4 ms·
SSH certificates don’t have an equivalent in Wireguard. They are a much more scalable way of provisioning authentication. Defense-in-depth is a good idea, but
by ratorx 4y ago
SSH certificates don’t have an equivalent in Wireguard. They are a much more scalable way of provisioning authentication.
Defense-in-depth is a good idea, but has its limits. I don’t think there’s too much value to layering SSH over Wireguard.
Agreed on SSHGuard type things not being necessary (for authentication protocol). SSH is not special. People can attempt to bruteforce Wireguard too. In fact, the only difference seems to be SSH making the logs (more easily) accessible.
The main downside to SSH is that it allows in default configuration to use insecure passwords for authentication (but this can be disabled). Wireguard is strictly better since passwords are never an option.
Protocol negotiation is another downside, but I think it’s a smaller one. The SSH devs are fairly good about removing insecure schemes from the defaults.
- hun3 4y ago> I don’t think there’s too much value to layering SSH over Wireguard. Future in-the-wild vulnerabilities in the SSH protocol layer?
- ratorx 4y agoSure, but there might be Wireguard vulnerabilities as well. Why not layer SSH over Wireguard over IPSec over OpenVPN just to be safe? I think that layering may be useful given a certain threat model, but you shouldn’t just layer protocols without actually considering the probability of vulnerability and considering the other tradeoffs you are making. Otherwise the only correct answer would be to layer SSH over every independent VPN protocol. Considering the security track record of SSH, I don’t see the value to layering, when on the other side, you now need to manage multiple keys and an entirely separate protocol that isn’t as ubiquitous (yet). The time spent doing this might be better spent building robust and testable auto-update infrastructure or architecting the applications on the server to reduce the risk of contagion given an RCE vulnerability.
- vinay_ys 4y agoDefense in depth works on the principle that you will have to find vulnerabilities in multiple heterogeneous and independent systems before you get to the prize. Reason to put wireguard as the first line of defense before ssh is because of wireguard's simplicity and robustness vs the track record of ssh implementations.
- ratorx 4y agoSure, defense in depth is great, but there needs to be an argument about the tradeoff. Otherwise as I said, everyone should run OpenSSH over Wireguard over IPSec over OpenVPN, because then you need to exploit all of them to do an exploit and that is harder to do than exploiting any smaller subset. Why is the tradeoff of adding Wireguard worth it? Sure it’s extra security, but is it really worthy managing multiple keys, not-as-ubiquitous protocol, less flexible administration and no CA? I don’t think there is a correct answer (it depends on the threat model), but your original comment made it seem like there was no tradeoff and there was an obvious correct answer.
- IcePic 4y agoSince wireguard is not visible from the outside, you have immediately fixed everything related to ssh logs clogging up with failed attempts.