Re: Using WireGuard on Windows as non-admin - proper solution?

[Patrick Fogarty <patrick@patanne.com>]

Jason

That method has the challenge of having to get a static configuration 
correct at the time of provisioning. A perfect example of when that 
won't work is during COVID. We have had client offices shut down, 
requiring us to migrate the VPN endpoint to a different office of the 
client. A machine in the field needs different configurations at that point.

You mentioned in a previous email you do not like the idea of allowing 
users to be able to change default routes. That was the reasoning behind 
requiring admin rights. Extremely valid point. With tools we have 
written in-house for matters unrelated to WireGuard we write them so 
config files cannot be loaded unless they are digitally signed with 
approved certificates, thereby allowing non-admins the ability to apply 
configuration files while on the road beyond our reach. It constrains 
what the user can do to what we distribute. The theory is, if we do our 
job correctly the user cannot hurt themselves. So far so good.


Patrick Fogarty


Jason A. Donenfeld wrote on 11/20/2020 7:52 AM:
> Hi Patrik,
>
> Why not provision the config for the users when you're provisioning
> the rest of the machine for their ownership?
>
> Jason
>