3 ms·

What about Pritunl - https://pritunl.com/sso https://pritunl.com/sso, it's a pretty good solution as well.

Xylakant 4y ago
Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.
- linsomniac 4y ago
  It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard https://docs.pritunl.com/docs/wireguard
  - yardstick 4y ago
    Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authentication will not have these weaknesses. For this reason the server will quickly revoke WireGuard keys of inactive clients to limit the possibility of this occurring” Does anyone know how others like Tailscale address this issue?
    - maxmouchet 4y ago
      I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2]. [1] https://github.com/WireGuard/wgctrl-go https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf820852888213a96bb7cb/pritunl/server/instance.py#L1361 https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...
      - yardstick 4y ago
        I think I’m more worried about the lifecycle of that key. Pritunl issues new keys all the time. What does Tailscale etc do? Because these keys aren’t the short life, in-memory session keys[1], but auth keys. Knowing this single key effectively bypasses any MFA you may have. Seems like Tailscale has 180 days by default[2], which feels a bit too long for a person who expects MFA to be more proactive than this. Sure you can change the default to 1 day, but how many users know it’s possible or would even think to change that? Compare that with OpenVPN where you can force every single auth attempt to use a password plus TOTP code for instance. 1. https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ 2. https://tailscale.com/kb/1028/key-expiry/ https://tailscale.com/kb/1028/key-expiry/

Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.

linsomniac 4y ago
It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard https://docs.pritunl.com/docs/wireguard
- yardstick 4y ago
  Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authentication will not have these weaknesses. For this reason the server will quickly revoke WireGuard keys of inactive clients to limit the possibility of this occurring” Does anyone know how others like Tailscale address this issue?
  - maxmouchet 4y ago
    I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2]. [1] https://github.com/WireGuard/wgctrl-go https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf820852888213a96bb7cb/pritunl/server/instance.py#L1361 https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...
    - yardstick 4y ago
      I think I’m more worried about the lifecycle of that key. Pritunl issues new keys all the time. What does Tailscale etc do? Because these keys aren’t the short life, in-memory session keys[1], but auth keys. Knowing this single key effectively bypasses any MFA you may have. Seems like Tailscale has 180 days by default[2], which feels a bit too long for a person who expects MFA to be more proactive than this. Sure you can change the default to 1 day, but how many users know it’s possible or would even think to change that? Compare that with OpenVPN where you can force every single auth attempt to use a password plus TOTP code for instance. 1. https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ 2. https://tailscale.com/kb/1028/key-expiry/ https://tailscale.com/kb/1028/key-expiry/