Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

101–110 of 171 posts

Re: HashiCorp Boundary

#101

Post by all_usernames »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

Google BeyondCorp?

Re: HashiCorp Boundary

#102

Post by jaquers »

mike-cardwell wrote: post #72
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…

This comment resonates with me so hard. Specifically TLS certs, private certificate authorities and Consul. Like I wanna run my PCA out of Vault (right?), but if using Consul as the backend how do I bootstrap? Sounds like the reply from Michael seems to suggest running the integrated backend, which I can get behind.

Re: HashiCorp Boundary

#103

Post by TheGuyWhoCodes »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Are there any plans or a way to use existing tools? By existing tools I mean winscp or any other tools that use a normal ssh client? RDP etc. I guess for shh and rdp you can just run the Boundary cli with a the predefined target in a terminal embedded into the UI (MremoteNG, MobaXterm etc) but tools like winscp are very much used for sftp file transfers.

A desktop client with a list of services/targets would also be great. Especially for the less technologically inclined individuals.

I know that people have their own opinions on port knocking but I find it as a good tool to remove a lot of noise, some pre built tool for that would be nice but could always just use fwknop-2

Re: HashiCorp Boundary

#104

Post by windexh8er »

francislavoie wrote: post #89
windexh8er wrote: post #15

Earlier quoted context omitted.

Also looks very much like Gravitational Teleport [0], which has been amazing to use. Teleport has a lot of advantages over Boundary right now based on it's architecture. But Hashi does a good job of iterating quickly, so I'd guess as with most of their products, it evolves quickly. [0] https://gravitational.com/teleport/ Disclaimer: I have no affiliation with any of these companies.

Looks like RBAC and SSO are paid features with Teleport (but I may be misunderstanding)

RBAC is paid for, but "Enterprise SSO" is different than the SSO supported in the Community Edition - it's described on their site as: "SSO with Enterprise Identity". They list: Okta, Sailpoint, Active Directory, OneLogin, G Suite, and Auth0 as examples. But, you still get SSO in Community Edition.

Re: HashiCorp Boundary

#105

Post by jmccarthy »

pferde wrote: post #97
luminousbit wrote: post #62

Personally I’ve been a big fan of strongDM ( https://www.strongdm.com/ ). Lightyears ahead of teleport or any of the other solutions out there. Built for great auditing and zero trust. Best of all it’s multi-protocol. So you can do SSH, SQL, K8s, HTTP all with one access system. Had it in prod for almost two years. Gonna be a long time before hashicorp or anyone else can catch up with the level of depth.

StrongDM does indeed look interesting. Can it be completely self-hosted? I am asking because some of the architecture docs mentioned "app.strongdm.com" as a necessary element, which has a webpage behind a (customer?) login. This is an external dependency that is not acceptable for my use case. I haven't found a conclusive answer in their documentation yet.

Justin here, co-founder and CTO of strongDM. The policy and audit functions of our product are hosted by us, but all the sensitive data transit - the proxies themselves - are hosted by you. Hope that helps!

Re: HashiCorp Boundary

#106

Post by pliu »

jefferai wrote: post #68
A_No_Name_Mouse wrote: post #58

Earlier quoted context omitted.

I can see how that works for an internal network. How does this work for SaaS solutions that would normally be directly on the internet? Would they have to be "shielded" to be on a private network and somehow be "Boundary enabled"? And could this be done in a way that is completely transparent to the user (without them having to start a connection to the worker first, and then make a connection to the desired service…

Generally speaking this is designed for accessing your own systems, not the systems of a third party being consumed as a SaaS. That said, any such provider that allows you to restrict the set of IPs allowed to make calls to the service would operate in a Boundary-friendly mode.

It would be interesting if the networking model for the end targets could also be inverted, so that an agent (or something) on the end target could make an outbound connection to establish a reverse tunnel to the proxy that user connections could then be sent over.

The use case I'm thinking of is for IoT or robotics, where you have devices you want to manage being deployed into remote networks that you don't have much control over. It's really helpful in this situation if devices make outbound connections only, so that network operators don't have to configure their firewalls to port forward or set up a VPN.

Edit: clearer language

Re: HashiCorp Boundary

#107

Post by francislavoie »

windexh8er wrote: post #104
francislavoie wrote: post #89

Earlier quoted context omitted.

Looks like RBAC and SSO are paid features with Teleport (but I may be misunderstanding)

RBAC is paid for, but "Enterprise SSO" is different than the SSO supported in the Community Edition - it's described on their site as: "SSO with Enterprise Identity". They list: Okta, Sailpoint, Active Directory, OneLogin, G Suite, and Auth0 as examples. But, you still get SSO in Community Edition.

My company self-hosts LDAP, so that's essentially a dealbreaker for us.

Re: HashiCorp Boundary

#108

Post by [deleted] »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

[deleted]

Re: HashiCorp Boundary

#109

Post by hossi »

cbb330 wrote: post #31

There are a few comparisons being introduced already in this thread, and I'm tempted to ask of more, so I'd love to see documentation on this vs. other solutions like is presented with Terraform: https://www.terraform.io/intro/vs/index.html

Since you asked, we have a commercial zero-trust product very similar to this. As a quick comparison: In our architecture, the worker node (extender) only needs outbound direct access to contact the master node. Unlike many of our competitors, we promote the usage of ephemeral certificates instead of secrets management or minting. We support a number of identity providers and dynamic host directories. Connections can be formed either with native clients or web browser (SSH, RDP, HTTPS) with session recording for auditing purposes. Check it out here https://www.ssh.com/products/privx/
Post reply on HN