Identity management for WireGuard networks

Re:Identity management for WireGuard networks by cpach on Wednesday October 19, 2022 @11:37AM (#33263746)

“Wireguard is a nightmare for any attempt at sane system administration.”

It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.

[ Parent | on HN ]

Re:Identity management for WireGuard networks by throwaway294566 on Wednesday October 19, 2022 @12:31PM (#33264569)

The problem with the building block approach is that it usually compromises any supposed security advantages Wireguard may have. You get a supersecure bank safe where the key is handed to you in the baker's shop opposite if you ask nicely.

[ Parent | on HN ]

Re:Identity management for WireGuard networks by cpach on Wednesday October 19, 2022 @02:06PM (#33265787)

I don’t believe that’s the case.

However, the system on top of WireGuard cannot just spit out a key to the user and call it a day.

The key (sorry…) is to make the system a) verify the identity of the users via an IdP (e.g. Okta or something similar) and then b) distribute short-lived keys, that can be revoked.

If one reads how Tailscale handles user authentication and key rotation, one will notice that they have a solid system in place for handling the keys and the product is much more sophisticated than OpenVPN.

I haven’t studied the approach of their competitors (e.g. Firezone) so I can’t comment on that.

[ Parent | on HN ]