From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: smntov@gmail.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 151f4008 for ; Tue, 17 Apr 2018 19:53:04 +0000 (UTC) Received: from mail-wr0-f169.google.com (mail-wr0-f169.google.com [209.85.128.169]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id a9e197ab for ; Tue, 17 Apr 2018 19:53:04 +0000 (UTC) Received: by mail-wr0-f169.google.com with SMTP id o15so7825330wro.11 for ; Tue, 17 Apr 2018 13:07:46 -0700 (PDT) Return-Path: Message-ID: <1523995660.9423.4.camel@gmail.com> Subject: Re: SFTP-based VPN bootstrapping with automatic collision-free IPs assignment/peers' public data sharing From: ST To: "Jason A. Donenfeld" Date: Tue, 17 Apr 2018 23:07:40 +0300 In-Reply-To: References: <1523814593.1990.49.camel@gmail.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Hi Jason, On Mon, 2018-04-16 at 00:37 +0200, Jason A. Donenfeld wrote: > Hi ST, > > It's a cool idea using the file system like that (the sticky bit would > make the permissions part work correctly, perhaps), though I wonder if > it's a bit complicated. If the model you're after is simply "server > allocates IPs for peers already known through some channel but with > unknown wireguard public keys", then maybe a better SSH-based > interface is a special user that is only allowed to run one program, > and that program does one thing: accepts as input a public key, and > outputs [without races] an allocated IP, endpoint, and the server's > public key. Under the hood that information could be stored in a > variety of ways. Alternatively, this could be its own protocol over > the wire or over TLS or over whatever the pre-established trust > mechanism is that the idea is based on. One of the earliest dirty bash > scripts for WireGuard did this (insecurely) over TCP -- > https://git.zx2c4.com/WireGuard/tree/contrib/examples/ncat-client-server/server.sh > -- this is what's running on demo.wireguard.com. I looked into those scripts - thank you! What discourages me is its warning not to use in production! So I'm wondering maybe it is possible to just use DHCP server/client somehow with WG for this purpose? Are there any expected pitfalls for such a configuration? Thank you!