[HN Gopher] Ask HN: I built a Yubikey-based domain controller. I...
___________________________________________________________________
Ask HN: I built a Yubikey-based domain controller. Is it sellable?
I once worked in R&D where our competitive advantage was in keeping
our customer relationships and intellectual property private, so we
kept everything on-prem. No cloud, no SaaS, no WFH. In my own SMB,
I still self-host git, CI, chat, etc. I love the privacy and
control, but I also needed to open these services to remote workers
without exposing them to the world. So I built an appliance to
protect my internal web apps by requiring user/pass+yubikey at
multiple layers of the stack: L3 (p2p vpn), L4 (mTLS), and L7
(OIDC). The appliance is self contained (VPN, LDAP, NTP, CA, OIDC),
like a classic domain controller, and it keeps servers safe from
any users without an authorized hardware key. I'd love to bundle
this with an admin panel and sell it, but I forsee problems
connecting with the right market: * Clients who have meaningful IT
budgets will require inter-operation with their legacy domain
controllers. This means I won't have an MVP without major changes
and lots of testing. It also puts my own product at risk: if
Microsoft doesn't want to support my integrations, they can disable
my product with a software update. * Clients who are too small to
have lots of legacy IT requirements will have small budgets and
require lots of support. Some of these clients will grow larger,
but this is a long game. I would love to support these clients but
don't want to die for lack of revenue in the short term. How would
you sell what I've built?
Author : elevation
Score : 49 points
Date : 2024-07-22 18:07 UTC (1 days ago)
| brudgers wrote:
| > I forsee problems connecting with the right market
|
| Finding the right market is hard work and consists entirely of
| rejection until you find it and entirely of rejection if you
| don't.
|
| > * Clients who have meaningful IT budgets...
|
| > * Clients who are too small...
|
| Selling is hard work and mostly or entirely rejection. Finding
| reasons not to sell is much easier and avoids the hard work and
| the psychological tolls of rejection.
|
| > How would you sell what I've built?
|
| One customer at a time. That's how selling is.
|
| On a brighter note. Hardware is a useful abstraction. Customers
| with big budgets will pay handsomely for annual service contracts
| and you can fly out in business class, stay in a nice hotel and
| markup the cost 25% in the materials section of your time-and
| materials invoice.
|
| Good luck.
| ac2u wrote:
| Nothing is impossible, so best of luck to the OP, but to add to
| the above, the kind of clients with the budget for your
| solution might also be the kind where their legal department
| requires that you have audited compliance procedures for
| various certs. It sounds like you design your solutions with
| the tech work for that already in mind, but it's something that
| needs extended to the paperwork side of things to get past the
| gatekeepers
| candiddevmike wrote:
| I'm not sure I understand the product. It kind of sounds like a
| zero trust VPN, but you're calling it a domain controller which
| has a different real world use case--does your product actually
| function as a Windows DC?
|
| What use case + benefit would folks have using this? Why should
| they trust you?
| elevation wrote:
| I call it a "domain controller" because it keeps a directory of
| users and hosts, accessible via LDAP. This source of truth
| drives the Certificate Authority role which can
| cryptographically assert authn/authz and distribute those
| assertions to member hosts in the form of certificates,
| password hashes, etc. A DC may also securely distribute time to
| its hosts, which is important for accurately calculating the
| validity of a certificate.
|
| A classic DC would authenticate windows logins and rely on an
| external network. My design authenticates just TLS and web-app
| logins (not windows) but also provides an authenticated layer 3
| network. So it's hardware-attested zero trust -- something
| that's difficult to securely assemble out of existing SaaS.
|
| This would be overkill for a typical call center (large scale,
| high churn, low trust) but perfect for a team working on
| sensitive IP (smaller scale, low churn, high trust.) Research
| and development, administrating expensive systems (regional
| manufacturing?) or for collaborative work on sensitive
| documents (legal?)
| beardedwizard wrote:
| Isn't this an idp? I'm totally unclear how this is
| differentiated from an idp that also requires a hardware key.
| elevation wrote:
| It _has_ an IdP, but you have to be authenticated at a
| lower layer in the stack before you can talk to it.
|
| Think Tailscale+Let's Encrypt+Okta but all in a single
| package.
| rblatz wrote:
| Look into products like okta, they have similar
| functionality. They also sync data from AD. I'd focus on not
| providing the LDAP management, but instead syncing other LDAP
| sources in.
| SCHiM wrote:
| Even big customers have a use for what you've built in high
| security areas they might have. Think swift alliance servers in a
| specialized network segment in financials, or perhaps sensitive
| medical information in health care?
|
| I think you should not have any issues integrating with legacy
| AD, but know bigger enterprises have mostly moved to online IdPs.
| Integrating with legacy AD will make your product also likely
| less secure. Maybe not the way to go?
| ericjmorey wrote:
| For anyone else wondering what IdPs are:
|
| > What is an identity provider (IdP)? > > An identity provider
| (IdP) is a service that stores and verifies user identity. IdPs
| are typically cloud-hosted services, and they often work with
| single sign-on (SSO) providers to authenticate users.
|
| Read a full explanation at:
| https://www.cloudflare.com/learning/access-management/what-i...
| whalesalad wrote:
| There is a market for small businesses who do not want to buy in
| to the Azure/O365 ecosystem but need a domain controller
| appliance that is easy to setup and maintain, and will offer VPN
| connectivity to access central resources.
| elevation wrote:
| It's affirming to hear of businesses with a similar
| disposition. I expect many will be rightly skeptical of an
| upstart vendor, but this just means establishing the brand for
| a few years will have its own dividends.
|
| I also hope to evangelize the mentality a bit more. Making the
| technical approach more feasible for non tech companies could
| be a boon.
| jmole wrote:
| Think about a company like ADT - they are selling security
| systems, but the people who really really need security (large
| clients with large IT budgets) would never buy an ADT system.
|
| So like it or not, you're going to be going door to door and
| helping smaller clients integrate this into their systems.
|
| I think the right way to approach this would be to better
| understand the problems your clients would face when trying to
| integrate this kind of system, and then figure out how to solve
| them at scale in a way that you make customer acquisition and
| onboarding easier in the future.
|
| Maybe it's things like creating base docker images for common
| services or OS pairings that have your stack already integrated.
| Maybe it's turnkey integrations with existing cloud identity
| providers or SSO. Maybe it's tailscale integration.
|
| In fact tailscale is probably a good model to look at here - no
| large organization with an existing VPN solution is moving to
| tailscale, or at least weren't when they first started. But
| tailscale made a hard thing easy, and that's exactly what you're
| doing here.
| nyrikki wrote:
| Physical security is probably a bad example, when people need
| physical security they end up calling installers. ADT got where
| they are by making their installers lives easier, and make it
| easier to find those installers.
|
| I am not the market for the OP. Because I want the ability to
| change MFA vendors or federate, but the strategies of non-
| software companies is much different IMHO.
| elevation wrote:
| What other MFA vendor would you go with? For my own business
| continuity it might make sense to white-label both yubikeys
| and an alternative vendor, but Yubico seems to have the best
| product unless you're wanting to push MFA to user's phones.
| packetlost wrote:
| Tailscale is a good model for software businesses in general
| IMO, but they also have another clear advantage over some
| project like this: they focus on exactly one thing and do it
| exceptionally well. There's _probably_ a (small) market for
| out-of-the-box stuff like this, but I 'd imagine it has got to
| be pretty small.
| tomnil wrote:
| Get in touch with Yubico
| pcl wrote:
| Perhaps see if you can put together a department-focused bundle
| -- something that can coexist with corporate VPN but be used for
| a 50-300 person team's needs. Plenty of big orgs have small-
| company-scaled deployments within disparate teams, and they often
| have terrible security / compliance / access policies for some
| time until they reach a certain scale.
| dheera wrote:
| > safe from any users without an authorized hardware key
|
| If you do this, make sure you support multiple hardware keys.
|
| Single Yubikey and no backup is not safe, since the key can be
| lost or damaged easily.
|
| Single Yubikey and SMS backup or "contact customer service to
| reset" backup is NOT secure, as it reduces your security to that
| of SMS or the CS rep.
| elevation wrote:
| I'd considered allowing users to provision a additional keys
| for backup, but only allowing one active key at any given time.
|
| If the active key is lost/destroyed, a self-serve portal allows
| them to disable their active key at any time. But activating a
| backup key would require a (different) administrator's
| approval.
| dheera wrote:
| That isn't a good workflow, in case the first administrator
| is sick or hospitalized and the second administrator needs to
| access it temporarily and is not in the same city.
|
| Also, I tend to leave Yubikeys permanently plugged into
| devices (1 per device) and register all the devices I have
| (4+) with every service. If any device is lost I would just
| login with another device disable that key. I also don't
| usually travel with keys unless I'm travelling with a
| portable device. When I move between two fixed desktops both
| in secured locations, the two desktops just have permanently-
| installed keys, I do not carry a key between them as walking
| around with a key is a liability.
| elevation wrote:
| Thanks for this feedback. I'll make sure to support
| multiple active keys as well.
| elevation wrote:
| I want hardware attestation to be first-class, and not an
| afterthought. Since I'm integrating everything I can support a
| top-notch "lost key recovery" flow, whatever the requirements
| are.
| internet101010 wrote:
| Yeah I have been sim swapped and can confidently say that SMS
| is not a valid form of 2FA.
| mooreds wrote:
| No substitute for talking to potential customers. Find some and
| ask them about their problems. Don't build the admin panel, but
| you can mock it up so that people have a better understanding.
|
| How would you find some people who might be interested? This is
| the crux of marketing!
|
| * find communities where such folks might hang out. This includes
| looking at places where self hosting is big (reddit, here,
| slacks, discords). Read stuff. If there's commercial channel,
| post there but respect the community.
|
| * find in-person folks to talk to. local linux group meetups,
| local security meetups, etc.
|
| * look up anyone on linkedin or in your work network and ask for
| 15 minutes of their time to get ideas on who might be interested
| in talking to you about this product. Stick to the 15 minutes,
| though.
|
| * do some google searches that your potential customers might
| perform. From your description, I'm not sure I'd use the term
| "domain controller". Seems more like an app gateway or smart
| proxy instead. See who else is out there and who their customers
| are.
|
| * searching might also turn up some communities for you to join.
|
| * build a landing page explaining your product (as it will be).
| Add a mailing list. See if you can get anyone to sign up.
|
| * You could buy some ads to drive folks to the landing page too.
| Use the same keywords you wanted to use. Set a limit as Google is
| happy to take your money.
|
| * if you have more time than money, write up a few articles about
| building this, publish and share them. This sounds like a great
| topic for HN. Make sure you link to the landing page.
|
| It's not easy, and this is why there are entire marketing and
| sales departments.
|
| This post is a good overview too:
| https://www.kalzumeus.com/2013/04/24/marketing-for-people-wh...
|
| Here's some classic patio11 wordplay.
|
| > The other way I did, was I went home to Chicago, which is where
| my family is from, and took out $400 from an ATM, and walked
| around downtown Chicago and looked for salons and other massage
| therapists, that sort of thing.
|
| > I walked in and said, "Hey, do you take walk-ins?" "Yeah." "Are
| you free right now?" "Yeah." "Are you the business owner?"
| "Yeah." "OK, I've got a weird proposition for you," and no, not
| that kind of weird.
|
| > "What's the rate on a 30-minute shoulder massage?" She would
| tell me. It's almost always a she. I would say, "OK, I'm going to
| pay you the rate for a 30-minute shoulder massage, but what I'm
| really interested in, I'm a small businessman, I live in Japan,
| I'm interested in the business of massage therapy. How about we
| just skip to that post-massage cup of tea that you're going to
| offer me," I have learned this over the years. "Skip to the cup
| of tea, I'm going to pick your brains about how you run your
| business, and then I'll go, no massage needed, and you get your
| money?" Almost everybody took me up on that, and nobody called
| the police. Yay.
| CodeWriter23 wrote:
| Sounds like you solved a lot of problems. I'd probably give up
| folding money for a DC with RADIUS solution that didn't require
| me to rip hair out to renew the 802.1X certs for our WiFi auth
| every year.
| elevation wrote:
| Is the problem more in generating the certificates? Or in
| getting them uploaded into the controller?
|
| I'd seriously started to look into 802.1X but in the "remote
| work" use case, L2 protection doesn't buy you much because
| outside your building, an attacker can get L2 access at
| Starbucks. It seemed like a good feature to leave out of the
| MVP -- but now I'm wondering if it wouldn't be worth
| prioritizing.
| packetlost wrote:
| It was already asked, but I'm curious what the actual
| difficulty is with rotating certificates? Do the clients need
| certificates issued? Uploading the chain/authenticating
| certificate to the authenticator?
| lijok wrote:
| If you're able to disable user+pass requirement and only require
| a yubikey for auth, i'd like to buy this. My email is in my
| profile.
| cdchn wrote:
| Is using on-prem instead of cloud/SaaS a "competitive advantage?"
| ThreatSystems wrote:
| If you want to integrate this into Windows AD look at ADFS[1] and
| MSAL[2]. Pretty much can give you OIDC from AD, but you'll have
| to deal with Microsoft licencing :D.
|
| [1] https://learn.microsoft.com/en-us/windows-
| server/identity/ad... [2] https://learn.microsoft.com/en-
| us/entra/identity-platform/ms...
| doctorpangloss wrote:
| > How would you sell what I've built?
|
| It's interesting. You have built something tightly coupled ("like
| a classic domain controller") but then it is interacting with
| inspecific, totally decoupled stuff ("(p2p vpn), L4 (mTLS), and
| L7 (OIDC)").
|
| "Tightly coupled for me, but not for thee" - why would someone
| who has adopted a decoupled application infrastructure decide
| that their domain controller should be coupled? I feel like
| people want one or the other in totality, they are either
| completely a Windows shop, or they are completely using bits and
| pieces of everything from everywhere. Everyone in between is
| ultimately migrating to one end or the other.
|
| I can't speak for how to sell something I've never used. But I
| know Okta is very popular, and I encounter many IT people in many
| tech forums basically describe a feature of Okta. That's a huge
| scope. But that's a company that has tackled the dichotomy of
| coupled versus decoupled solutions, by simply providing
| everything. Is there a little bit of a chance that a single
| person can make something competitive with Okta? Yes!
| oneplane wrote:
| I wouldn't sell it for two reasons:
|
| 1. The market that needs this will not be capable to use it
|
| 2. The market that is capable to use it is also capable to use
| something like Cloudflare Access.
|
| As for 'domain controller', like others have posted, that is a
| product or branded product from microsoft that doesn't have much
| to do with what you described. You could argue that Microsoft
| Windows Server can host most of those services, and will likely
| need a Microsoft Active Directory service (which in turn requires
| at least one Active Directory Domain Controller), it's not really
| related to what you are doing besides perhaps a user directory.
|
| In a way, your product would address the classic setup that
| Microsoft (and Apple) have thrown away (many) years ago,
| companies are very bad at IT, and it gets worse as you focus on
| smaller companies and companies where IT is rather far removed
| from their core business. Something that is managed and
| maintained by someone else, that is where the money is, and in
| almost all cases that means the services and applications are not
| co-located in some office somewhere, mostly because the office is
| pretty much irrelevant these days.
| ggernov wrote:
| I'd buy this as a one time payment for my homelab.
| TheRealPomax wrote:
| Start but not claiming it's yubikey-based, and instead phrase
| your product in terms of what _category_ of dependency it has.
| You built a hardware authenticator based product, and yubikeys
| are just one example of the kind of hardware authenticator it
| works with.
|
| _Even if it 's currently the only one it works with_.
| lifeisstillgood wrote:
| 1. This is a reseller opportunity - teach small ISVs what is
| under the hood, why it's smaller cleaner better
|
| 2. Linked to the above, this is not a competitor to Active
| Directory. It's the antithesis. It's not for a small office of
| PCs on desktops. It's to properly secure IoT devices in different
| locations - sensors, telemetry that niche businesses sell - they
| sell the service that the device provides, and want a reliable
| small footprint security solution. Maybe you are it
___________________________________________________________________
(page generated 2024-07-23 23:04 UTC)