tinc - Aug 2015 - multiple nodes/servers

Greetings, I hope this message finds you well?

First off, thank you for a great product. 

Is it possible to generate one key pair? This way I only have to copy one set of
files over to the nodes. For instance I have roughly 50 machines that I need in
the mesh network. I want to be able to create 1 master key pair and distribute
that master key pair to all the nodes. This way the nodes can all communicate
and I do not have to waste time building 50 keys and transferring those 50 keys
back and forth allowing the nodes to communicate with each other.

Thank you in advance for your time. 

Bo

Hi.

In general, you don't need to have 50 keys in /etc/tinc/hosts.

In default Mode you can have nodes A, B, C and X, Y, Z.
Node A have keys from B, C and X, and node X have keys from Y, Z and A.

In that case node B can work with node Z without distributing keys between
them.

You can read about modes in tinc manual -
http://tinc-vpn.org/documentation-1.1/Main-configuration-variables.html#Main-configuration-variables

If you want to use only one key pair, it should work. You just need to set
right filename for public key file on each node. And probably edit
variables in this file - Subnet, for example.
But in my opinion, it is damn bad practice.


On Mon, Aug 17, 2015 at 7:03 PM, bo Morris <bo at bomorris.com> wrote:
> Greetings, I hope this message finds you well?
>
> First off, thank you for a great product.
>
> Is it possible to generate one key pair? This way I only have to copy one
> set of files over to the nodes. For instance I have roughly 50 machines
> that I need in the mesh network. I want to be able to create 1 master key
> pair and distribute that master key pair to all the nodes. This way the
> nodes can all communicate and I do not have to waste time building 50 keys
> and transferring those 50 keys back and forth allowing the nodes to
> communicate with each other.
>
> Thank you in advance for your time.
>
> Bo
> _______________________________________________
> tinc mailing list
> tinc at tinc-vpn.org
> http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
>


-- 
brgds
Maxim Vorontsov
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20150818/de5d4c6a/attachment.html>

Hi,
> Is it possible to generate one key pair?
Maybe this is all you want to know?
 openssl genrsa -out private.key 4096
 openssl rsa -pubout -in private.key -out public.key

I assume that you analyzed the risks and benefits of a single shared key
according to your specific setup.

Lars

Thank you Lars for the reply. Your instructions were dead on. 

Yes I have considered the security risks; however, I think scaleability and
rapid deployment out weigh the security risks for me.


On Aug 18, 2015, at 6:31 AM, Lars Kruse <lists at sumpfralle.de> wrote:
> Hi,
> 
>> Is it possible to generate one key pair?
> 
> Maybe this is all you want to know?
> openssl genrsa -out private.key 4096
> openssl rsa -pubout -in private.key -out public.key
> 
> I assume that you analyzed the risks and benefits of a single shared key
> according to your specific setup.
> 
> Lars
> _______________________________________________
> tinc mailing list
> tinc at tinc-vpn.org
> http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc