There are a few pitfalls when trying to fetch groups from LDAP. I document some here so I remember it for the next time I have to do it.

Use an appropriate object filter

It is possible to filter for object classes in LDAP. By default, ldapsearch should not impose a filter on the object class. If you want to distinguish users from groups, you will therefore need to set it manually. For example, use objectClass=group to only obtain groups in your LDAP result.

This is how I proceed to remove files from a git history, no matter if this is about large files or sensitive data. Note: This is not supposed to be reliable in removing sensitive data. There are many pitfalls in removing sensitive data from git histories, so consult a more reliable source in case it really matters.

Rewriting commits

On one machine, use a fresh cloned copy of the git repository (or use --force) to rewrite the commits. I learned that git filter-repo, the recommended tool for this task, now provides an option --sensitive-data-removal, which makes removing files from the git history really easy. Use this syntax:

In a previous post , I described how to manually authenticate against an OAuth2 compatible identity provider using bare tools like curl and Python’s requests library. In this article, I extend that work to also include manual introspection and userinfo with a Shibboleth identity provider. I’ll update the example Python script in the original article to include the examples described here as well.

OAuth2 Introspection

Introspection allows a service provider, e.g. a web application the user wants to use, to verify the authenticity of the access token presented by the user. While correctly signed JSON Web Tokens (JWTs) can be verified locally without contacting the introspection endpoint, this allows verification of non-JWT-tokens or possibly the revocation of tokens.

We want to secure our mailservers with two-factor-authentication, but unfortunately, most email clients (e.g. thunderbird) only provide two-factor-authentication flows for defined mail providers like Google or Microsoft (the issue is still open). So I wanted to do a manual OpenID connect / OAuth2 authentication using curl with Shibboleth as an identity provider. Afterwards, a very recently published Thunderbird plugin could help in rolling this out.

1. First, query the /.well-known/openid-configuration endpoint of your identity provider. This should provide a JSON-formatted response describing the available OpenID endpoints, that could look like this:

Sometimes I want to have more control on how Garafana formats timestamps in its panels. This may be dependent on grafana settings and the browser locale, but sometimes I want to make sure timestamps are formatted exactly how I want. This will be a quick write-up of how I’m doing it, so I don’t forget it until I have to do it the next time. As an example, I’m going to use the panel created for the weekly delta Grafana/Prometheus post .

I’m using Grafana and Prometheus for monitoring, and I often want to break a counter metric (continuously increasing) into weekly deltas. Sometimes I find it confusing how Prometheus range vectors and functions work in Grafana, and I tend to forget how I did it the last time. Hence I want to write down one way of doing weekly deltas that I recently used and checked for correctness.

1. Choose a counter metric you want to split into weekly deltas, and add it to a new panel in Grafana. Do any filtering and adjustments as needed. You may also already set a title, units and other formatting options in Grafana.

While I have some networking experience using copper networks, I have never configured fiber networking in the past. As I needed to connect two buildings across 150 meters of cable distance, preferably with 10Gbps speeds, this was the moment to get my first fiber network running. However, I wanted to do it entirely using open source software, in this case OpenWRT.

SFP+ tranceivers usually advertise their compatibility with certain hardware manufactures. Unfortunately, I didn’t find any advertising OpenWRT or even Linux compatibility. So I was a bit sceptical aboud which tranceivers to order. After a brief period of research, I decided to just go for it and order two SFP+ tranceivers from fs.com, announcing “Generic” support. And I was very glad to find out they worked out of the box on my OpenWRT SFP+ devices.

Motivation

I want to switch my network setup to open source software (and hardware) as much as possible. Therefore, I was looking for a modern OpenWRT WiFi device for quite a while now. I wanted stable OpenWRT support, enough computing power, memory and storage to run OpenWRT with some packages smoothly, preferably in open hardware. Most importantly, I wanted to directly go for WiFi 7 from my current WiFi 5 network. Even if I do not own any WiFi 7 devices yet, I want to use my new networking equipment for years to come, and therefore be future-proof. I also needed an SFP+ slot for cross-site connectivity, and preferably 2.5GiB+ copper ethernet as well to support the fast WiFi network.

Motivation

In my home network, I use a separate VLAN for guest access, i.e. devices that are allowed to connect to the internet but should not have access to local devices. Of course, the guest network should be available via a separate WiFi SSID as well. However, configuring this took me quite a while in LuCi and the reForis interface on my new Turris Omnia NG routers. While I am quite familiar with Linux networking on the command line, OpenWRT configuration is quite new to me. And although most configurations translate well from plain Linux networking to OpenWRT, there are some trivialities I still need to wrap my head around.

I want to access metrics of my OpenWRT networking equipment in my Prometheus/Grafana setup. Luckily, there are OpenWRT packages for exporters that provide Prometheus endpoints directly on the device and require no external services.

To enable Prometheus monitoring on the OpenWRT device, I install the corresponding exporter packages, e.g. via SSH:

ssh root@host opkg install prometheus-node-exporter-lua-hwmon prometheus-node-exporter-lua-netstat prometheus-node-exporter-lua prometheus-node-exporter-lua-nat_traffic prometheus-node-exporter-lua-thermal prometheus-node-exporter-lua-openwrt prometheus-node-exporter-lua-ethtool prometheus-node-exporter-lua-nft-counters prometheus-node-exporter-lua-uci_dhcp_host prometheus-node-exporter-ucode prometheus-node-exporter-lua-snmp6 prometheus-node-exporter-ucode-dnsmasq prometheus-node-exporter-ucode-wireguard prometheus-node-exporter-lua-wifi prometheus-node-exporter-lua-wifi_stations

WiFi related packages may be excluded if the device has no WiFi radios. There are more packages available that may be included if corresponding hardware / services are used. Note that there are two kinds of Prometheus exporters for OpenWRT, the lua ones and the ucode ones. I prefer the lua ones as there are more exporters available for the lua framework.