T19:52:15+02:00",
            "date_modified": "2026-05-11T20:08:00+02:00"
        },
        {
            "id": "https://blog.antonin.verrier.eu/opnsense-allow-router-to-connect-across-ipsec-tunnel/",
            "url": "https://blog.antonin.verrier.eu/opnsense-allow-router-to-connect-across-ipsec-tunnel/",
            "title": "[OpnSense] allow router to connect across IPSec tunnel",
            "summary": "<p>A bit on OpnSense IPSec tunneling and the routing config that should probably have been on by default.</p>\n",
            "content_html": "<p>A bit on OpnSense IPSec tunneling and the routing config that should probably have been on by default.</p>\n<hr>\n<p><em>(Tested on OpnSense 26.1)</em></p>\n<p>When setting up an IPSec tunnel in OpenSense, by default, the tunnel will not be used to to access remote hosts by services running on the firewall host itself (eg. : LDAP for auth, syslog, etc.)</p>\n<p>To allow services running on OpenSense to use the tunnel:</p>\n<ol>\n<li>Create a gateway (<code>System</code> &gt; <code>Gateways</code> &gt; <code>Configuration</code>), bind it to the LAN interface, with the LAN IP as the gateway IP<figure class=\"post__image\"><img loading=\"lazy\"  style=\"font-size: inherit;\" src=\"https://blog.antonin.verrier.eu/media/posts/1/Copie-decran_20260511_175151.png\" alt=\"gateway creation screenshot\" width=\"974\" height=\"642\" sizes=\"(min-width: 920px) 703px, (min-width: 700px) calc(82vw - 35px), calc(100vw - 81px)\" srcset=\"https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175151-xs.png 300w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175151-sm.png 480w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175151-md.png 768w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175151-lg.png 1024w\"></figure></li>\n<li>Create a route (<code>System</code> &gt; <code>Routes</code> &gt; <code>Configuration</code>) for the remote subnet and bind it to the gateway you just created<figure class=\"post__image\"><img loading=\"lazy\"  style=\"font-size: inherit;\" src=\"https://blog.antonin.verrier.eu/media/posts/1/Copie-decran_20260511_175242.png\" alt=\"Route creation screenshot\" width=\"974\" height=\"323\" sizes=\"(min-width: 920px) 703px, (min-width: 700px) calc(82vw - 35px), calc(100vw - 81px)\" srcset=\"https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175242-xs.png 300w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175242-sm.png 480w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175242-md.png 768w ,https://blog.antonin.verrier.eu/media/posts/1/responsive/Copie-decran_20260511_175242-lg.png 1024w\"></figure></li>\n</ol>\n<p>That's it!</p>",
            "author": {
                "name": "Antonin Verrier"
            },
            "tags": [
                   "opnsense",
                   "opensource",
                   "networking"
            ],
            "date_published": "2026-05-11T17:54:55+02:00",
            "date_modified": "2026-05-11T20:04:30+02:00"
        }
    ]
}