Identity management for WireGuard • Hacker News Board

Re: Identity management for WireGuard

#41

Post by candiddevmike » Wed, Oct 19, 2022, 5:04 PM UTC

generalizations wrote: post #31

tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over wg.

What do you need L2 for these days?

Re: Identity management for WireGuard

#42

Post by kbumsik » Wed, Oct 19, 2022, 5:09 PM UTC

Netmaker looks promising for k8s distros. It's shame that its license is SSPL.

Re: Identity management for WireGuard

#43

Post by matthewaveryusa » Wed, Oct 19, 2022, 5:20 PM UTC

bradfitz wrote: post #34

Spooky23 wrote: post #22

Earlier quoted context omitted.

I felt the same way until Tailscale mysteriously stopped working one day for iOS. There’s no way to troubleshoot. A bunch of forum posters reported the same issue after an update, but no solution for a few months.

(Tailscale engineer here) What's the bug? I hadn't heard about this. Metrics show no drop in iOS control plane connections.

I've been using tailscale for a couple years. wrt ios every couple of weeks all traffic on my phone stops and I need to open the tailscale app and toggle the active switch for traffic to start flowing again. I don't have that problem with my other devices.

Re: Identity management for WireGuard

#44

Post by jasonjayr » Wed, Oct 19, 2022, 5:21 PM UTC

generalizations wrote: post #31

tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over wg.

https://github.com/m13253/VxWireguard-Generator

I'm using that in production with Babel (managing dynamic routes) with great success. Tinc had been solid for us for years, but once I actually payed attention to the performance hit, it was worth a bit of hassle to make it work over wireguard.

Re: Identity management for WireGuard

#45

Post by giobox » Wed, Oct 19, 2022, 5:25 PM UTC

LinuxBender wrote: post #35

jetbalsa wrote: post #32

Earlier quoted context omitted.

Sounds like you are looking for a self hosted ZeroTier or Tailscale.

It does not appear that Tailscale is an identity provider but rather integrates into commercial ID providers? Do they integrate into OpenLDAP or into OAuth/SAML providers that are in front of OpenLDAP? [Edit] Answering my own question. Custom SAML providers are only supported with the Enterprise edition. [1] [1] - https://tailscale.com/kb/1119/sso-saml-oidc/

In fairness, they do out of the box support most of the major players in the SSO space for free (google, Microsoft, okta, gitub...). I'm happily using Google SSO to manage a small number of users for my tailscale account free of charge.

FWIW, tailscale is technically not free once more than 1 user, its a commercial service at the end of the day not some self-hosted open source application. They have extremely generous fair use policy in my experience and won't bill for a small number of users though. This means custom SSO is likely only a real issue for paying customers to begin with, although I can understand the frustration for the few users who do want it on the free tier.

> https://tailscale.com/pricing/

Re: Identity management for WireGuard

#46

Post by Spooky23 » Wed, Oct 19, 2022, 5:40 PM UTC

bradfitz wrote: post #34

Spooky23 wrote: post #22

Earlier quoted context omitted.

I felt the same way until Tailscale mysteriously stopped working one day for iOS. There’s no way to troubleshoot. A bunch of forum posters reported the same issue after an update, but no solution for a few months.

(Tailscale engineer here) What's the bug? I hadn't heard about this. Metrics show no drop in iOS control plane connections.

Here’s the post i put up on the forum.

https://forum.tailscale.com/t/difficulty-with-ios-tailscale-...

Other posts had some troubleshooting guidance that wasnt effective. Note that it only failed on iOS. Still using it on my Debian boxes.

If you could point me at anything I would be very grateful. I’m using some other VPN container now that i don’t like!

Re: Identity management for WireGuard

#47

Post by [deleted] » Wed, Oct 19, 2022, 5:45 PM UTC

tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

[deleted]

Re: Identity management for WireGuard

#48

Post by j0057 » Wed, Oct 19, 2022, 5:50 PM UTC

Mister_Snuggles wrote: post #23

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…

You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?

Re: Identity management for WireGuard

#49

Post by belthesar » Wed, Oct 19, 2022, 5:52 PM UTC

Mister_Snuggles wrote: post #23

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…

This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s dependent on the peer host OS to be able to do that, but that’s how I do it with my client access VPN.

Re: Identity management for WireGuard

#50

Post by cpach » Wed, Oct 19, 2022, 6:06 PM UTC

throwaway294566 wrote: post #38

cpach wrote: post #30

Earlier quoted context omitted.

“Wireguard is a nightmare for any attempt at sane system administration.” It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.

The problem with the building block approach is that it usually compromises any supposed security advantages Wireguard may have. You get a supersecure bank safe where the key is handed to you in the baker's shop opposite if you ask nicely.

I don’t believe that’s the case.

However, the system on top of WireGuard cannot just spit out a key to the user and call it a day.

The key (sorry…) is to make the system a) verify the identity of the users via an IdP (e.g. Okta or something similar) and then b) distribute short-lived keys, that can be revoked.

If one reads how Tailscale handles user authentication and key rotation, one will notice that they have a solid system in place for handling the keys and the product is much more sophisticated than OpenVPN.

I haven’t studied the approach of their competitors (e.g. Firezone) so I can’t comment on that.