11 ms·

Identity management for WireGuard

183 points by chmaynard 4y ago

jumperabg 4y ago
What about Pritunl - https://pritunl.com/sso https://pritunl.com/sso, it's a pretty good solution as well.
- Xylakant 4y ago
  Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.
  - linsomniac 4y ago
    It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard https://docs.pritunl.com/docs/wireguard
    - yardstick 4y ago
      Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authentication will not have these weaknesses. For this reason the server will quickly revoke WireGuard keys of inactive clients to limit the possibility of this occurring” Does anyone know how others like Tailscale address this issue?
      - maxmouchet 4y ago
        I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2]. [1] https://github.com/WireGuard/wgctrl-go https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf820852888213a96bb7cb/pritunl/server/instance.py#L1361 https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...
        yardstick 4y ago
        I think I’m more worried about the lifecycle of that key. Pritunl issues new keys all the time. What does Tailscale etc do? Because these keys aren’t the short life, in-memory session keys[1], but auth keys. Knowing this single key effectively bypasses any MFA you may have. Seems like Tailscale has 180 days by default[2], which feels a bit too long for a person who expects MFA to be more proactive than this. Sure you can change the default to 1 day, but how many users know it’s possible or would even think to change that? Compare that with OpenVPN where you can force every single auth attempt to use a password plus TOTP code for instance. 1. https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ 2. https://tailscale.com/kb/1028/key-expiry/ https://tailscale.com/kb/1028/key-expiry/
tssva 4y ago
When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.
- jacob019 4y ago
  OpenVPN doesn't have awesome credential management baked in and the core networking code is an order of magnitude more complex, which is why the performance sucks compared to wireguard.
  - throwaway294566 4y ago
    While not totally awesome, OpenVPN is miles beyond Wireguard when it comes to credential management. There are several auth plugins, you can use "the usual stuff" like PAM, and through that LDAP/Kerberos, ActiveDirectory, RADIUS, etc.. For higher security demands, client certificates are also possible and standardized X.509, PKCS#11/15 like CaC, Yubikeys and usual employee ID cards work. Also, OpenVPN supports at least some form of IP assignment and DNS/Route management. Wireguard has none of that, not even the notion of a user. There are just keys in a special (unsupported by anything else) format that are assigned an IP address statically in a file. Oh, and the frigging software writes into that config file if you change anything. Wireguard is a nightmare for any attempt at sane system administration.
    - cpach 4y ago
      “Wireguard is a nightmare for any attempt at sane system administration.” It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.
      - throwaway294566 4y ago
candiddevmike 4y ago
Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance.
- ericpauley 4y ago
  > I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance. Out of curiosity, why do you want this?
  - candiddevmike 4y ago
    Split DNS, where WireGuard may resolve an endpoint differently on a LAN vs internet. Also for IPv4/IPv6 roaming--if WireGuard resolves an IPv6 address but moves to a non IPv6 network, the peer will never connect as far as I know.
    - dinosaurdynasty 4y ago
      It's not (and shouldn't be) possible to do it in the kernel module, but it's not too hard to write a cronjob/daemon if you really need it. It'd definitely be nice if wg-quick and the official apps supported it, though.
    - cgb_ 4y ago
      I see this when my equipment roams back into my private network and the wireguard server is inside that LAN. It can be solved by NAT'ing packets arriving on your edge router's inside interface, destinated to your outside IP, back to the inside wireguard server IP. Alternatively if your client is Linux, there is: https://github.com/WireGuard/wireguard-tools/tree/master/contrib/reresolve-dns https://github.com/WireGuard/wireguard-tools/tree/master/con...
- 4y ago
snoopy_telex 4y ago
I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.
- lifty 4y ago
  is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.
  - guu 4y ago
    That’s correct. The open issue is here: https://github.com/tailscale/tailscale/issues/1572 https://github.com/tailscale/tailscale/issues/1572
  - mr337 4y ago
    So far doesn't look like it unless you go the MDM route, which I guess is aimed mainly at enterprise users. https://github.com/tailscale/tailscale/issues/5431 https://github.com/tailscale/tailscale/issues/5431
    - Handytinge 4y ago
      Wow, that's a pretty bullshit sounding response from tailscale. "We don't want to overcrowd the settings". It's ok to say "we'd prefer our users used our paid auth, rather than self host auth and use the fruits of our labour for the app". No need to be so opaque about it.
    - GekkePrutser 4y ago
      You can add profiles with Apple configurator 2. You don't have to go the full MDM route. It's quite easy. I think the problem is though that the iOS client doesn't support configuring this option in the profile (whether installed via configurator or MDM) either.
- yamrzou 4y ago
Mister_Snuggles 4y ago
I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up does this perfectly, and using MDM profiles lets me set up connect-on-demand. WireGuard already does connect-on-demand and my limited testing suggests that it works well enough. I don't want to use Tailscale since I'd like to keep everything self-hosted. It sounds like Headscale is almost there - it just needs the iOS client to be able to point to an arbitrary endpoint.
- j0057 4y ago
  You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?
  - Mister_Snuggles 4y ago
    In my case I mean the iOS official client.
- belthesar 4y ago
  This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.
  - Mister_Snuggles 4y ago
    That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".
LinuxBender 4y ago
I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for ID management and could leverage Wireguard for speed. I am not a proper developer so I can only wish for such a thing or maybe pay someone to make this. Tinc has awesome user-space dynamic mesh routing but lacks user management and is slow compared to Strongswan/OpenVPN. Wireguard is fast. OpenLDAP can back-end ID management for just about anything, especially when combining it with oauth/saml and can be integrated into just about anything and that works for me because I am a fan of decentralized and/or distributed systems. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
- jetbalsa 4y ago
  Sounds like you are looking for a self hosted ZeroTier or Tailscale.
  - LinuxBender 4y ago
    It does not appear that Tailscale is an identity provider but rather integrates into commercial ID providers? Do they integrate into OpenLDAP or into OAuth/SAML providers that are in front of OpenLDAP? [Edit] Answering my own question. Custom SAML providers are only supported with the Enterprise edition. [1] [1] - https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/
    - giobox 4y ago
      In fairness, they do out of the box support most of the major players in the SSO space for free (google, Microsoft, okta, gitub...). I'm happily using Google SSO to manage a small number of users for my tailscale account free of charge. FWIW, tailscale is technically not free once more than 1 user, its a commercial service at the end of the day not some self-hosted open source application. They have extremely generous fair use policy in my experience and won't bill for a small number of users though. This means custom SSO is likely only a real issue for paying customers to begin with, although I can understand the frustration for the few users who do want it on the free tier. > https://tailscale.com/pricing/ https://tailscale.com/pricing/
kbumsik 4y ago
Netmaker looks promising for k8s distros. It's shame that its license is SSPL.
controversial97 4y ago
For people at the scale of running one wireguard server on one linux box, I suggest this script which sets everything up and creates vpn user accounts https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
- leksak 4y ago
  What's up with the uneven indentation in the script? Is that a bash thing or an oops thing?
- aborsy 4y ago
  He also has an OpenVPN version. Both launches a VPN server with one click. Needless to say, Wireguard is preferred over other VPNs. Far less code.
teleforce 4y ago
Obligatory Digital Identity Guidelines documents from NIST: https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/
OJFord 4y ago
We solve this (for non-technical colleagues) by keeping the key in terraform (via my open source provider OJFord/wireguard - accepts either a public key for out-of-state key, or generates one for you). Then we can just provide users who don't know or care about keys a file to import into the wg app. (Spoofing other users if you already have access to our tf state isn't a vector we care about.. even if we logged user info for audit, that kind of access would let you fake that and worse anyway.) Maybe it's not as flashy to set up from a non-technical-end-user perspective, but it's easy; it's just wireguard & terraform, both of which we're using anyway.
zamalek 4y ago
> Despite Headscale's unofficial status, Tailscale seems to be fully supportive of its efforts; Tailscale has coordinated with Headscale's creator on API changes and hired one of Headscale's maintainers. I have noticed an interesting change psychology arising from behavior such as this. I am more likely to use Tailscale (at the very least professionally, if not personally) instead of the free/OSS version because of this goodwill. Another example is Aeotec, who produce Z-Wave appliances. Aeotec's cooperation with the community (in terms of firmware) gives me significantly more confidence in the longevity of their devices. Sadly, I don't think this psychology is ever going to become pervasive. People like what they already like.
- tomschlick 4y ago
  I agree. It probably helps make the decision because of how easy it would be to fall back on the FOSS version if needed, but for now its worth offloading the setup/hosting for the relatively small fee.
  - LouisvilleGeek 4y ago
    Have either of you priced the product for 150+ users?
asmr 4y ago
I'll definitely check out Headscale, I have similar infrastructure setup with pfsense running wg on a VPS that connects to my pfsense box at home. I have other VPS that connect to the cloud pfsense box and routes setup to the home box so I essentially have an extended LAN. This seems promising as it will remove the pain of configuring additional clients.

183 points by chmaynard 4y ago

jumperabg 4y ago

What about Pritunl - https://pritunl.com/sso https://pritunl.com/sso, it's a pretty good solution as well.

Xylakant 4y ago
Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.
- linsomniac 4y ago
  It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard https://docs.pritunl.com/docs/wireguard
  - yardstick 4y ago
    Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authentication will not have these weaknesses. For this reason the server will quickly revoke WireGuard keys of inactive clients to limit the possibility of this occurring” Does anyone know how others like Tailscale address this issue?
    - maxmouchet 4y ago
      I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2]. [1] https://github.com/WireGuard/wgctrl-go https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf820852888213a96bb7cb/pritunl/server/instance.py#L1361 https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...
      - yardstick 4y ago
        I think I’m more worried about the lifecycle of that key. Pritunl issues new keys all the time. What does Tailscale etc do? Because these keys aren’t the short life, in-memory session keys[1], but auth keys. Knowing this single key effectively bypasses any MFA you may have. Seems like Tailscale has 180 days by default[2], which feels a bit too long for a person who expects MFA to be more proactive than this. Sure you can change the default to 1 day, but how many users know it’s possible or would even think to change that? Compare that with OpenVPN where you can force every single auth attempt to use a password plus TOTP code for instance. 1. https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ 2. https://tailscale.com/kb/1028/key-expiry/ https://tailscale.com/kb/1028/key-expiry/

tssva 4y ago

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

jacob019 4y ago
OpenVPN doesn't have awesome credential management baked in and the core networking code is an order of magnitude more complex, which is why the performance sucks compared to wireguard.
- throwaway294566 4y ago
  While not totally awesome, OpenVPN is miles beyond Wireguard when it comes to credential management. There are several auth plugins, you can use "the usual stuff" like PAM, and through that LDAP/Kerberos, ActiveDirectory, RADIUS, etc.. For higher security demands, client certificates are also possible and standardized X.509, PKCS#11/15 like CaC, Yubikeys and usual employee ID cards work. Also, OpenVPN supports at least some form of IP assignment and DNS/Route management. Wireguard has none of that, not even the notion of a user. There are just keys in a special (unsupported by anything else) format that are assigned an IP address statically in a file. Oh, and the frigging software writes into that config file if you change anything. Wireguard is a nightmare for any attempt at sane system administration.
  - cpach 4y ago
    “Wireguard is a nightmare for any attempt at sane system administration.” It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.
    - throwaway294566 4y ago

candiddevmike 4y ago

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance.

ericpauley 4y ago
> I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance. Out of curiosity, why do you want this?
- candiddevmike 4y ago
  Split DNS, where WireGuard may resolve an endpoint differently on a LAN vs internet. Also for IPv4/IPv6 roaming--if WireGuard resolves an IPv6 address but moves to a non IPv6 network, the peer will never connect as far as I know.
  - dinosaurdynasty 4y ago
    It's not (and shouldn't be) possible to do it in the kernel module, but it's not too hard to write a cronjob/daemon if you really need it. It'd definitely be nice if wg-quick and the official apps supported it, though.
  - cgb_ 4y ago
    I see this when my equipment roams back into my private network and the wireguard server is inside that LAN. It can be solved by NAT'ing packets arriving on your edge router's inside interface, destinated to your outside IP, back to the inside wireguard server IP. Alternatively if your client is Linux, there is: https://github.com/WireGuard/wireguard-tools/tree/master/contrib/reresolve-dns https://github.com/WireGuard/wireguard-tools/tree/master/con...
4y ago

snoopy_telex 4y ago

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

lifty 4y ago
is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.
- guu 4y ago
  That’s correct. The open issue is here: https://github.com/tailscale/tailscale/issues/1572 https://github.com/tailscale/tailscale/issues/1572
- mr337 4y ago
  So far doesn't look like it unless you go the MDM route, which I guess is aimed mainly at enterprise users. https://github.com/tailscale/tailscale/issues/5431 https://github.com/tailscale/tailscale/issues/5431
  - Handytinge 4y ago
    Wow, that's a pretty bullshit sounding response from tailscale. "We don't want to overcrowd the settings". It's ok to say "we'd prefer our users used our paid auth, rather than self host auth and use the fruits of our labour for the app". No need to be so opaque about it.
  - GekkePrutser 4y ago
    You can add profiles with Apple configurator 2. You don't have to go the full MDM route. It's quite easy. I think the problem is though that the iOS client doesn't support configuring this option in the profile (whether installed via configurator or MDM) either.
yamrzou 4y ago

Mister_Snuggles 4y ago

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up does this perfectly, and using MDM profiles lets me set up connect-on-demand. WireGuard already does connect-on-demand and my limited testing suggests that it works well enough. I don't want to use Tailscale since I'd like to keep everything self-hosted. It sounds like Headscale is almost there - it just needs the iOS client to be able to point to an arbitrary endpoint.

j0057 4y ago
You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?
- Mister_Snuggles 4y ago
  In my case I mean the iOS official client.
belthesar 4y ago
This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.
- Mister_Snuggles 4y ago
  That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".

LinuxBender 4y ago

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for ID management and could leverage Wireguard for speed. I am not a proper developer so I can only wish for such a thing or maybe pay someone to make this. Tinc has awesome user-space dynamic mesh routing but lacks user management and is slow compared to Strongswan/OpenVPN. Wireguard is fast. OpenLDAP can back-end ID management for just about anything, especially when combining it with oauth/saml and can be integrated into just about anything and that works for me because I am a fan of decentralized and/or distributed systems. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/

jetbalsa 4y ago
Sounds like you are looking for a self hosted ZeroTier or Tailscale.
- LinuxBender 4y ago
  It does not appear that Tailscale is an identity provider but rather integrates into commercial ID providers? Do they integrate into OpenLDAP or into OAuth/SAML providers that are in front of OpenLDAP? [Edit] Answering my own question. Custom SAML providers are only supported with the Enterprise edition. [1] [1] - https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/
  - giobox 4y ago
    In fairness, they do out of the box support most of the major players in the SSO space for free (google, Microsoft, okta, gitub...). I'm happily using Google SSO to manage a small number of users for my tailscale account free of charge. FWIW, tailscale is technically not free once more than 1 user, its a commercial service at the end of the day not some self-hosted open source application. They have extremely generous fair use policy in my experience and won't bill for a small number of users though. This means custom SSO is likely only a real issue for paying customers to begin with, although I can understand the frustration for the few users who do want it on the free tier. > https://tailscale.com/pricing/ https://tailscale.com/pricing/

kbumsik 4y ago

Netmaker looks promising for k8s distros. It's shame that its license is SSPL.

controversial97 4y ago

For people at the scale of running one wireguard server on one linux box, I suggest this script which sets everything up and creates vpn user accounts https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install

leksak 4y ago
What's up with the uneven indentation in the script? Is that a bash thing or an oops thing?
aborsy 4y ago
He also has an OpenVPN version. Both launches a VPN server with one click. Needless to say, Wireguard is preferred over other VPNs. Far less code.

teleforce 4y ago

Obligatory Digital Identity Guidelines documents from NIST: https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/

OJFord 4y ago

We solve this (for non-technical colleagues) by keeping the key in terraform (via my open source provider OJFord/wireguard - accepts either a public key for out-of-state key, or generates one for you). Then we can just provide users who don't know or care about keys a file to import into the wg app. (Spoofing other users if you already have access to our tf state isn't a vector we care about.. even if we logged user info for audit, that kind of access would let you fake that and worse anyway.) Maybe it's not as flashy to set up from a non-technical-end-user perspective, but it's easy; it's just wireguard & terraform, both of which we're using anyway.

zamalek 4y ago

> Despite Headscale's unofficial status, Tailscale seems to be fully supportive of its efforts; Tailscale has coordinated with Headscale's creator on API changes and hired one of Headscale's maintainers. I have noticed an interesting change psychology arising from behavior such as this. I am more likely to use Tailscale (at the very least professionally, if not personally) instead of the free/OSS version because of this goodwill. Another example is Aeotec, who produce Z-Wave appliances. Aeotec's cooperation with the community (in terms of firmware) gives me significantly more confidence in the longevity of their devices. Sadly, I don't think this psychology is ever going to become pervasive. People like what they already like.

tomschlick 4y ago
I agree. It probably helps make the decision because of how easy it would be to fall back on the FOSS version if needed, but for now its worth offloading the setup/hosting for the relatively small fee.
- LouisvilleGeek 4y ago
  Have either of you priced the product for 150+ users?

asmr 4y ago

I'll definitely check out Headscale, I have similar infrastructure setup with pfsense running wg on a VPS that connects to my pfsense box at home. I have other VPS that connect to the cloud pfsense box and routes setup to the home box so I essentially have an extended LAN. This seems promising as it will remove the pain of configuring additional clients.