Ban a node from whole network about nebula HOT 5 CLOSED

Of the three, I think the third is the most feasible. It is probably not obvious from the existing (limited) documentation, but the lighthouses are outside of the trust model in a way we would like to retain. A single compromised lighthouse cannot do much to disrupt a nebula network, because they simply return answers to queries, and do not coordinate with each other at all.

As you noticed, we do have blacklisting in the config file, which would allow this to be pushed out via a config management system, and is how we use it ourselves.

The ability for a central authority to blacklist nodes is something we've considered, but that power comes with a downside, which is potential for abuse. I am not opposed to this if there is a good solution, likely involving some kind of signed CA blacklist.

from nebula.

Thanks for the quick reply!
OCSP responses are signed, we could either use Nebula CA or an independent CA for checking OCSP responses.
Let's close this issue for now, I'll get back to you with a pull request in a few month when it is time to implement this feature (if I haven't found a better workaround in the meantime of course 😄)

from nebula.

Hello! Any updates on this feature?
@goireu did you manage to find a workaround?

from nebula.

Our current workaround is a mix of short lived certificates and blacklist, nebula configuration is regularly generated and fetched from a central API.

from nebula.

I see. Thank you!

from nebula.