Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

71–80 of 107 posts

Re: Identity management for WireGuard

#71

Post by tptacek »

tssva wrote: post #66
tptacek wrote: post #56

Earlier quoted context omitted.

First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit). But more importantly, you can't just count lines of code as if they're all equivalent. There's a trusted core of code that is more important than the rest of the code, and WireGuard's trusted code is microscopic compared to OpenVPN. That's the right word in this case: "microscopic". It's…

"First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit)." Do you have some evidence for that or is it just speculation? "But more importantly, you can't just count lines of code as if they're all equivalent." You're right but the Wireguard white paper conclusion claims an advantage for Wireguard based solely upon the lines of code needed to i…

Yes, there is plenty of evidence for this; see for instance the WireGuard paper. Numerous code size comparisons have been done here.

Further, that is not what the WireGuard paper concludes. For instance: the paper makes a note of the fact that WireGuard is designed to be implemented without dynamic memory allocation, which is not a function of lines of code (in fact, it probably adds lines of code).

You do you, but as a practitioner in this space, I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice. You might disagree, but I think you'd be in the minority of security engineers on the point. Feel free to ask around! The codebases for OpenVPN and the IPSECs are reviled.

Re: Identity management for WireGuard

#72

Post by afeiszli »

Mister_Snuggles wrote: post #23

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…

Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.

Re: Identity management for WireGuard

#74

Post by OJFord »

We solve this (for non-technical colleagues) by keeping the key in terraform (via my open source provider OJFord/wireguard - accepts either a public key for out-of-state key, or generates one for you). Then we can just provide users who don't know or care about keys a file to import into the wg app.

(Spoofing other users if you already have access to our tf state isn't a vector we care about.. even if we logged user info for audit, that kind of access would let you fake that and worse anyway.)

Maybe it's not as flashy to set up from a non-technical-end-user perspective, but it's easy; it's just wireguard & terraform, both of which we're using anyway.

Re: Identity management for WireGuard

#75

Post by maxmouchet »

yardstick wrote: post #67
linsomniac wrote: post #14

Earlier quoted context omitted.

It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard

Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authenti…

I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2].

[1] https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...

Re: Identity management for WireGuard

#76

Post by dpifke »

LinuxBender wrote: post #37
mbreese wrote: post #36

Earlier quoted context omitted.

If you don’t need identity controls (using a fixed node configuration), you can always use vanilla Wireguard without the user management. You don’t get a NAT traversing mesh, but if your nodes are visible to the net, you do get direct node to node networking. If you only have one node directly visible, you can also use that as a gateway. I like these more traditional VPN style use tools for Wireguard, but you can alw…

vanilla Wireguard without the user management That is how I use Tinc today. I briefly tried Wireguard but it works very much like OpenVPN and Strongswan in that it does not have dynamic mesh routing. Privacy advantages aside, the dynamic mesh routing I get from Tinc works around internet outages, albeit slower than I would like but a 2 minute routing outage is still better than {n} time it takes for ISP's to manually…

You can run dynamic routing protocols such as OSPF or iBGP over Wireguard. It's not built in, but that's a feature, not a bug—I vastly prefer software that does one thing and does it well.

I have a full mesh of Wireguard tunnels configured between home/office/datacenters/laptop, and run bird[0] on the VPN endpoints to direct traffic between them.

[0] https://bird.network.cz/

Re: Identity management for WireGuard

#77

Post by yardstick »

maxmouchet wrote: post #75
yardstick wrote: post #67

Earlier quoted context omitted.

Interesting: “The WireGuard private key is stored in the memory of the Pritunl client background service and also in the WireGuard configuration file. WireGuard uses a connection-less design and this private key could be used by an attacker to hijack the connection even if multi-factor authentication is used. In high security environments it is important to consider that OpenVPN connections with multi-factor authenti…

I am not familiar with pritunl, but it should not be necessary to keep the private key in a file. It is possible to configure wireguard directly with code [1] without calling the wg binary manually as pritunl seems to be doing [2]. [1] https://github.com/WireGuard/wgctrl-go [2] https://github.com/pritunl/pritunl/blob/f82528ff2b7250965faf...

I think I’m more worried about the lifecycle of that key. Pritunl issues new keys all the time. What does Tailscale etc do?

Because these keys aren’t the short life, in-memory session keys[1], but auth keys. Knowing this single key effectively bypasses any MFA you may have.

Seems like Tailscale has 180 days by default[2], which feels a bit too long for a person who expects MFA to be more proactive than this. Sure you can change the default to 1 day, but how many users know it’s possible or would even think to change that?

Compare that with OpenVPN where you can force every single auth attempt to use a password plus TOTP code for instance.

1. https://www.wireguard.com/protocol/

2. https://tailscale.com/kb/1028/key-expiry/

Re: Identity management for WireGuard

#78

Post by jacob019 »

generalizations wrote: post #65
jacob019 wrote: post #39

Earlier quoted context omitted.

Wireguard is L3 encryption. It's great because it's simple. Linus called it poetry. If you are bridging L2 over the Internet, then one way or another you're stuffing Ethernet frames into IP packets. Linux has built in L2 tunneling, sans encryption. I wouldn't call it a custom hack to open an L2 tunnel over wireguard. It's a one liner on each end. A configuration utility like wg-quick could be made to set it up for yo…

> I wouldn't call it a custom hack to open an L2 tunnel over wireguard There's too many headers that are too big. If you do a simple L2 tunnel, you have three options: jumbo frames, packet fragmentation, or custom hacks. None are great. > Linux has built in L2 tunneling, sans encryption IIRC, because the extra header for the encryption layer pushes the MTU over 1500.

Regardless of the technology, there is no way to put an 1518 byte Ethernet frame in a 1500 byte IP packet. You're going to have to fragment or live with reduced MTU inside the tunnel.

Re: Identity management for WireGuard

#79

Post by colonelxc »

matthewaveryusa wrote: post #43
bradfitz wrote: post #34

Earlier quoted context omitted.

(Tailscale engineer here) What's the bug? I hadn't heard about this. Metrics show no drop in iOS control plane connections.

I've been using tailscale for a couple years. wrt ios every couple of weeks all traffic on my phone stops and I need to open the tailscale app and toggle the active switch for traffic to start flowing again. I don't have that problem with my other devices.

I've actually had that happen on Android, seemed to somehow kill even all non-tailscale traffic too

Re: Identity management for WireGuard

#80

Post by matthewaveryusa »

colonelxc wrote: post #79
matthewaveryusa wrote: post #43

Earlier quoted context omitted.

I've been using tailscale for a couple years. wrt ios every couple of weeks all traffic on my phone stops and I need to open the tailscale app and toggle the active switch for traffic to start flowing again. I don't have that problem with my other devices.

I've actually had that happen on Android, seemed to somehow kill even all non-tailscale traffic too

The way it works on phones is these apps operate as full VPN due to how network permissions for apps are handled. When you turn on tailscale, tailscale will pass through traffic it doesn’t need to touch. that’s also why you can’t have two vpn apps running at the same time.
Post reply on HN