4 ms·
RustDesk still does not support encrypted connections when self hosting: https://github.com/rustdesk/rustdesk/issues/3714 https://github.com/rustdesk/rustdesk/i
by inktype 2mo ago
RustDesk still does not support encrypted connections when self hosting: https://github.com/rustdesk/rustdesk/issues/3714 https://github.com/rustdesk/rustdesk/issues/3714
- dj0k3r 2mo agoTailscale, or any encrypted mesh overlay is perfect for this. Infact I prefer it that way. Rustdesk can do what it does best at its core.
- preisschild 2mo agoI disagree, modern software should make encrypted connections over something like HTTP3 or QUIC directly so true secure end to end connectivity works. This would make VPN software such as tailscale obsolete.
- thatfunkymunki 2mo agoagreed, zero-trust solution with proper endpoint security and PKI is superior to transport encryption and insecure protocols
- elevation 2mo agoI'm also in favor of adding encrypted connections to RustDesk, not to replace tailscale, but as a part of this complete breakfast. Tailscale provides mutually authenticated, authorized L3 access. TLS can be configured to provide mutually authenticated L4 access. With a little OIDC/webauthn setup, both L3/L4 support device attestation, meaning there's no way to connect without e.g. a yubikey (or perhaps an enrolled TPM.)
- marshray 2mo agoSo I'm supposed to set up PKI before I can open a remote console connection? Please just make it work seamlessly with my existing SSH credentials. Like SFTP.
- preisschild 2mo agoYou could just make use of public oidc/oauth2 providers like Google/Github/Microsoft/Cloudflare Generic OIDC or heck, even your bluesky account via ATProto oauth But yeah, you could also make use of your ed25519 ssh public key as client certificate and accept based on fingerprint like ssh
- kaoD 2mo agoYou don't need PKI. Nothing prevents RustDesk from implementing TLS TOFU (see e.g. Gemini Protocol), which offers the same security guarantees as SSH TOFU.
- jcelerier 2mo agoso without tailscale or any other intermediary turn service how does my computer behind a NAT connect to another computer behind another NAT
- theultdev 2mo agoby using something like iroh. basically an embedded tailscale.
- jcelerier 1mo agobut it just moves the dependency from tailscale's relay servers to iroh's relay servers. Says it right there in your article: > The public relays we run have seen more than 200 million endpoints created, in the last 30 days alone
- preisschild 2mo agoIdeally using ipv6 without NAT, but yeah hole punching or quic address discovery like iroh does works too
- LoganDark 2mo agoand how do you discover the ipv6 address? memorize it? many ISPs don't listen to informational documents listing all the problems with random dynamic prefixes.
- mnahkies 2mo agoOne of my primary use cases for tailscale/VPN is that I can happily run stuff (grafana, gitea, etc) and not have to be panicked about monitoring for CVEs - I serve it all over HTTPS but I don't want to put it on the public internet if I don't need to.
- preisschild 2mo agoI just have envoy proxy with the oauth + jwt filter in front of those services. Envoy does the oidc flow with pocket-id so I can use passkeys for authN. Envoy validates the resulting token and does authorization via ACL. Envoy then sends an authorization bearer jwt with the oidc id_token jwt to the backend (for example grafana). Grafana parses and validates the jwt and sets claims as userinfo (username, groups, email). I think such setups are at least as secure as having tailscale in front of it and they are web standards conform. I dont need a client app like tailscale, I can just use my normal browser and internet conn. I always make sure envoy/all other apps are on the latest security patcb anyways.
- mnahkies 2mo agoIt's funny you say that, as one of my weekend projects today is setting up https://www.authelia.com/ https://www.authelia.com/ to achieve the same. I probably won't allow everything through it (eg: postgres, clickhouse etc can stay on tailscale), but I've been stumbling into use cases where I want to share things with friends or colleagues, and I don't want to put them on my tailnet.
- preisschild 2mo agoYou can use the great oauth2-proxy as a forward auth proxy to archive that if you use nginx btw, i did that before envoy.
- teekert 2mo agoTailscale also protects against login attempts.
- javier2 2mo agomanaging the certificates safely is too much of a hassle. especially if i dont want to accessible on public internet.
- stavros 2mo agoDoesn't Iroh do that? It would be great to go back to the peer to peer days, but with security.
- ZoomZoomZoom 2mo agoSecure and censorship-resistant connectivity is very hard. We should compartmentalise and not expect everything to reimplement and maintain their own version of it and focus on specialised solutions that actually work. What all user-facing software should have is a minimal-overhead connection option to improve performance inside user's tunnel of choice. Pure QUIC gets blocked easily, SSH requires wrapping, even Tailscale mimicry is basic and they still ignore simple protocol improvements available.
- wooben 2mo agoYour statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment? 1 - https://github.com/rustdesk/rustdesk/issues/3714#issuecomment-3519568715 https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
- SubiculumCode 2mo agoIt may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
- innocent_name 2mo agoHave you tried reading the docs? >RustDesk is a single open-source application (AGPL) with its own architecture. Clients connect outward to an ID/rendezvous server, which brokers a peer-to-peer or relayed session. Per the RustDesk documentation, traffic is end-to-end encrypted (built on NaCl)
- SubiculumCode 2mo agoNot yet...good to chastise me on this, but in my defense, I am at work, and am just trying to get a sense of this, as I would like to move away from VNC.
- wolrah 2mo agoThe specific purpose of RustDesk is to have the middleman making remote access across networks easier. It's intended to replace TeamViewer, LogMeIn, etc. not VNC or RDP. You either pick a middleman you want to trust or you run one of your own, if you don't want that or need the features if offers RustDesk is not for you.
- preisschild 2mo agoI still think its an essential feature for self-hosting, but they seem to be open to PRs so what is the problem?
- SubiculumCode 2mo agoI think you bring up a fine point. Most applications have encryption built in and transparent to the user. While technical IT people in charge of infrastructure will not make this assumption, it is not unreasonable, at the same time, for small business / individual users, to not understand or know of this limitation. VNC does not, for example, and you need to set up port forwarding through ssh. X2Go does....but I don't trust it terribly. So, RustDesk..what do you need to wrap it in? ssh? I really want a better solution that VNC/X2Go..especially since I use hardware accelerated apps that need to use VGL to operate correctly (but underwhich operation is quite buggy).
- NewJazz 2mo agoYou could wrap in a wireguard tunnel.
- aruggirello 2mo agoRustDesk already encrypts connections going via Relay. Encryption is missing in direct IP to IP connections only - but you could set up an SSH tunnel, or a SOCKS or HTTPS proxy though. Another valid alternative is Xpra, and it does support Wayland too - but doesn't reach feature parity with X11. Like RustDesk, Xpra is similarly feature-rich and mature, it too can take advantage of SSH tunnels, SOCKS or HTTPS proxies etc. And then there's TeamViewer and AnyDesk - both of which are paid, with a free tier for evaluating or personal use - RustDesk is younger, but feature-wise they're quite similar. Finally, you could set up wireguard that will happily encrypt your connection with very little overhead - regardless of your chosen remote desktop solution.
- nextaccountic 2mo ago[dead]
- innocent_name 2mo ago>does not support encrypted connections when self hosting Factually incorrect. If you self host a relay/coordination server - encryption works as documented.
- guiambros 2mo agoOnly if you use a relay server. Direct connections in a local network are not encrypted, and RuskDesk doesn't plan on implementing it [1]. [1] https://github.com/rustdesk/rustdesk/issues/3714#issuecomment-3519568715 https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
- tomjakubowski 2mo agoWould be nice if they did support that, but on a LAN you can always encrypt at layer 3 with WireGuard.
- trueno 2mo agotheir reply in that issue: "We don’t plan to implement this directly, as it is designed for test initially, we do not recommend using RustDesk with a public IP alone, that's also why direct ip access is turned off by default. For security and privacy, we strongly advise using it in combination with a VPN—the VPN tunnel already provides end-to-end encryption, so additional encryption within RustDesk is unnecessary in that setup. That said, we welcome community contributions! Many users express interest or share feedback—but very few take the next step and submit a pull request. If you’re able to help, your PR would be greatly appreciated! "
- LoganDark 2mo ago> That said, we welcome community contributions! Many users express interest or share feedback—but very few take the next step and submit a pull request. If you’re able to help, your PR would be greatly appreciated! hate this. "we don't want this on principle... but we would accept it if you did it yourself!" just say you don't feel like it! don't act like it's a bad thing except for when somebody else does it for you, that's just dishonest.
- trueno 2mo agoyeah it's definitely confusing messaging i can't imagine being a community contributor there and saying "ok im gonna help implement this thing that they just described as not a good fit for their thing". i think being under resourced or whatever or just not having anyone on the team that would be able to pull this off is a fine thing to be forward about, but it gets confusing because they kinda frame it like it's the wrong thing to do then leave the door open for someone else to do it. if they didn't beat around the bush perhaps they'd have encryption on this already.
- wolrah 2mo ago> RustDesk still does not support encrypted connections when self hosting Not true at all. RustDesk connections are fully encrypted even when using a self-hosted server. What is not supported are encrypted direct endpoint-to-endpoint connections not going through a server at all, because that's not a use case RustDesk is designed for. The feature is intended for testing, which is why it's disabled altogether by default. If your use case is focused on direct connections without a server, RustDesk is the wrong tool for the job. It's an open-source self-hostable analog to Teamviewer, the server is inherent to the design.
- anakaine 2mo agoSo, to have end to end encryption you need to do something like: Client -- Relay Server -- Host That's certainly less than ideal since many remote desktop session will not be using a middle-age server but rather be direct between client and host.
- hnarn 2mo ago”Many?” Teamviewer does not work like that which by far is the most popular.
- wolrah 2mo agoTo establish a connection between client and remote host, you are expected to go through a coordination server which you trust, that can be either the official one or your own self-hosted instance. Your client and the remote host will then attempt to directly connect if possible, only actually sending the display and input streams through a relay server if a direct connection is impossible due to NAT or whatever else. The use case where encryption is not supported is directly connecting by IP address, which is not the intended use for this software. It's an open source analog to TeamViewer, not a replacement for VNC or RDP. The direct connect functionality is there primarily for testing, which is why it's entirely disabled by default and the option to turn it on is buried at the bottom of a dialog that requires elevated privileges to access. If your use case is focused on those direct connections, RustDesk is not aimed at you.