10 ms·
Ubuntu 20.04 LTS Adds WireGuard Support
- rainworld 7y agoWith that, Ubuntu Core 20 should be a brilliant fire-and-forget VPN server.
- kube-system 7y agoI'm excited for wireguard, but I'm not going to use it in production until the authors advise that it's ready for production.
- rainworld 7y agoOnly out of abundant caution, it seems. I mean, Cloudflare is using it.
- ownagefool 7y agoThe author has specifically said it'll be considered released when it's in the kernel, which makes the parents point kinda mute.
- panarky 7y agohttps://grammarist.com/usage/moot-mute/ https://grammarist.com/usage/moot-mute/
- ComputerGuru 7y agoCloudflare is not the golden standard for security.
- vsareto 7y agoWho is?
- all_blue_chucks 7y agoOpenBSD
- tptacek 7y agoI don't know a lot of serious systems security people who actually believe that. OpenBSD is fine, and smart people work on it, but it's been a long time since the early 2000's.
- all_blue_chucks 7y agoAFAIK it remains the single most selective platform out there. If a project is included in an OpenBSD release you know it has undergone serious whitebox scrutiny for security issues. I'm not aware of any platform that is quite so pedantic at the source code level.
- aquabeagle 7y agoAnd yet: https://news.ycombinator.com/item?id=22175431 https://news.ycombinator.com/item?id=22175431
- tptacek 7y agoI've said pretty much all I have to say about this, here: https://news.ycombinator.com/item?id=7071219 https://news.ycombinator.com/item?id=7071219
- coolsunglasses 7y agoWhat's the history there?
- PhilippGille 7y agoThe protocol yes, but don't they use their own implementation? https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
- tw04 7y agoSure, but the underlying codebase hasn't had a public audit for boringtun or wireguard, so they're both in the same boat.
- Hamuko 7y agoCloudflare is also cautioning against using their own implementation in production.
- atonse 7y agoSecurity people are always like that (I love that about them). They freak out if a hash function will now take 50 million years to find a collision on a supercomputer, rather than 345 billion. It's worked flawlessly for me and many others the past year in our production environment. The fact that Ubuntu is including it, means that it's probably passed a critical mass of early adopters and then is probably seeping into the startup mainstream (as opposed to enterprise that wants 20 valid bells and whistles like authentication, auditing, etc).
- kube-system 7y agoThe authors say that their current version(s): > should not be considered real releases and they may contain security quirks (which would not be eligible for CVEs, since this is pre-release snapshot software) I figure they know better than I do.
- pedrocx486 7y agoIn ~2 months time Wireguard is reaching 1.0 along with Linux 5.6, I figure it's quite stable already and they say that (as anyone with a sane mind would) to keep their asses safe.
- pnako 7y agoI also use it, and it works, but this tells us nothing about its actual security. Security people are also subject to fads and fashion just like web developers or indeed any other technical group. Many will endorse the primitives developed for example by Dan Bernstein without understanding anything about how they actually work, or having read and understood papers describing their security. Just because he has some hacker "street cred" (arguably well deserved) as the developer of qmail, etc.
- Ar-Curunir 7y agoThe primitives codesigned/codiscovered by Dan Bernstein have become popular not because of hacker street cred but rather because they are peer reviewed and have good design rationale
- FDSGSG 7y agoI guess you're just left with no VPN software then? If WG isn't suitable for production, then OpenVPN, IPSec & co. definitely aren't.
- kube-system 7y agoI can only make informed decisions based on the information I have. I don't have the time or expertise to personally audit every piece of code I use. I have to leverage the available resources and evidence that others have put forward.
- FDSGSG 7y agoAnd all evidence put forward seems to suggest that all commonly deployed VPN solutions really suck. Do you simply ignore that evidence?
- kube-system 7y agoKnown weaknesses are actionable. Unknown weaknesses are not.
- FDSGSG 7y agoKnown weaknesses such as vast and messy codebases? What's the action there? A full rewrite?
- mekster 7y agoSecurity is only considered stable after being consumed long enough without holes, so not sure how you're measuring it.
- zx2c4 7y agoFrom the most recent wireguard-linux-compat release notes: https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html https://lists.zx2c4.com/pipermail/wireguard/2020-January/004... > Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release. In other words, over the next ~10 weeks, Linus' kernel tree and Dave Miller's net.git tree will fill up with nice stabilization patches. At the end of that process, 5.6 will be released. At that time, our backports to older kernels (wireguard-linux-compat) will also become a "1.0". This also lines up with the 20.04 LTS release and such.
- DCKing 7y agoGreat. This will mean wonders for the short-term adoption of Wireguard, as it's now in a "stable" Linux distro. After Ubuntu 20.04 there's a big gap in new "stable/enterprise" releases. Debian 11 - Mid 2021, probably OpenSUSE Leap/SLES 16 - Mid 2021, probably Ubuntu 22.04 LTS - April 2022 Red Hat 9 - probably 2024 ? So if Ubuntu hadn't included this, we would have to wait more than a year to have it in the kernel of a "server-grade" Linux system by default. Most people don't like running more cutting edge distros or fiddling with the kernel on their servers. Defaults matter, so this will be great for Wireguard adoption.
- curt15 7y agoRed Hat is known to backport features into RHEL kernels. Could Wireguard conceivably make it into RHEL 8.x?
- CiPHPerCoder 7y agoRed Hat still ships ancient versions of PHP in their official packages. I wouldn't bet on a backport unless you have a lot of clout (a.k.a. purchasing power) behind you.
- jagger27 7y agoI can understand why RHEL would still ship ancient PHP versions to keep legacy apps running, but I think WireGuard would be an easier sell considering it's so unobtrusive and has no legacy software to worry about breaking.
- CiPHPerCoder 7y agoThe problem isn't "RHEL ships ancient PHP for legacy apps". The problem is "RHEL doesn't also ship newer PHP as an alternative and you need to instead rely on third-party repositories".
- chucky_z 7y ago
- psoots 7y agoWireguard still has this warning on their site: > WireGuard is currently working toward a stable 1.0 release. Current snapshots are generally versioned "0.0.YYYYMMDD" or "0.0.V", but these should not be considered real releases and they may contain security quirks (which would not be eligible for CVEs, since this is pre-release snapshot software). This text will be removed after a thorough audit.
- cjbprime 7y agoIt looks like they're saying that they'll switch to 1.0 when Linux 5.6 is released in a few weeks.
- 3fe9a03ccd14ca5 7y agoWhat’s the best “WireGuard as a VPN configuration” doc out there? Many are not clear about what is being set up, why the cidrs are chosen, how it works without DHCP etc. other guides focus on only proxying rfc1918 traffic and not your entire connection. Is my DNS leaking? Is ALL traffic going through it? OpenVPN, with all of its issues, is simple to set up in a way that’s not leaky.
- brunoqc 7y agoThe best is probably with network namespaces where you don't have network access by default, only wireguard has. https://www.wireguard.com/netns/#routing-all-your-traffic https://www.wireguard.com/netns/#routing-all-your-traffic There's probably some guides out there.
- carlhjerpe 7y agoIf you put two /1 routes towards the private vpn endpoint and one route for your public vpn endpoint to your public ip it'll route all traffic over the vpn because it's the more specific route. The rest is your ip rules and your issue if you don't want any traffic in your physically attached subnet to go over the shortest distance. It's not really up to the protocol, it's the tooling around it.
- GABeech 7y agoWireguard needs to put actual logging into the product before anyone should consider using it in production. I have to deal with it via a vendors product and have spend about 4 weeks in the past 6 months trying to fix a flaky connection by guessing and restarting a lot. Just like anything things will go wrong. But, with wireguard you have no idea what it could even be if it's not an obvious thing that you can diagnose with ping.
- big_chungus 7y agoWireguard also needs a better auth mechanism. I really like the simple secure key-based auth for small-scale stuff, but it's not viable for scaling at production levels. Things like user/pass auth (even if as an additional layer of security rather than displacing existing keys), 2FA, etc. will be important to get adoption at scale. I hope wireguard creates a module interface of sorts so people can extend the protocol as needed.
- pa7ch 7y agoWireguard doesn't need to change at the protocol level to add those features and I think thats the point. Userspace programs can be written to fetch keys from a server based on SSO or w/e.
- XMPPwocky 7y agoNo, I don't think it does. The thing about simple, key-based authentication is that it's very extensible, without changing the actual protocol. What? Well, what Wireguard's auth actually means is that you can use whatever authentication you want to communicate a shared secret to both ends. Want to authenticate with, say, SSH keys? Sure- SSH into a server, run a command that generates a new Wireguard key, connect in with that key. LDAP? Same situation. Whatever SSO you want- as long as you can stick up authentication in front of a service that's able to pull bits from /dev/urandom. Multifactor? Sure. Wireguard does one thing well. What's missing is not features in Wireguard- it's the ecosystem around it to actually handle key management. For enterprises, Hashicorp Vault or something should probably look into supporting Wireguard; for smaller situations, some SSH-based key exchange, like the way Mosh handles things, seems reasonable. Complex, pluggable authentication is sometimes necessary...but you want as few implementations of it as possible, and you sure don't want it in the kernel if you can help it.
- diminish 7y agowireguard is now available from android, ios to mac, windows and other platforms.
- Daniel_sk 7y agoThe iOS app is very bare-bones and it drops the connection once a day and doesn’t notify you about and doesn’t try to reconnect automatically. I hope Mullvad VPN will release their own app this year.
- app4soft 7y agoFTR, WireGuard also available in F-Droid repo for all Android 5.0+ devices.[0] > If your device has a custom kernel containing the WireGuard module, then the module will be used for superior battery life and performance. Otherwise a userspace version will work sufficiently on all other devices. [0] https://apt.izzysoft.de/fdroid/index/apk/com.wireguard.android?repo=main https://apt.izzysoft.de/fdroid/index/apk/com.wireguard.andro...
- zx2c4 7y agoFor Google Pixel devices, we're actually prebuilding and distributing WireGuard kernel modules for use in that app: https://github.com/WireGuard/android-wireguard-module-builder#downloading https://github.com/WireGuard/android-wireguard-module-builde...
- dstaley 7y agoI'm assuming these modules require superuser access, correct?
- zx2c4 7y agoYea, kernel-wireguard on Android is just for people who have rooted their phones and want a little extra adventure. Cellphones have weird networking stacks and unusually written drivers (I'm looking at you, qcacld and rmnet_perf...), so supporting WireGuard's kernel module on Android has been very worthwhile to us for fine tuning things. Plus the performance is as good as can be in kernel space. But it's definitely something for "rooters only."
- mqus 7y agoI'm sad that it doesn't support older versions... There are still many users on these devices.
- roboctipus 7y agoCould someone please explain what a meaningful example usage of WireGuard might be? The intro seems to imply something that could be duplicated with a terminal + SSH forwarding + a VPS. How is this better and/or different? Thank you :-)
- chousuke 7y agoI use it as an IPSec replacement for a site-to-site tunnel and to provide my phone a VPN connection to my home network. Wireguard is much easier to set up than either IPSec or OpenVPN, and seems to outperform at least the latter.
- BrandoElFollito 7y agoWhile I love the product and use it in production, debugging is a royal pain in the ass. There is zero logging to help understand when and how a connection is established (or not) server side. Logging that someone tries to conne ct but wrong key, wrong protocol, whatever - that would help tremendously. Today it is tcpdump or wireshark all the way.