Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

21–30 of 107 posts

Re: Identity management for WireGuard

#21

Post by yamrzou »

snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

Same. I recently started using it for a personal project, and was amazed how much it simplifies the access and management of the infrastructure.

I'm also using it to SSH into my home PC. No need to open router ports, configure dynamic IP, or whatever. Just setup tailscale, and I can simply do ssh user@homepc thanks to MagicDNS.

Re: Identity management for WireGuard

#22

Post by Spooky23 »

snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

I felt the same way until Tailscale mysteriously stopped working one day for iOS.

There’s no way to troubleshoot. A bunch of forum posters reported the same issue after an update, but no solution for a few months.

Re: Identity management for WireGuard

#23

Post by Mister_Snuggles »

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec.

Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up does this perfectly, and using MDM profiles lets me set up connect-on-demand. WireGuard already does connect-on-demand and my limited testing suggests that it works well enough.

I don't want to use Tailscale since I'd like to keep everything self-hosted. It sounds like Headscale is almost there - it just needs the iOS client to be able to point to an arbitrary endpoint.

Re: Identity management for WireGuard

#24

Post by vetinari »

matthewaveryusa wrote: post #8
candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

wrt the IP not being enforced, do you mean different endpoints can require different IPs, or a client can connect to an endpoint with a different IP configured and it's all good? Last time I tested, if you set one IP per user in your wireguard config, that user must connect with that IP.

He means endpoint (hostname or IP), not AllowedIP. It is resolved/connected to only when initiating the connection, not when accepting one.

I consider the behavior a feature, allows for seamless roaming. You should not trust the IPs anyway, that's what the keys are for.

Re: Identity management for WireGuard

#25

Post by throwaway294566 »

jacob019 wrote: post #9
tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

OpenVPN doesn't have awesome credential management baked in and the core networking code is an order of magnitude more complex, which is why the performance sucks compared to wireguard.

While not totally awesome, OpenVPN is miles beyond Wireguard when it comes to credential management. There are several auth plugins, you can use "the usual stuff" like PAM, and through that LDAP/Kerberos, ActiveDirectory, RADIUS, etc.. For higher security demands, client certificates are also possible and standardized X.509, PKCS#11/15 like CaC, Yubikeys and usual employee ID cards work. Also, OpenVPN supports at least some form of IP assignment and DNS/Route management.

Wireguard has none of that, not even the notion of a user. There are just keys in a special (unsupported by anything else) format that are assigned an IP address statically in a file. Oh, and the frigging software writes into that config file if you change anything.

Wireguard is a nightmare for any attempt at sane system administration.

Re: Identity management for WireGuard

#26

Post by GekkePrutser »

mr337 wrote: post #20
lifty wrote: post #12

Earlier quoted context omitted.

is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.

So far doesn't look like it unless you go the MDM route, which I guess is aimed mainly at enterprise users. https://github.com/tailscale/tailscale/issues/5431

You can add profiles with Apple configurator 2. You don't have to go the full MDM route. It's quite easy.

I think the problem is though that the iOS client doesn't support configuring this option in the profile (whether installed via configurator or MDM) either.

Re: Identity management for WireGuard

#27

Post by GekkePrutser »

candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

Another thing I wish it would use is the built in kernel support for wireguard.

Re: Identity management for WireGuard

#28

Post by encryptluks2 »

GekkePrutser wrote: post #27
candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

Another thing I wish it would use is the built in kernel support for wireguard.

Wireguard already does this. Did you mean something else?

Re: Identity management for WireGuard

#29

Post by LinuxBender »

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply.

My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for ID management and could leverage Wireguard for speed. I am not a proper developer so I can only wish for such a thing or maybe pay someone to make this. Tinc has awesome user-space dynamic mesh routing but lacks user management and is slow compared to Strongswan/OpenVPN. Wireguard is fast. OpenLDAP can back-end ID management for just about anything, especially when combining it with oauth/saml and can be integrated into just about anything and that works for me because I am a fan of decentralized and/or distributed systems.

[1] - https://www.tinc-vpn.org/

Re: Identity management for WireGuard

#30

Post by cpach »

throwaway294566 wrote: post #25
jacob019 wrote: post #9

Earlier quoted context omitted.

OpenVPN doesn't have awesome credential management baked in and the core networking code is an order of magnitude more complex, which is why the performance sucks compared to wireguard.

While not totally awesome, OpenVPN is miles beyond Wireguard when it comes to credential management. There are several auth plugins, you can use "the usual stuff" like PAM, and through that LDAP/Kerberos, ActiveDirectory, RADIUS, etc.. For higher security demands, client certificates are also possible and standardized X.509, PKCS#11/15 like CaC, Yubikeys and usual employee ID cards work. Also, OpenVPN supports at lea…

“Wireguard is a nightmare for any attempt at sane system administration.”

It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.

Post reply on HN