From: "Ivan Labáth" <labawi-wg@matrix-dream.net>
To: Der PCFreak <mailinglists@pcfreak.de>,
Jaseem Abid <jaseemabid@gmail.com>
Cc: wireguard@lists.zx2c4.com
Subject: Re: Peer names in configuration file possible?
Date: Thu, 21 Feb 2019 21:11:33 +0000 [thread overview]
Message-ID: <20190221211133.GA9835@matrix-dream.net> (raw)
In-Reply-To: <CAH-tXsDAjhKXcwSKSEGvQtrzoznwaL4dufOj+UiLj3bQuF1tMQ@mail.gmail.com> <ba2eee20-4dcd-2601-ffb7-bd1915230b0e@pcfreak.de>
Hi all,
I would like to propose an idea, that if peer were keyed by an
identifier (e.g. string) insted of pubkey. E.g. from
[Peer PubKeyWithBunchOfCharacters]
Identifier = Gorge
[Peer AnotherPubkeyWithBuchOfCharacters]
Identifier = Jane
..
we changed it to
[Peer George]
Pubkey = BuchOfBase64
[Peer Jane]
Pubkey = AnotherBuchOfBase64
It might not only
* save people from doing reverse ip what was this peer guessing
and/or lookup (e.g. in wg show)
* discourage remembering pubkeys, while encouraging key rotation
* perhaps make peers naturally sorted in a consistent manner
(after changing keys)
but also:
* enable lossless key turnover
pubkey changes, session keys tied to peer -> no connection drop
I think it should work fine, if privkey changed first, then
pubkey on peer, with handshake complete before old keys
become stale?
What do you think?
Regards,
Ivan
On Tue, Jan 22, 2019 at 12:50:17PM +0100, Der PCFreak wrote:
> Hi,
>
> this is my first post to this list, so hopefully I don't get anything
> wrong. Excuse me if so.
>
> I don't know if this has ever been mentioned but I am asking myself how
> should I keep track of let's say 1000 Peers in the configuration file of
> a WireGuard server when the config file just shows me the public key of
> the peers to identify them?
>
> Would it be possible to add something like 'identifier' which might or
> might not be unique:
>
> Sample '/etc/wireguard/wg0-server.conf'
>
> [Interface]
> ...
> ...
>
> [Peer]
> identifier=computer01
> ...
> ...
>
> [Peer]
> identifier=computer02
> ...
> ...
>
> For example the command 'wg show wg0-server dump' could then maybe show
> the 'identifier' as column to make things easier?
>
> I am thinking of possibly replacing/migrating a large OpenVPN server
> instance to WireGuard and I am currently thinking about the management of
> the peers which on OpenVPN I do do with username/password + OTP. Just
> the public key in the config is not enough in my opinion, a descriptive
> field should be possible.
>
> Also I assume when 'SaveConfig = true' is set in the servers
> configuration file any saves to the file currently remove manually added
> comments so doing it with comments is not a good option.
>
> Regards
>
> Peter aka PCFreak
On Wed, Jan 30, 2019 at 03:29:33AM +0530, Jaseem Abid wrote:
> Hello lovely WireGuard people,
>
> I wrote a tiny patch to add a name attribute to peers because identifying
> clients on my VPN just got very hard. Also hacking on wg source was a lot of
> fun. I asked @zx2c4 about this a while ago and he was open to the idea.
>
> It's not _really_ ready for a submission yet because of a few rough edges
> but
> I'd love to get some eyes on this if anyone is kind! I've never written any
> kernel code before and my C is a bit rusty, so please feel free to be picky
> about the review. I've added '*NOTE:*'s for the reviewer where I'm not sure
> of
> the approach.
>
> A few other questions,
>
> 1. There are barely any inline code comments, is that intentional or
> something
> that the community would love to improve? I don't mean the really obvious
> ones
> but things that are tricky.
>
> 2. Is there any interest in a getting started guide for developers wanting
> to
> work on wireguard itself? Something like the usual CONTRIBUTING.md? I had
> to dig
> through a lot of netlink tutorials and old kernel newbie guides to make any
> progress. It would be helpful to have it in one small doc.
>
> The patch stays in the `name` branch here[1] and this commit does most of
> the
> work[2].
>
> [1]: https://github.com/jaseemabid/WireGuard/tree/name
> [2]: https://github.com/jaseemabid/WireGuard/commit/544e59b4
>
> --
> Regards,
>
> Jaseem Abid
> https://twitter.com/jaseemabid
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
prev parent reply other threads:[~2019-02-21 21:11 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-29 21:59 Request for review: Add a short name attribute to peers for human friendly output Jaseem Abid
2019-01-22 11:50 ` Peer names in configuration file possible? Der PCFreak
2019-02-21 21:11 ` Ivan Labáth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190221211133.GA9835@matrix-dream.net \
--to=labawi-wg@matrix-dream.net \
--cc=jaseemabid@gmail.com \
--cc=mailinglists@pcfreak.de \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).