3 ms·

Sure, but there might be Wireguard vulnerabilities as well. Why not layer SSH over Wireguard over IPSec over OpenVPN just to be safe? I think that layering may

by ratorx 4y ago

Sure, but there might be Wireguard vulnerabilities as well. Why not layer SSH over Wireguard over IPSec over OpenVPN just to be safe? I think that layering may be useful given a certain threat model, but you shouldn’t just layer protocols without actually considering the probability of vulnerability and considering the other tradeoffs you are making. Otherwise the only correct answer would be to layer SSH over every independent VPN protocol. Considering the security track record of SSH, I don’t see the value to layering, when on the other side, you now need to manage multiple keys and an entirely separate protocol that isn’t as ubiquitous (yet). The time spent doing this might be better spent building robust and testable auto-update infrastructure or architecting the applications on the server to reduce the risk of contagion given an RCE vulnerability.

vinay_ys 4y ago
Defense in depth works on the principle that you will have to find vulnerabilities in multiple heterogeneous and independent systems before you get to the prize. Reason to put wireguard as the first line of defense before ssh is because of wireguard's simplicity and robustness vs the track record of ssh implementations.
- ratorx 4y ago
  Sure, defense in depth is great, but there needs to be an argument about the tradeoff. Otherwise as I said, everyone should run OpenSSH over Wireguard over IPSec over OpenVPN, because then you need to exploit all of them to do an exploit and that is harder to do than exploiting any smaller subset. Why is the tradeoff of adding Wireguard worth it? Sure it’s extra security, but is it really worthy managing multiple keys, not-as-ubiquitous protocol, less flexible administration and no CA? I don’t think there is a correct answer (it depends on the threat model), but your original comment made it seem like there was no tradeoff and there was an obvious correct answer.
  - IcePic 4y ago
    Since wireguard is not visible from the outside, you have immediately fixed everything related to ssh logs clogging up with failed attempts.

by ratorx 4y ago

vinay_ys 4y ago

Defense in depth works on the principle that you will have to find vulnerabilities in multiple heterogeneous and independent systems before you get to the prize. Reason to put wireguard as the first line of defense before ssh is because of wireguard's simplicity and robustness vs the track record of ssh implementations.

ratorx 4y ago
Sure, defense in depth is great, but there needs to be an argument about the tradeoff. Otherwise as I said, everyone should run OpenSSH over Wireguard over IPSec over OpenVPN, because then you need to exploit all of them to do an exploit and that is harder to do than exploiting any smaller subset. Why is the tradeoff of adding Wireguard worth it? Sure it’s extra security, but is it really worthy managing multiple keys, not-as-ubiquitous protocol, less flexible administration and no CA? I don’t think there is a correct answer (it depends on the threat model), but your original comment made it seem like there was no tradeoff and there was an obvious correct answer.
- IcePic 4y ago
  Since wireguard is not visible from the outside, you have immediately fixed everything related to ssh logs clogging up with failed attempts.