4 ms·

I have a singular request - so Wireguard is unusable in any high security environments with compliance requirements - because it doesnt support any 2-factor aut

I have a singular request - so Wireguard is unusable in any high security environments with compliance requirements - because it doesnt support any 2-factor auth out of the box. We get rejected on stuff like PCI-DSS because the standards mandate a 2-FA. I am not a security expert and wouldnt know about the pros and cons here. But the fact remains that most high-sec compliance needs 2-FA. We have filed tickets on wireguard and it has always got rejected - things like epass2003, fido keys, etc. We have requested the most popular wireguard self-setup - Algo - but also have been rejected. Of all the open source software here, only Pritunl comes somewhat close by layering google auth - https://docs.pritunl.com/docs/google https://docs.pritunl.com/docs/google . But Pritunl doesnt let u setup google auth as a second factor and its generally tricky to config. If u can have a simple 2-FA - even something as simple as getting a google auth login link while connecting as second factor - that would make the killer feature here. As of right now, Tailscale is the only closed source solution that works.

tptacek 5y ago
It's not WireGuard's job to do user management or end-user authentication; it's deliberately designed to make that stuff easy to layer on top. You're unlikely to get much traction with the WireGuard project directly, but not unlikely to get it from a project like this (or, for that matter, from Tailscale, which does 2FA authentication for WireGuard by connecting to IdPs).
- sandGorgon 5y ago
  im not denying that and i apologise if it came off a bit whiney. I meant that since Wireguard is not the place to do it - it would be great to get it a higher order tool.
  - tptacek 5y ago
    Not at all! I'm sorry if I sounded snippy. It's a common misconception people have about the role of WireGuard!
jeroenhd 5y ago
Wireguard isn't designed or set up to do that kind of authentication, it's basically the encryption and networking part of OpenVPN with none of the other fluff. You tell it where to connect to with what key and how to deal with basic IP stuff and the rest is up to you. To do what you'd require with 2FA, someone would need to write a front end for Wireguard that either reconfigures the public key for a session or uses one encrypted tunnel to connect, execute 2FA and then another to do the real connection part. That quickly turns a simple VPN protocol into a complex management system for IP addresses and secrets, so it probably won't ever be part of any standard Wireguard tooling. I can see the business use case here, but as long as no business is willing to write such a tool and open source it, I don't think we'll see anything in this area soon.
- sandGorgon 5y ago
  understood. I was just qualifying the request so that Firezone can add it. Quick question however - is there a plan to add any bindings to wireguard to make this stuff more easier to do? i might be wrong, but it seems from a few comments on these bugs that it is quite tricky to get Wireguard core to read from OpenSC encrypted storage, etc. I think there was an attempt to make a python library for this...but it was given up. Wireguard is definitely the most exciting tool in enterprise security, but its a bit hard to make it work with the existing ecosystem of tooling out there.
ptman 5y ago
headscale is open-source tailscale server. You could probably add 2fa to headscale quite easily
- sandGorgon 5y ago
  hi - yes im aware of headscale. it doesnt have 2-FA right now. Pritunl is the only solution that (partially) works. other than that - basically the entire wireguard ecosystem is non-2FA non-SSO compliant. Not sure why. There is definitely demand. maybe its quite hard to actually make it work in this way.
FDSGSG 5y ago
>I have a singular request - so Wireguard is unusable in any high security environments with compliance requirements - because it doesnt support any 2-factor auth out of the box. >We get rejected on stuff like PCI-DSS because the standards mandate a 2-FA. I am not a security expert and wouldnt know about the pros and cons here. But the fact remains that most high-sec compliance needs 2-FA. This is absolutely nuts. Why would 2FA be enforced at the network edge instead of on individual services? What a completely suicidal security model.
- rpadovani 5y ago
  > This is absolutely nuts. You have never worked in regulated industries, haven't you?
  - deleted 5y ago
    [deleted]
jamilbk 5y ago
This is great feedback! You're not the first person to request 2FA. See this issue for discussion: https://github.com/firezone/firezone/issues/259 https://github.com/firezone/firezone/issues/259 I'm planning to add functionality that will make it possible to require multi-factor auth before allowing the user access to "restricted" firewall zones. Kind of like a captive portal. Would something like that solve your problem?
- sandGorgon 5y ago
  hi - just posted on the bug itself. I'm not sure what firewall zones are...but generally we need 2-FA to basically connect to a wireguard VPN. I mean its a pretty straightforward usecase - but it doesnt work on any other wireguard system. And it would be a killer feature!

tptacek 5y ago

It's not WireGuard's job to do user management or end-user authentication; it's deliberately designed to make that stuff easy to layer on top. You're unlikely to get much traction with the WireGuard project directly, but not unlikely to get it from a project like this (or, for that matter, from Tailscale, which does 2FA authentication for WireGuard by connecting to IdPs).

sandGorgon 5y ago
im not denying that and i apologise if it came off a bit whiney. I meant that since Wireguard is not the place to do it - it would be great to get it a higher order tool.
- tptacek 5y ago
  Not at all! I'm sorry if I sounded snippy. It's a common misconception people have about the role of WireGuard!

jeroenhd 5y ago

Wireguard isn't designed or set up to do that kind of authentication, it's basically the encryption and networking part of OpenVPN with none of the other fluff. You tell it where to connect to with what key and how to deal with basic IP stuff and the rest is up to you. To do what you'd require with 2FA, someone would need to write a front end for Wireguard that either reconfigures the public key for a session or uses one encrypted tunnel to connect, execute 2FA and then another to do the real connection part. That quickly turns a simple VPN protocol into a complex management system for IP addresses and secrets, so it probably won't ever be part of any standard Wireguard tooling. I can see the business use case here, but as long as no business is willing to write such a tool and open source it, I don't think we'll see anything in this area soon.

sandGorgon 5y ago
understood. I was just qualifying the request so that Firezone can add it. Quick question however - is there a plan to add any bindings to wireguard to make this stuff more easier to do? i might be wrong, but it seems from a few comments on these bugs that it is quite tricky to get Wireguard core to read from OpenSC encrypted storage, etc. I think there was an attempt to make a python library for this...but it was given up. Wireguard is definitely the most exciting tool in enterprise security, but its a bit hard to make it work with the existing ecosystem of tooling out there.

ptman 5y ago

headscale is open-source tailscale server. You could probably add 2fa to headscale quite easily

sandGorgon 5y ago
hi - yes im aware of headscale. it doesnt have 2-FA right now. Pritunl is the only solution that (partially) works. other than that - basically the entire wireguard ecosystem is non-2FA non-SSO compliant. Not sure why. There is definitely demand. maybe its quite hard to actually make it work in this way.

FDSGSG 5y ago

>I have a singular request - so Wireguard is unusable in any high security environments with compliance requirements - because it doesnt support any 2-factor auth out of the box. >We get rejected on stuff like PCI-DSS because the standards mandate a 2-FA. I am not a security expert and wouldnt know about the pros and cons here. But the fact remains that most high-sec compliance needs 2-FA. This is absolutely nuts. Why would 2FA be enforced at the network edge instead of on individual services? What a completely suicidal security model.

rpadovani 5y ago
> This is absolutely nuts. You have never worked in regulated industries, haven't you?
- deleted 5y ago
  [deleted]

jamilbk 5y ago

This is great feedback! You're not the first person to request 2FA. See this issue for discussion: https://github.com/firezone/firezone/issues/259 https://github.com/firezone/firezone/issues/259 I'm planning to add functionality that will make it possible to require multi-factor auth before allowing the user access to "restricted" firewall zones. Kind of like a captive portal. Would something like that solve your problem?

sandGorgon 5y ago
hi - just posted on the bug itself. I'm not sure what firewall zones are...but generally we need 2-FA to basically connect to a wireguard VPN. I mean its a pretty straightforward usecase - but it doesnt work on any other wireguard system. And it would be a killer feature!