From: Adam Weiss <adam@signal11.com>
To: wireguard@lists.zx2c4.com
Subject: Key Management / Rotation and Monitoring
Date: Tue, 8 Dec 2020 22:18:45 -0500 [thread overview]
Message-ID: <CAFVoEQSmozd-6h7isSX04h8L3ZiRjv_xBmAiYVHNwyU3uoDz5w@mail.gmail.com> (raw)
Hi All,
I've been following some recent threads regarding real life
deployments of WireGuard and it got me thinking about key management,
rotation and monitoring. Due to the seamless support for roaming
built into WireGuard these concerns are greater than typical setups as
a stolen key can be used seamlessly alongside its legitimate user.
In the interest of understanding best practices for secure deployment
of WireGuard and possibly identifying use cases for another project
that could aim to solve these issues, I'm curious:
1) What are people doing to get keys onto their endpoints?
2) What are people doing to rotate those keys regularly?
3) What sorts of monitoring have people constructed to try and detect
multiple users of the same key (I'm not sure how possible this is
today with the current WG releases, it's been a while since I've
looked closely at the project so please forgive me if this question is
nonsensical at this time).
Looking forward to any responses.
--adam
reply other threads:[~2020-12-09 3:19 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFVoEQSmozd-6h7isSX04h8L3ZiRjv_xBmAiYVHNwyU3uoDz5w@mail.gmail.com \
--to=adam@signal11.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).