HashiCorp Boundary

#1

Post by yongshin » Wed, Oct 14, 2020, 3:55 PM UTC

Re: HashiCorp Boundary

#2

Post by jolux » Wed, Oct 14, 2020, 4:42 PM UTC

Seems like the BeyondCorp-ish “zero trust” remote access space is heating up. This looks similar in some ways to Cloudflare One which was announced Monday: https://blog.cloudflare.com/introducing-cloudflare-one/

Re: HashiCorp Boundary

#3

Post by warkdarrior » Wed, Oct 14, 2020, 4:43 PM UTC

This looks like an authenticated proxy. I assume you would need to locally reconfigure your clients (ssh, browser, whatever) to use the Boundary server as a proxy.

Re: HashiCorp Boundary

#4

Post by bluu00 » Wed, Oct 14, 2020, 4:44 PM UTC

https://web.archive.org/web/20201014160020/https://www.hashi...

link wasn't working for me, so.

Re: HashiCorp Boundary

#5

Post by marmaduke » Wed, Oct 14, 2020, 4:45 PM UTC

This looks like an interesting alternative to k8s ingress, even if the goal is similar, especially when the default ingress controllers don't support e.g. SSH.

Way too much ceremony for scientific compute sites tho

Re: HashiCorp Boundary

#6

Post by t3rabytes » Wed, Oct 14, 2020, 4:45 PM UTC

> When a user establishes a TCP session through Boundary, a Boundary worker node seamlessly proxies the connection.

Boundary sounds like the perfect mash-up of Google's bastion-less SSH access to GCE instances and actual IAM. Exciting!

Re: HashiCorp Boundary

#7

Post by latentpot » Wed, Oct 14, 2020, 4:59 PM UTC

Is this very similar to cyberark, but without the logging and recording of usage?

Re: HashiCorp Boundary

#8

Post by yegle » Wed, Oct 14, 2020, 5:06 PM UTC

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp. If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend.

This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend).

Pomerium is another open source project that's actively maintained. I've been using it as a reverse proxy to all my homelab websites (grafana, miniflux etc). I can now safely access all of these internal resources from outside of my home WiFi with automated SSL certificate configuration and renewal.

You can theoretically protect your SSH connection via these IAP proxies, using the Chrome SSH extension and open source SSH relay implementation like https://github.com/zyclonite/nassh-relay (but I personally haven't tried that).

Disclaimer: I work for Google and am a casual contributor to the Pomerium project.

Re: HashiCorp Boundary

#9

Post by lizhang » Wed, Oct 14, 2020, 5:07 PM UTC

jolux wrote: post #2

Seems like the BeyondCorp-ish “zero trust” remote access space is heating up. This looks similar in some ways to Cloudflare One which was announced Monday: https://blog.cloudflare.com/introducing-cloudflare-one/

I'm guessing the Cloudflare One announcement forced Hashicorp to announce this so they wouldn't lose a lot of potential customers due to vendor lock-in.

Re: HashiCorp Boundary

#10

Post by throwaway873993 » Wed, Oct 14, 2020, 5:07 PM UTC

I'd rather use https://userify.com/