5

I've read WireGuard specification, and it looks that it doesn't natively support any kind of user authentication (i.e. LDAP or something like that). Any client which has server's public key, and whose IP address is whitelisted in the server configuration, can connect.

Does anyone knows about any WireGuard extension / implementation which does provide user authentication feature?

Thanks!

0
3

Each side of the tunnel has its own generated key and derived public key (defined as "peer" on other side of connection). To act as you are writing you would need to share the private key between the "clients", which is the worst you can do (technically you can but I hope nobody would even think about that).

Let's think about "client vs. server" roles.

server

  • own secret key
  • list of all possible peers / users
  • each client is represented by own peer definition on server side with relevant public key of the client

client

  • own secret key
  • one peer definition with the public key of the server

We can say that client is authenticated using one factor authentication and the authentication is realized using public key of the client.

  • Granting access to new client mean to add peer definition to server side (can be realize without restarting VPN / without breaking all current vpn sessions).
  • Revoking access for the current client mean removing peer definition on server side (again it can be done also without restarting VPN - closing all current sessions).

If I correctly understood your question this "feature" is present in wireguard out of the box without any needs of extensions.

2

As @Kamil says, Wireguard concept is a bit different that other VPN solutions, I also started using it no long time ago, and if you want to implement something that uses existing authentication, you can get the way that I see in some projects:

  • Authenticate your users with your preferred method, plus 2FA, whatever you want.
  • After user is authenticated, the client generate a temporal key/pair.
  • Through a secure connection, client send the public key to the server, fetch their config (endpoint, server public key, etc...)
  • The client connect to VPN
  • When the user logout or session expires, the server can remove the peer from the WG endpoint.

All of this of course can be automated on client/server side.

4
  • 1
    Sorry, never, please never do that. Do not advice sending of the private keys trough a "secure" channel. Both parties should not know each others private keys. This is not the case when the client's key is generated on server. There should be another implementation that "unlocks" (decrypts) the client private key when needed. At the moment the private key is easily transferable and can be used directly in another (abuser's) client. Something more. Because of the "roaming feature" of WireGuard it is impossible for the server to distinguish between these two clients. – Nikolay Naydenov Jul 22 '20 at 18:44
  • I understand the OP's concern. The export function in the Windows client exports the tunnel with the client's private key. There is nothing preventing someone from importing this file to another computer and connecting as that client. I've done this. There needs to be a method of authentication. – whizzard Jul 25 '20 at 22:39
  • I agree with Nikolay. Don't ever send private keys. That being said, a client could generate a key, send their public key, let the server add that to its peers section, receive a template of their config from the server, and populate that template with the matching private key. Of course the server would be designed to only carry out this process for an authenticated user. – Kevin Tindall Jan 1 at 14:37
  • I agree that is not good practice, to send private keys, I edited the steps, also it's not a definitive solution, olny a example that WG can be combined with other authentication systems to integrate VPN connections – Securez Jan 4 at 15:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.