>IPv4 only. You'd think that sites choosing wireguard would have a more modern setup and might make heavy use of (self service) ULAs.
[deleted]
Show HN: Wag, MFA and Enrollment for WireGuard
21–30 of 68 posts
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#22[flagged]
[deleted]
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#23Earlier quoted context omitted.
You know people can just do these things for fun right? It doesn’t have to be intended as any form of competitor.
[flagged]
I am a cynical and curmudgeonly person so I am usually want to agree with your take, however I think you have missed something critically important:
Most technical people learn by doing. There is value in doing something even if you throw it away, even with hardware in meatspace, because it gains you knowledge and intuition about how the better/established thing works. This knowledge can be golden.
I have a very deep understanding of a lot of systems that most people never touch because they “just work” and are well implemented. I have that understanding exactly because of garbage toy projects (most of which I never shared). This knowledge has made me invaluable in many projects/jobs in my life, because nobody else bothers to understand those systems.
In fact, one of the most obvious (although perhaps not most efficient) ways to do clean room reverse engineering is to treat a system as a modeled black box and try to naively reimplement it using your own assumptions and then benchmark your outputs against the black box model. This reveals significant knowledge about the workings of the black box.
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#24Earlier quoted context omitted.
You sound like a fun guy to have at parties. :-)
[flagged]
It's not fun
If it's not fun or interesting for you, just read something other than Show HN's. This sort of meta is totally offtopic in an actual Show HN which is about the work being shown rather than your personal feelings about the category.
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#25Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…
It seems to me that if I were building a VPN client like Global Protect but using WG, I'd have an eternal per client auth key that is used to set up an initial tunnel to the VPN controller, over that you perform auth, etc, then you're given another session key, which is valid as long as that session is. The first tunnel would disconnect as soon as you finished authenticating and got your actual session key.
Why even have the first tunnel? You could do the entire thing out of hand over a web interface or other mechanism. If the public address of the WG server (or the authn server) is known and available, then there’s no real difference in setting up the connection over a persistent WG channel vs an HTTPS service.
Both solutions are custom for that VPN, so I’d just have one WG tunnel that’s controlled through a secured (web)service. The bonus is that you wouldn’t need a hard coded initial key. (You’d still need some authentication mechanism, but it could be more than fixed public/private key pairs).
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#26This looks nice, but a couple of things
> curl http://public.server.address:8080/register_device?key=e83253...
> The service will return a fully templated response
It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server.
Not only that but your example is http! Probably worth replacing that part at least in case people think http is a reasonable option.
> To authenticate the user should browse to the servers vpn address, in the example, case 192.168.1.1:8080, where they will be prompted for their 2fa code.
So when the session times out, is there any way for the client to realise this? Or does their ssh session (or whatever) just stop working?
I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever.
I haven't found one.
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#27Re: Show HN: Wag, MFA and Enrollment for WireGuard
#28Earlier quoted context omitted.
You know people can just do these things for fun right? It doesn’t have to be intended as any form of competitor.
This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".
I don’t know if the parent was edited or not, but that’s not how I read the parent post.
I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them.
Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of bounds.
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#29Earlier quoted context omitted.
This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".
I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of b…
Oh, I'm not saying it's malicious, it's just a mindset of "creating a thing must be externally motivated" vs "we make things because we like making things".
Re: Show HN: Wag, MFA and Enrollment for WireGuard
#30Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…
I'd use firezone for that. It has an option that forces the user to login to the platform regularly. Coupling that with an external identity provider via oidc is a very solid and simple solution for session management.