Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

131–140 of 171 posts

Re: HashiCorp Boundary

#132

Post by tinco »

mitchellh wrote: post #48
zellyn wrote: post #45

Earlier quoted context omitted.

Looks great! A couple of questions: Can you view logs of SSH sessions after the fact? Can you live-view a session? Can you require a pairing authorization like with https://github.com/square/sudo_pair ?

All of the above is on the roadmap. Our initial focus is on making the connections easy. We have some work to do there still. We'll then move on to more management features like this. They're both super important but from an initial adoption perspective we feel the latter is moot if the former (connections) don't work easily.

Would it not be easier to replace SSH with something more modern that actually exposes that as a feature?

I've been thinking about that the past couple of years, with today's building blocks an SSH alternative is so easy to build. I bet if you guys were to build or back such a system it would be the right quality and get the adoption it needs.

Opaque SSH sessions are such a thorn in my side.

Re: HashiCorp Boundary

#133

Post by TheGuyWhoCodes »

mitchellh wrote: post #112
TheGuyWhoCodes wrote: post #103

Earlier quoted context omitted.

Are there any plans or a way to use existing tools? By existing tools I mean winscp or any other tools that use a normal ssh client? RDP etc. I guess for shh and rdp you can just run the Boundary cli with a the predefined target in a terminal embedded into the UI (MremoteNG, MobaXterm etc) but tools like winscp are very much used for sftp file transfers. A desktop client with a list of services/targets would also be…

You can do this already, The `boundary connect ssh` stuff is just a convenience. You can spin up a local boundary proxy to anything and just connect anything that speaks TCP over it. This allows you to use all the tools you just named. A desktop client is on the way, we already have an internal build of parts of it but it requires more work and didn't make it for 0.1.

Thanks for answering.

boundary proxy is an ok step but user experience should be streamlined especially if it's for teams and orgs and not just individuals who want to hack scripts but I full understand it's a 0.1 release.

Another thing I couldn't find in the docs is support for multiple installations, let's say I have different vpcs (In different accounts) or I have one on-prem installation and one in a cloud how do I login/switch/configure the cli to work seamlessly with multiple controllers.

Re: HashiCorp Boundary

#135

Post by leTechsavy »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

Seknox Trasa https://www.trasa.io

Re: HashiCorp Boundary

#136

Post by fairramone »

all_usernames wrote: post #101
newman314 wrote: post #98

Earlier quoted context omitted.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

Google BeyondCorp?

I think BeyondCorp == IAP

Re: HashiCorp Boundary

#137

Post by carlosf »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Happy Nomad + Consul + Terraform user here.

Thanks a lot for the great products, but please give us managed Nomad already. Or even better: a Heroku like app platform. I want to give you money, but I really dislike your companies' enterprise offerings.

BTW I believe there's a great opportunity for Hashicorp right now. Cloud providers are good at selling building blocks, but are terrible at selling a vision of how you should build your applications. On the other hand, low code / enterprise application platforms are a disgrace as always. IMO a coherent stack of managed Nomad + Consul + Vault could provide a solid middle ground for those who want to build apps without the burden of managing K8s or navigating through the incomprehensible maze of products offered by public clouds.

Re: HashiCorp Boundary

#138

Post by atonse »

armon wrote: post #41
A_No_Name_Mouse wrote: post #27

Earlier quoted context omitted.

Is there a simple paper that explains how this works on a technical level? I have a hard time visualizing how a connection to a remote host would be set up if it runs through Boundary. Does "without requiring direct network access" mean Boundary works as a proxy? And how does Boundary enable the connection if the host does not have direct network access?

We don't have a white paper on this yet, but we have a white board video that explains both how it works conceptually as well as at a more technical level of deployment architecture and data flow. https://www.youtube.com/watch?v=tUMe7EsXYBQ&feature=emb_titl...

Armon, just wanted to say your whiteboard videos are excellent. And the clarity of thought demonstrated in them over the years has been a great ad for the products too. The low tech aspect also feels more human.

But I had a chuckle at the idea of you wheeling a whiteboard into your house (if that is where it is filmed).

Re: HashiCorp Boundary

#139

Post by mitchellh »

carlosf wrote: post #137
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Happy Nomad + Consul + Terraform user here. Thanks a lot for the great products, but please give us managed Nomad already. Or even better: a Heroku like app platform. I want to give you money, but I really dislike your companies' enterprise offerings. BTW I believe there's a great opportunity for Hashicorp right now. Cloud providers are good at selling building blocks, but are terrible at selling a vision of how you…

Hello! Thank you :)

(1) HCP Nomad is coming. We announced HCP Consul public beta and HCP Vault private beta today (on AWS, more clouds later). HCP Nomad is planned but not quite ready to talk about beyond that yet. That is "managed Nomad."

(2) Re: Heroku-like app platform. Watch tomorrow's keynote or catch up on our announcements tomorrow. It isn't this, but I think it'll give you an idea of the vision we're heading towards and that is relevant to this idea.

Re: HashiCorp Boundary

#140

Post by btgeekboy »

mmettler wrote: post #131

Another company to watch here is Tailscale, which is Wireguard-based: https://tailscale.com/ (disclosure: small Tailscale investor)

I like the people behind Tailscale, but I’ve yet to figure out how they’re different than ZeroTier.
Post reply on HN