:Celeste_transbian: flori_ava_star:~:cursor_blinking::badge-petting-encouraged: :badge-biting-allowed: (@star)

I would love to know the opinions of network enthusiasts on NetBird, Pangolin and whether there are perhaps even better ways to do resource access management, zero trust and so on

@star @femsci

speaking for my own infrastructure i generally dont want to rely on anything that considers itself a marketable product rather than a technology of the public

i've heard about netbird before but never tried it, though from the fact that it calls itself a "wireguard-based overlay network" it is already hinting at the fact that it is indeed not zero trust

here they do a very poor job at explaining what zero trust is, and how it's supposed limitations affect their product
netbird.io/knowledge-hub/open-source-zero-trust-networking

when accessing a web service for example, with an OIDC-enabled SSO that authenticates the browser session of the user, one can meaningfully restrict access to that browser. in their scenario of an employee running malware where they get pwned that is because they do the opposite of zero-trust and blindly route all network traffic to the intra-net, just because it runs on the same machine

i think this is very misleading

also lmao at these supposed network security experts telling you to install their product by running a curl pipe bash command

i think what you might like is the PAM-integration of kanidm, which also does SSO-bound ssh to remote machines. ssh3 as a protocol is also very much about OIDC-integration, so this is definitely not some killer feature of netbird

i cant speak precisely about their security model because they do not seem to provide a whitepaper and only marketing pages full of buzzwords meant for executives

@alina @femsci thank you so much alinaaaa c: that's very helpful!!!!

@star From Kittens limited view they are a good way to secure selfhosted services behind a central Gateway, but Kittens experience stems from experimenting with stuff for maybe three quarters of a year.
So far Kitten only had a reverse Proxy in front of her services, all services behind an SSO and tailscale for stuff, that should only be reachable by VPN.
Pangolin and Netbird seem to combine reverse Proxy and VPN. From what Kitten gathered Netbird was similar to Tailscale before and only recently tried to be an all in one Gateway. Pangolin tried this approach from the very start and seems more focused on community than Netbird.
There is an Enterprisr version of Pangolin, but you get a Key for free if your revenue is below a threshold or if you don't make any money with it.

One thing to note though: Kitten didn't get around to trying netbird or Pangolin yet and only wants to use any of it for Services and not machines for ssh.

@Lilith_demon_blood Thank you soooooooooo much lilith!!!

very nice of you !!!

@star Always glad to help, especially when it's also one of kittens special interests

Not only that but Kitten wants to set up something like this this year, when she has enough money for a vps, so the knowledge is pretty fresh.