News for hackers. Stuff that matters.

A comment on Identity management for WireGuard networks. Parent comment

Re:Identity management for WireGuard networks by sph on Wednesday October 19, 2022 @07:00PM (#33268908)
These days it's pretty simple to achieve with systemd-resolved. I've been playing with split DNS and VPNs for a while and it seems it's a solved problem on Linux, finally.

The big hurdle is understanding the concept of search domain vs routing domain and the interaction with resolved and NetworkManager.

[ Parent | on HN ]
Re:Identity management for WireGuard networks by Fnoord on Thursday October 20, 2022 @04:08AM (#33272006)
Funny, systemd is like an opposite of wireguard in design goal. I believe the UNIX way would be /etc/hosts but some way to sync these within clients. Like etcd or whatever.
[ Parent | on HN ]
Re:Identity management for WireGuard networks by jeltz on Thursday October 20, 2022 @05:29AM (#33272431)
An issue with /etc/hosts is that it is just one file and you do not want etcd to own all the config you would need to use something like NIS instead.
[ Parent | on HN ]
Re:Identity management for WireGuard networks by Fnoord on Thursday October 20, 2022 @05:46AM (#33272518)
Ah yes, my bad. /etc/nsswitch.conf (which is also a Linux-ism but BSDs have something similar) supports LDAP. However, an advantage of /etc/hosts is the low latency since its not networked, while LDAP would result to overhead. Still, I believe that would be a suitable alternative. There's some non-bloated alternatives to OpenLDAP, and also an option could be caching.
[ Parent | on HN ]