I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.
Re:WireGuard 1.0 for Linux 5.6
by blacksmith_tb on Monday March 30, 2020 @05:26PM
(#22732433)
Algo (mentioned above) will generate a bunch of profiles for you (including QR codes to configure mobile devices without needing to type awkward strings), which works pretty well for me - at least with a family you won't need to add or revoke identities very often I'd hope...
Re:WireGuard 1.0 for Linux 5.6
by ficklepickle on Monday March 30, 2020 @06:59PM
(#22733053)
My family shuns a member every other week. If you can't access the family VPN anymore, that is your notice.
I'm using Algo right now and it's perfect if I plan to maintain the same server consistently. The problem is that we're constantly traveling around and latency suffers when trying to connect to a box in DO's NYC3 from Vietnam.
It's a huge hassle to take that box down, spin up a new instance in Singapore, distribute profiles and authenticate. This is neither Algo nor Wireguard's fault. I just wish we had some more tooling to make it easier to move between instances.
Re:WireGuard 1.0 for Linux 5.6
by d00bianista on Tuesday March 31, 2020 @12:56PM
(#22739580)
Like a good Unix tool, that's outside of WG's scope. User management is done with the likes of LDAP and such.
I completely agree that it should never be part of Wireguard itself. Mostly looking forward to the project and tooling ecosystem that develops around it.
Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!
Re:WireGuard 1.0 for Linux 5.6
by MartijnBraam on Monday March 30, 2020 @10:30AM
(#22728297)
actually wireguard doesn't look at text files at all, it only has a netlink interface so you can configure it using the `ip` command. The current tools read the text files and set up the network interface.
Interesting... I'll have to take a look at what the utilities are actually done then and how they're loading the keys into the interface
If you look at their tutorial video, you can see what's going on. The tutorial has a lot of commands like
ip link add wg0 type wrieguard
ip addr add 10.1.20.1/24 dev wg0
wg set wg0 listen-port 5100 private-key /etc/path/to/key
ip link set wg0 up
wg set wg0 peer........
It's great when you're just trying to test things out. You can do a lot of stuff by hand, make sure it's working, try the conf file, enable the systemd or runit service, reboot and make sure it comes up.
Can you link to the video you're mentioning?
The side-by-side video:
You can already easily do the other way round: populate the config files with keys retrieved in an external system
This is what I do. I have a small dynamo table and a Python script I run from cron. I grab all updates since the last run and apply all changes to the running service. I have the config option set to write out the config on service stop, so I don't lose anything on a restart and don't have to replay everything. I have lots of room for improvement but it's a quick hack that works for my needs. (Not sharing yet because it doesn't fully CRUD right now.)
I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but — I'm someone! I (or you, or whoever) can build something, and as surely as day follows the night someone else will build some neat things in the future.
It's early days yet!