8 ms·

Show HN: Wag, MFA and Enrollment for WireGuard

149 points by Nullence 2y ago

Howdy folk, I've been building this project as both a side project and my job for a little while now. The rationale behind it is while wireguard is a fantastic protocol cryptographically it leaves a lot to be desired when it comes to enrollment and end user device security. Obviously instead of using an off the shelf solution like tailscale, I decided to reinvent the wheel which has honestly been quite fun with learning about eBPF, and recently clustering and HA with etcd! The most recent version (in the docker container) contains about 6 months of very new work bringing it all from sqlite3 to etcd. So please be forgiving if it does some weird things! Hope you all enjoy! P.s Im not a web developer and any tips on that front to make it less teeth pullingly awful are welcome!

mahkoh 2y ago
>IPv4 only. You'd think that sites choosing wireguard would have a more modern setup and might make heavy use of (self service) ULAs.
- deleted 2y ago
  [deleted]
- tptacek 2y ago
  What are the ULA wins you're thinking of here?
- deleted 2y ago
  [deleted]
- Nullence 2y ago
  I do plan on supporting IPv6 sometime soon, and doing something along the lines of mapping folks IPv4 addresses into private IPv6 space to reduce the risk of clashing with a users real local network. Is there something specific you were thinking about when you mention ULAs?
d-z-m 2y ago
Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.
- Avicebron 2y ago
  I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..
  - asimops 2y ago
    But MFA is there to prevent this compromise from affecting the service and alert users/admins to the compromise, right? If you have username and password and are able to force the TOTP in the 60s window, the TOTP would be useless imho.
  - yonatan8070 2y ago
    If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password
    - yardstick 2y ago
      Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)
      - ThePowerOfFuet 2y ago
        The difference being the notebook is paper and easily read, while the password manager is... quite a bit harder.
      - yonatan8070 2y ago
aragilar 2y ago
[flagged]
- helloooooooo 2y ago
  You know people can just do these things for fun right? It doesn’t have to be intended as any form of competitor.
  - stavros 2y ago
    This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".
    - mbreese 2y ago
      I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of bounds.
      - stavros 2y ago
        Oh, I'm not saying it's malicious, it's just a mindset of "creating a thing must be externally motivated" vs "we make things because we like making things".
        mbreese 2y ago
        I agree that that dichotomy is on display here quite often. And it isn’t a good mindset. Making for the sake of making and learning should be celebrated. I just didn’t get that vibe from the now flagged comment by @aragilar. I saw it as a genuine curiosity about the design choices. Maybe I was wrong. “¯\_(ツ)_/¯“
asimops 2y ago
Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring new routes and repeating authentication if necessary.
- Aloha 2y ago
  It seems to me that if I were building a VPN client like Global Protect but using WG, I'd have an eternal per client auth key that is used to set up an initial tunnel to the VPN controller, over that you perform auth, etc, then you're given another session key, which is valid as long as that session is. The first tunnel would disconnect as soon as you finished authenticating and got your actual session key.
  - mbreese 2y ago
    Why even have the first tunnel? You could do the entire thing out of hand over a web interface or other mechanism. If the public address of the WG server (or the authn server) is known and available, then there’s no real difference in setting up the connection over a persistent WG channel vs an HTTPS service. Both solutions are custom for that VPN, so I’d just have one WG tunnel that’s controlled through a secured (web)service. The bonus is that you wouldn’t need a hard coded initial key. (You’d still need some authentication mechanism, but it could be more than fixed public/private key pairs).
- gchamonlive 2y ago
  I'd use firezone for that. It has an option that forces the user to login to the platform regularly. Coupling that with an external identity provider via oidc is a very solid and simple solution for session management.
  - jamilbk 2y ago
    Just a quick note -- 1.0 goes a little further and rotates the WireGuard keys upon each auth session, so the private key never leaves the tunnel process memory. You need the Firezone client for that, though.
eptcyka 2y ago
[flagged]
- hiatus 2y ago
  This kind of shallow dismissal is inappropriate, especially for a Show HN.
  - eptcyka 2y ago
    [flagged]
- deleted 2y ago
  [deleted]
ta1243 2y ago
This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253fd9962c68f73aa5088604f3f425d58a963bfb5c0889cca54d63a34b2e3 http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth replacing that part at least in case people think http is a reasonable option. > To authenticate the user should browse to the servers vpn address, in the example, case 192.168.1.1:8080, where they will be prompted for their 2fa code. So when the session times out, is there any way for the client to realise this? Or does their ssh session (or whatever) just stop working? I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever. I haven't found one.
- 20after4 2y ago
  > I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever. That would be really cool. I hope the author of this will consider it.
  - Nullence 2y ago
    Ironically I've also been thinking about this on and off for a bit, as it is definitely one of the pain points of using Wag at the moment. My only problem is that if you capture that route and then redirect it, or whatnot, your peers wont be able to log in to wifi in public areas like coffee-shops/libraries/etc because the route will be trying to go via a VPN which wont be returning any real data. Such as where you should be going to log in haha
hnarn 2y ago
This sounds very similar to Head- or Tailscale, nice to see some alternatives to managing wireguard networks. Is there a comparison anywhere to understand what functionality overlaps, what is added, what differs and what will perhaps never be implemented?
- Nullence 2y ago
  Similar in terms of it uses wireguard definitely! I havent made a direct comparison in the documentation as it's not something I'm currently going toward. This project suits my needs and is quite fun! But I'll try and give a basic run down on the differences/similarities. Wag is good for hub and spoke design where you want to have a hard boundary, rather than a tailscale-esque mesh where everything touches everything and then the rules define the overlay. Both wag and tailscale add SSO integrations and effectively 2FA for securing your users. And both of us have a way to enroll and a web UI to manage things, although I'm sure TailScale is much more polished considering I'm one guy who doesnt like web development. As for things Im definitely not going to implement, probably interception or a TLS proxy to redirect users once their session logs out. Primarily just because doing that in eBPF is a little bit beyond me right at this second, and I dont feel like writing the DNAT/SNAT components I'd probably have to in order to get it working

149 points by Nullence 2y ago

mahkoh 2y ago

>IPv4 only. You'd think that sites choosing wireguard would have a more modern setup and might make heavy use of (self service) ULAs.

deleted 2y ago
[deleted]
tptacek 2y ago
What are the ULA wins you're thinking of here?
deleted 2y ago
[deleted]
Nullence 2y ago
I do plan on supporting IPv6 sometime soon, and doing something along the lines of mapping folks IPv4 addresses into private IPv6 space to reduce the risk of clashing with a users real local network. Is there something specific you were thinking about when you mention ULAs?

d-z-m 2y ago

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

Avicebron 2y ago
I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..
- asimops 2y ago
  But MFA is there to prevent this compromise from affecting the service and alert users/admins to the compromise, right? If you have username and password and are able to force the TOTP in the 60s window, the TOTP would be useless imho.
- yonatan8070 2y ago
  If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password
  - yardstick 2y ago
    Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)
    - ThePowerOfFuet 2y ago
      The difference being the notebook is paper and easily read, while the password manager is... quite a bit harder.
    - yonatan8070 2y ago

aragilar 2y ago

[flagged]

helloooooooo 2y ago
You know people can just do these things for fun right? It doesn’t have to be intended as any form of competitor.
- stavros 2y ago
  This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".
  - mbreese 2y ago
    I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of bounds.
    - stavros 2y ago
      Oh, I'm not saying it's malicious, it's just a mindset of "creating a thing must be externally motivated" vs "we make things because we like making things".
      - mbreese 2y ago
        I agree that that dichotomy is on display here quite often. And it isn’t a good mindset. Making for the sake of making and learning should be celebrated. I just didn’t get that vibe from the now flagged comment by @aragilar. I saw it as a genuine curiosity about the design choices. Maybe I was wrong. “¯\_(ツ)_/¯“

asimops 2y ago

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring new routes and repeating authentication if necessary.

Aloha 2y ago
It seems to me that if I were building a VPN client like Global Protect but using WG, I'd have an eternal per client auth key that is used to set up an initial tunnel to the VPN controller, over that you perform auth, etc, then you're given another session key, which is valid as long as that session is. The first tunnel would disconnect as soon as you finished authenticating and got your actual session key.
- mbreese 2y ago
  Why even have the first tunnel? You could do the entire thing out of hand over a web interface or other mechanism. If the public address of the WG server (or the authn server) is known and available, then there’s no real difference in setting up the connection over a persistent WG channel vs an HTTPS service. Both solutions are custom for that VPN, so I’d just have one WG tunnel that’s controlled through a secured (web)service. The bonus is that you wouldn’t need a hard coded initial key. (You’d still need some authentication mechanism, but it could be more than fixed public/private key pairs).
gchamonlive 2y ago
I'd use firezone for that. It has an option that forces the user to login to the platform regularly. Coupling that with an external identity provider via oidc is a very solid and simple solution for session management.
- jamilbk 2y ago
  Just a quick note -- 1.0 goes a little further and rotates the WireGuard keys upon each auth session, so the private key never leaves the tunnel process memory. You need the Firezone client for that, though.

eptcyka 2y ago

[flagged]

hiatus 2y ago
This kind of shallow dismissal is inappropriate, especially for a Show HN.
- eptcyka 2y ago
  [flagged]
deleted 2y ago
[deleted]

ta1243 2y ago

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253fd9962c68f73aa5088604f3f425d58a963bfb5c0889cca54d63a34b2e3 http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth replacing that part at least in case people think http is a reasonable option. > To authenticate the user should browse to the servers vpn address, in the example, case 192.168.1.1:8080, where they will be prompted for their 2fa code. So when the session times out, is there any way for the client to realise this? Or does their ssh session (or whatever) just stop working? I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever. I haven't found one.

20after4 2y ago
> I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever. That would be really cool. I hope the author of this will consider it.
- Nullence 2y ago
  Ironically I've also been thinking about this on and off for a bit, as it is definitely one of the pain points of using Wag at the moment. My only problem is that if you capture that route and then redirect it, or whatnot, your peers wont be able to log in to wifi in public areas like coffee-shops/libraries/etc because the route will be trying to go via a VPN which wont be returning any real data. Such as where you should be going to log in haha

hnarn 2y ago

This sounds very similar to Head- or Tailscale, nice to see some alternatives to managing wireguard networks. Is there a comparison anywhere to understand what functionality overlaps, what is added, what differs and what will perhaps never be implemented?

Nullence 2y ago
Similar in terms of it uses wireguard definitely! I havent made a direct comparison in the documentation as it's not something I'm currently going toward. This project suits my needs and is quite fun! But I'll try and give a basic run down on the differences/similarities. Wag is good for hub and spoke design where you want to have a hard boundary, rather than a tailscale-esque mesh where everything touches everything and then the rules define the overlay. Both wag and tailscale add SSO integrations and effectively 2FA for securing your users. And both of us have a way to enroll and a web UI to manage things, although I'm sure TailScale is much more polished considering I'm one guy who doesnt like web development. As for things Im definitely not going to implement, probably interception or a TLS proxy to redirect users once their session logs out. Primarily just because doing that in eBPF is a little bit beyond me right at this second, and I dont feel like writing the DNAT/SNAT components I'd probably have to in order to get it working