SSH and User-Mode IP WireGuard • Hacker News Board

Re: SSH and User-Mode IP WireGuard

#101

Post by malnick » Wed, Mar 03, 2021, 3:53 PM UTC

atonse wrote: post #57

tptacek wrote: post #37

Earlier quoted context omitted.

There is a lot of Hashi in our stack already; we orchestrate with Nomad (we have our own Firecracker task driver), we backend our certificate system --- which is awesome, certificates just work for Fly apps --- with Vault, and we use a lot of Consul. I think our take on end-user access management is lower-level than what Boundary is trying to do. Boundary, as I understand it, sees the world the way an IdP RP does, mo…

Thanks. I actually feel like if Boundary had an experience more like Tailscale does, but on top of their stack (wireguard network, secrets in vault, server/service discovery in consul, etc), that would be really powerful and a no-brainer for those of us who also use a lot of Hashicorp products. But I'm still trying to fully understand what they're doing with Boundary. The abstractions just feel a bit off to me unlike…

Also adding to @jefferai's comment, we are working on many "better together" stories that include Vault, Consul, and Nomad. Product's like Boundary have a very large surface area in terms of potential features and road map items. There's a lot of great stuff we're currently working, stay tuned!

Re: SSH and User-Mode IP WireGuard

#102

Post by jefferai » Wed, Mar 03, 2021, 4:31 PM UTC

tptacek wrote: post #37

atonse wrote: post #36

Earlier quoted context omitted.

Ok thanks – this has been one of the rare things that some of those clients seem to care about (whether they're right or wrong, or rather, more conservative). I had another question – this seems similar to what Hashicorp is doing with Boundary. Have you looked at Boundary and how this potentially compares with that, from an architecture standpoint? Of course there are parts of this that are bespoke to your infrastruc…

There is a lot of Hashi in our stack already; we orchestrate with Nomad (we have our own Firecracker task driver), we backend our certificate system --- which is awesome, certificates just work for Fly apps --- with Vault, and we use a lot of Consul. I think our take on end-user access management is lower-level than what Boundary is trying to do. Boundary, as I understand it, sees the world the way an IdP RP does, mo…

Boundary will indeed give you a bearer token after authentication to present to take further actions in its API. So you'd authenticate to Boundary, get a bearer token, and use that to make one or more requests to connect to infrastructure or services. That bit is pretty much in line with most clouds, platforms, services, etc.

However, once authorized, the actual session uses a TLS stack generated for that individual session to establish a secure tunnel. It's explained at https://www.boundaryproject.io/docs/concepts/security/connec... if you're interested.

As for complexity, while Boundary overall is by no means a couple hundred lines, I will simply say that the vast majority of code (nearly the entire API) is related to user and resource management...how users are defined and authenticated, how infrastructure and services are described for access, RBAC, etc. The actual networking code performing the secure proxying is quite minimal because at least for the TCP tunnel it's more or less specifying the acceptable TLS parameters for that session and from there you're mostly in `io.Copy` land... it probably works out to a couple hundred lines :-D

What you're doing in Fly looks super cool and the stuff you're doing on gVisor (including the user-mode Wireguard stuff) is super cool too! Thanks for writing it up. And it sounds like the two solutions are more complementary than competing, so maybe at some point in the future you'll find that Boundary has a niche to fill in your setup as well!

Re: SSH and User-Mode IP WireGuard

#103

Post by atonse » Fri, Mar 05, 2021, 5:36 PM UTC

jefferai wrote: post #100

atonse wrote: post #57

Earlier quoted context omitted.

Thanks. I actually feel like if Boundary had an experience more like Tailscale does, but on top of their stack (wireguard network, secrets in vault, server/service discovery in consul, etc), that would be really powerful and a no-brainer for those of us who also use a lot of Hashicorp products. But I'm still trying to fully understand what they're doing with Boundary. The abstractions just feel a bit off to me unlike…

TCP targets (the only kind currently in Boundary) actually work with _any_ TCP connection. The `boundary connect ` bits are just some CLI syntactic sugar around the main `boundary connect` command -- which works all by itself! -- that fill in IP/port and other information for various clients. (This has been an unfortunate bit of confusion for many people trying Boundary out. We'll take another look at how we can make…

Awesome, thanks for the responses!

Re: SSH and User-Mode IP WireGuard

#104

Post by chrisweekly » Tue, Mar 16, 2021, 2:58 AM UTC

mrkurt wrote: post #68

chrisweekly wrote: post #64

Amazing. The client API is profoundly simple. Also, this post prompted me to look closer at Fly.io, and it's leapfrogged to the top of my shortlist for an imminent client "edge proxy" project.

I love proxies and think all problems should be solved with proxies. Which means – if you give Fly.io a try and need any help, you should let me know!

Right on, MrKurt - will do!