5 ms·

Wireguard also needs a better auth mechanism. I really like the simple secure key-based auth for small-scale stuff, but it's not viable for scaling at producti

Wireguard also needs a better auth mechanism. I really like the simple secure key-based auth for small-scale stuff, but it's not viable for scaling at production levels. Things like user/pass auth (even if as an additional layer of security rather than displacing existing keys), 2FA, etc. will be important to get adoption at scale. I hope wireguard creates a module interface of sorts so people can extend the protocol as needed.

pa7ch 7y ago
Wireguard doesn't need to change at the protocol level to add those features and I think thats the point. Userspace programs can be written to fetch keys from a server based on SSO or w/e.
XMPPwocky 7y ago
No, I don't think it does. The thing about simple, key-based authentication is that it's very extensible, without changing the actual protocol. What? Well, what Wireguard's auth actually means is that you can use whatever authentication you want to communicate a shared secret to both ends. Want to authenticate with, say, SSH keys? Sure- SSH into a server, run a command that generates a new Wireguard key, connect in with that key. LDAP? Same situation. Whatever SSO you want- as long as you can stick up authentication in front of a service that's able to pull bits from /dev/urandom. Multifactor? Sure. Wireguard does one thing well. What's missing is not features in Wireguard- it's the ecosystem around it to actually handle key management. For enterprises, Hashicorp Vault or something should probably look into supporting Wireguard; for smaller situations, some SSH-based key exchange, like the way Mosh handles things, seems reasonable. Complex, pluggable authentication is sometimes necessary...but you want as few implementations of it as possible, and you sure don't want it in the kernel if you can help it.
- yardstick 7y ago
  The problem is lots of organisations in the financial and medical worlds need 2FA. WireGuard needs a 2FA solution - It doesn’t have to be kernel based - but it does need to protect against someone grabbing a copy of the single factor auth in WireGuard (keypair). A solution that rotates/manages/provisions/etc these keypairs is still fundamentally single factor auth of the tunnel.
  - tptacek 7y ago
    Nobody is arguing that there shouldn't be IdP-based WireGuard management systems. The point is that they are out of scope for the WireGuard project itself. WireGuard has an extremely straightforward configuration interface; if Okta wanted to manage WireGuard, they'd likely have no problem doing it.
    - yardstick 7y ago
      Is there any decent open source 2FA / IdP management systems at the moment that work with WireGuard?
      - ficklepickle 7y ago
        It has just landed in one distro. If there isn't yet, there certainly will be.
        yardstick 7y ago
        You don’t need a distro for this, and WireGuard has been available and in use for several years. So in that time has anyone developed a practical 2FA solution that is compatible with it?
        tptacek 7y ago
        People have. I'm unaware of any published. It's not hard. Implementing a new IdP-integrated WireGuard authorizer is probably easier than understanding IPSEC or OpenVPN in sufficient detail to secure it.
      - marsokod 7y ago
        There are some attempts like subspace: https://github.com/subspacecloud/subspace https://github.com/subspacecloud/subspace but I have not found anything stable yet.
  - XMPPwocky 7y ago
- Spivak 7y ago
  The problem is that a Wireguard key isn't a session token -- it isn't revoked when the connection ends or goes idle. It's more like an authorized SSH key which in most environments meets the bar for 1FA even if it requires 2FA to set up the key. WG has the concept of sessions already, the only change would be allowing a process in userspace to instrument the sessions directly without going through the key system. The the default key-routing system would be just one method of issuing and managing sessions making the core protocol even simpler!
  - labawi 7y ago
    By sessions, do you mean the key agreement/initiation protocol, that is re-run every 2 or so minutes (with the keys having moderately overlapping validity)?
jrockway 7y ago
I think you might like something like Tailscale: https://tailscale.com/ https://tailscale.com/
- big_chungus 7y ago
  It looks quite good, but I don't see any information on: 1. Is it open-source? 2. When am I going to see the "you have to pay us now" screen, and how much will it cost? I realize it's a business and am fine with that, but want to know what I'm spending before setting stuff up.
  - jrockway 7y ago
    I am not affiliated with Tailscale, I merely know that it exists. You should ask them the questions for an authoritative answer.

pa7ch 7y ago

Wireguard doesn't need to change at the protocol level to add those features and I think thats the point. Userspace programs can be written to fetch keys from a server based on SSO or w/e.

XMPPwocky 7y ago

No, I don't think it does. The thing about simple, key-based authentication is that it's very extensible, without changing the actual protocol. What? Well, what Wireguard's auth actually means is that you can use whatever authentication you want to communicate a shared secret to both ends. Want to authenticate with, say, SSH keys? Sure- SSH into a server, run a command that generates a new Wireguard key, connect in with that key. LDAP? Same situation. Whatever SSO you want- as long as you can stick up authentication in front of a service that's able to pull bits from /dev/urandom. Multifactor? Sure. Wireguard does one thing well. What's missing is not features in Wireguard- it's the ecosystem around it to actually handle key management. For enterprises, Hashicorp Vault or something should probably look into supporting Wireguard; for smaller situations, some SSH-based key exchange, like the way Mosh handles things, seems reasonable. Complex, pluggable authentication is sometimes necessary...but you want as few implementations of it as possible, and you sure don't want it in the kernel if you can help it.

yardstick 7y ago
The problem is lots of organisations in the financial and medical worlds need 2FA. WireGuard needs a 2FA solution - It doesn’t have to be kernel based - but it does need to protect against someone grabbing a copy of the single factor auth in WireGuard (keypair). A solution that rotates/manages/provisions/etc these keypairs is still fundamentally single factor auth of the tunnel.
- tptacek 7y ago
  Nobody is arguing that there shouldn't be IdP-based WireGuard management systems. The point is that they are out of scope for the WireGuard project itself. WireGuard has an extremely straightforward configuration interface; if Okta wanted to manage WireGuard, they'd likely have no problem doing it.
  - yardstick 7y ago
    Is there any decent open source 2FA / IdP management systems at the moment that work with WireGuard?
    - ficklepickle 7y ago
      It has just landed in one distro. If there isn't yet, there certainly will be.
      - yardstick 7y ago
        You don’t need a distro for this, and WireGuard has been available and in use for several years. So in that time has anyone developed a practical 2FA solution that is compatible with it?
        tptacek 7y ago
        People have. I'm unaware of any published. It's not hard. Implementing a new IdP-integrated WireGuard authorizer is probably easier than understanding IPSEC or OpenVPN in sufficient detail to secure it.
    - marsokod 7y ago
      There are some attempts like subspace: https://github.com/subspacecloud/subspace https://github.com/subspacecloud/subspace but I have not found anything stable yet.
- XMPPwocky 7y ago
Spivak 7y ago
The problem is that a Wireguard key isn't a session token -- it isn't revoked when the connection ends or goes idle. It's more like an authorized SSH key which in most environments meets the bar for 1FA even if it requires 2FA to set up the key. WG has the concept of sessions already, the only change would be allowing a process in userspace to instrument the sessions directly without going through the key system. The the default key-routing system would be just one method of issuing and managing sessions making the core protocol even simpler!
- labawi 7y ago
  By sessions, do you mean the key agreement/initiation protocol, that is re-run every 2 or so minutes (with the keys having moderately overlapping validity)?

jrockway 7y ago

I think you might like something like Tailscale: https://tailscale.com/ https://tailscale.com/

big_chungus 7y ago
It looks quite good, but I don't see any information on: 1. Is it open-source? 2. When am I going to see the "you have to pay us now" screen, and how much will it cost? I realize it's a business and am fine with that, but want to know what I'm spending before setting stuff up.
- jrockway 7y ago
  I am not affiliated with Tailscale, I merely know that it exists. You should ask them the questions for an authoritative answer.