Live data from Hacker News

WireGuard is in net-next

git.kernel.org

91–100 of 208 posts

Re: WireGuard is in net-next

#91

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

WireGuard is actually pretty awful from an IT security org perspective. There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures. Additionally, there is no concept of two step auth, so if your key is compromised, anyone can connect without anyone knowing about the compromise. If security companies adopt WireGuard, expect thing…

There are (at least) two pieces to WireGuard. The wireguard "wire" protocol itself, which is implemented in the kernel. And the authentication and key exchange, that are done by userspace tools.

Right now there exist the "default" tools, which require a manual exchange of key pairs and do only very rudimentary user mapping and authorization.

However: It is perfectly possible to implement much more complex authorization schemes, with all the two step auth, logging, etc. you desire. Somebody has to write the tools for that, still. But the nice thing is, that this is a pretty much independent task, which you could do over any transport/protocol you desire (HTTPS, SSH, custom made, etc.).

An idea I've had for a longer time, but don't have the time to actually invest developing it, is using wireguard for a pure IPv6 mesh VPN.

- The ULA network part would be the key-id (lower bits) of the mesh public key (i.e. with knowledge of the mesh private key you can join the mesh), used for the mesh setup.

- The Host part would be each individual host's key-id (again lower bits of the public key).

Since wireguard uses Cryptokey Routing (https://www.wireguard.com/#cryptokey-routing) this would directly map.

Re: WireGuard is in net-next

#93
post #90

When will we see support for this built into iOS?

Whenever so many networks are deployed with this that Apple becomes interested in supporting it for their users. Being in the kernel should help with this, but obviously there's no actual timeline. Maybe never

Re: WireGuard is in net-next

#94
post #73
post #14

Earlier quoted context omitted.

way simpler (and thus, I would argue, way more secure). way faster. On the other hand: No built-in client in any of the mobile OSes, so a third-party client install is required.

I like my always-on IPsec tunnel on android. Never really understood this entire wireguard hype. Probably because VPN just got a bit easier for some people..?

The primary hype is its speed, good defaults, and small code base making it easier for audits.

Re: WireGuard is in net-next

#95
post #82

Earlier quoted context omitted.

So, it scales well with multiple peers? Are all peers aware of each other or are you using some sort of hub and spoke topology?

I created a script to distribute the configuration to all relevant VMs. A network configuration is basically: a port, a name, a set of peers(public key, external ip, wireguard ip). If you want, you can distinguish between master and slave peers (=the slaves do not know/trust each other; master knows everyone)

What is the maximum number of peers you have scaled it to per Wireguard server?

Re: WireGuard is in net-next

#96
post #73
post #14

Earlier quoted context omitted.

way simpler (and thus, I would argue, way more secure). way faster. On the other hand: No built-in client in any of the mobile OSes, so a third-party client install is required.

I like my always-on IPsec tunnel on android. Never really understood this entire wireguard hype. Probably because VPN just got a bit easier for some people..?

One of the big things is that it uses more common UDP rather than a completely new IP protocol like IPsec wants. This makes it play much nicer with a lot of networks that have unusual setups or restrictions that otherwise block IPsec. OpenVPN can also accomplish that, but it's got a more complicated setup than WireGuard since it needs a full TLS stack and certificates.

Re: WireGuard is in net-next

#97
post #8

Release announcements are here: https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lkml.org/lkml/2019/12/8/257

Congrats, hopefully you'll be able to port it back to Zinc sometime over 2020.

Re: WireGuard is in net-next

#98
post #82

Earlier quoted context omitted.

I created a script to distribute the configuration to all relevant VMs. A network configuration is basically: a port, a name, a set of peers(public key, external ip, wireguard ip). If you want, you can distinguish between master and slave peers (=the slaves do not know/trust each other; master knows everyone)

What is the maximum number of peers you have scaled it to per Wireguard server?

I don't have "user" peers. I just use it to connect the VMs. So around 50 I guess.

Re: WireGuard is in net-next

#100

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

WireGuard is actually pretty awful from an IT security org perspective. There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures. Additionally, there is no concept of two step auth, so if your key is compromised, anyone can connect without anyone knowing about the compromise. If security companies adopt WireGuard, expect thing…

I tend to agree with this statement. I have been tracking WireGuard as a potential replacement for PulseSecure and it's a far ways off. We need 2FA and SAML support along with dynamic address assignment and logging before we can make the case to replace PulseSecure.
Post reply on HN