3 ms·
Aaaaaw shoot. There goes my private WireGuard client-side TLS certificate for tunneled SSH. Just need to bashify all the certificate creation ... again.
by egberts1 1y ago
Aaaaaw shoot.
There goes my private WireGuard client-side TLS certificate for tunneled SSH.
Just need to bashify all the certificate creation ... again.
- throwaway81523 1y agoCA.pl has 9 lives.
- arccy 1y agomkcert is pretty painless
- egberts1 1y agoYes. But I like my own certificate tool better. * Creating Root CA node * Creating Intermediate CA node * Creating 2nd Intermediate CA node * Renew Root CA node * Renew Intermediate CA node * Encrypt using ChaCha20-Poly1305 * Encrypt using Elliptic Curve Problem is OpenSSH 3.1 recently broke CLI syntax, so that needs fixing. Used JetBrain with Bash plugin for development. https://github.com/egberts/tls-ca-manage https://github.com/egberts/tls-ca-manage
- JCattheATM 1y agoWhy are you tunneling SSH over WireGuard?
- egberts1 1y ago"Scoping and corraling" Also ensures that source IP are not leaked, as well.
- JCattheATM 1y agoI mean, the IP of the WG gateway is still seen...so that's just being used to SSH to somewhere else? Seems like overkill.
- egberts1 1y agoYou may need a tad bit more field experience in hostile networking. It's all about hiding what protocol is being used.
- JCattheATM 1y ago> You may need a tad bit more field experience in hostile networking. Or maybe I can just sense bs after a career in the field :-) > It's all about hiding what protocol is being used. And what, exactly, do you think the advantage is from hiding SSH traffic this way?
- egberts1 1y agoProfiling, or more concisely, anti-profiling.