6 ms·
Tinc is pretty amazing. My only beef with it is that once a node is connected to the network, if you ever wish to revoke access, you have to update all nodes on
by subway 9y ago
Tinc is pretty amazing. My only beef with it is that once a node is connected to the network, if you ever wish to revoke access, you have to update all nodes on the network to ensure the revoked node is now gone.
- chatmasta 9y agoUnix philosophy says keys should be stored somewhere else, and you can write your own logic to update them on each node.
- billabul 9y agoon tinc each node could have a different public key configuration for the other nodes
- subway 9y agoRight -- the trouble is tinc only halfway adheres to this. It will happily distribute a key. This means if you delete a node from 3/4 of your network, eventually that node's key is redistributed across the network.
- samsk 9y agoSee https://github.com/samsk/ansible-tinc https://github.com/samsk/ansible-tinc
- subway 9y agoYeah, there are a number of out of band mechanisms available to manage keys, but the issue still remains that you have to rely on an out of band mechanism to revoke access. If nodes reside in multiple administrative zones the situation gets even more awkward.