Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wag, MFA and Enrollment for WireGuard

github.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#41

Post by 20after4 »

ta1243 wrote: post #26

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth repla…

> I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever.

That would be really cool. I hope the author of this will consider it.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#42

Post by jamilbk »

gchamonlive wrote: post #30
asimops wrote: post #9

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…

I'd use firezone for that. It has an option that forces the user to login to the platform regularly. Coupling that with an external identity provider via oidc is a very solid and simple solution for session management.

Just a quick note -- 1.0 goes a little further and rotates the WireGuard keys upon each auth session, so the private key never leaves the tunnel process memory. You need the Firezone client for that, though.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#43

Post by cchance »

gchamonlive wrote: post #30
asimops wrote: post #9

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…

I'd use firezone for that. It has an option that forces the user to login to the platform regularly. Coupling that with an external identity provider via oidc is a very solid and simple solution for session management.

Firezone seems to have come really far from when i last used it wow... But ... I really like running headscale for most of my stuff as i prefer the p2p meshing for direct connections from server to server latency regardless of where they are.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#44

Post by yonatan8070 »

yardstick wrote: post #37
yonatan8070 wrote: post #32

Earlier quoted context omitted.

If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password

Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)

I want to believe users who use a password manager are also technically literate enough to secure it properly

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#45

Post by aragilar »

zeotroph wrote: post #15
aragilar wrote: post #4

[flagged]

"Numerous others" which also support MFA, have some (Web)-UI and are also open source? I only know of DefGuard[1], which aspires to do a lot more. 1: https://github.com/DefGuard/defguard discussed at https://news.ycombinator.com/item?id=36056080

https://github.com/netbirdio/netbird seems to be completely open source (BSD), https://github.com/gravitl/netmaker?tab=License-1-ov-file#re... uses Apache for the non-pro stuff, and both of those I found by simply looking at https://github.com/topics/wireguard

This is why I asked, the phrase "I decided to reinvent the wheel which has honestly been quite fun with learning about eBPF, and recently clustering and HA with etcd" makes it sound like it's doing a bunch of cool stuff (which I want to hear about!), but the readme says nothing about those.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#46

Post by blipvert »

ta1243 wrote: post #26

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth repla…

I have written a similar server (per-device client cert required which gets you mTLS to a logon page which uses OIDC the authenticate the user and enable the tunnel) but the client is the tricky bit.

I have written one in Go for the Mac which uses the command line wg from Brew and handles key gen, but it is clunky and requires sudo.

A proper native app which uses the network entitlements would be great, but it is beyond my ken

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#47

Post by Nullence »

ta1243 wrote: post #26

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth repla…

Howdy! Kind of forgot that I put this up, the registration url can also take an optional pubkey parameter, so you dont have to rely on the server generating the private key for you (docs are a little lacking so I understand the confusion!)

To answer your last question, eBPF XDP which is what I use can only do PASS, DROP or REDIRECT. So I stick with the easiest possible outcome and do PASS/DROP, which means your connections will just stop working.

However you can always set up the detection yourself by adding the captive portal detection pages to your wag MFA list then the browser should do everything else for you.

Unfortunately doing interception or acting like a proxy isnt something Im looking to do with wag (which makes authorisation timeout/logout a bit easier to deal with)

Hope that answers things!

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#48

Post by Nullence »

asimops wrote: post #9

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…

Im not entirely sure what you mean by "eternal session keys" in the context of wag specifically.

While the wireguard key effectively gives you the ability to talk to the wag server, the session is effectively maintained by a map in ebpf, as to whether you've authorised or not.

So even if someone steals your private key material, they wont be able to access MFA restricted routes

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#49

Post by Nullence »

d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

Yep! I do indeed have protections against bruteforcing TOTP codes, effectively each authentication has a number of "attempts" a user can make before their account gets locked, and an admin is then required to unlock it.

Specifically to force people to have a bit of a think as to why their device is trying to force auth to begin with, as it indicates an endpoint compromise.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#50

Post by Nullence »

mahkoh wrote: post #2

>IPv4 only. You'd think that sites choosing wireguard would have a more modern setup and might make heavy use of (self service) ULAs.

I do plan on supporting IPv6 sometime soon, and doing something along the lines of mapping folks IPv4 addresses into private IPv6 space to reduce the risk of clashing with a users real local network.

Is there something specific you were thinking about when you mention ULAs?

Post reply on HN