ekoby

In this blog article we show how we embedded OpenZiti SDK to secure monitoring collection with beats/logstash

The good news is you don't have to stand up your OpenZiti network to try it out.

We have Ziti Edge Developer Sandbox (ZEDS) https://zeds.openziti.org exactly for this reason. It is a simple way to try OpenZiti, and exercise OpenZiti SDKs.

This is a pretty accurate description of OpenZiti.

The incremental approach is something that many of our customers go through: start with tunneling agents (quick and low investment), then transition to application embedded solutions

at this time OpenZiti connection are guaranteed-delivery (like TCP). We are evaluating offering lossy connections in the future.

At the edges connection are always outbound and are seen as mTLS to the firewalls. the application payloads are end-to-end encrypted (using libsodium) an d transferred inside mTLS channels

Absolutely, from your application's view it is just a socket that can live and be used to send/receive data indefinitely

there are significant differences from libp2p:

* strong identity support: authenticate before connect

* it is service oriented vs point-to-point

We would love for you to try OpenZiti it give us feedback :)

> Also what the threat model is, and how ziti solves it.

Your service (anything that accepts incoming connections) is never exposed to open internet. any incoming connections are guaranteed to be from authenticated and authorized clients.

> I assume it does little to thwart traffic analysis?

It does -- the traffic is routed throw OpenZiti fabric.

> Does it suffer from tcp-over-tcp problems?

OpenZiti is not a VPN and it does not forward network packets. In application embedded cases payload is end-to-end encrypted and forwarded on overlay network.

> Would be fair to say it's similar to a private Tor network with hidden services - but without anonymity and (probably much) higher throughput?

I believe that is a fair comparison, except anonymity is replaced with strong identity support to allow configuration of authorization policies.

I am not deeply familiar with nats.io, so I could be wrong in my comparisons.

OpenZiti is a connection-oriented overlay network vs NATS a messaging system.

OpenZiti SDKs are more easily embeddable in existing applications as it does not require changes in networking semantics.

In the simplest terms, it's an application embedded VPN (on both client and server)

The SDK allows you to integrate OpenZiti directly into your applications so that it can access network resources securely from anywhere in the world. This is based on strong identity so that the overlay cannot be access by untrusted endpoints. This is ensuring your application has zero trust in the network, WAN, LAN and even host OS - in fact, your app does not even need to know the IP and port to communicate with on the underlying host.

Comparing to traditional VPNs this solution is a lot more secure -- instead giving you access to internal network, OpenZiti gives you access to specific service endpoints.

funny you should mention this, here is another post covering exactly that: https://news.ycombinator.com/item?id=32924212

I am happy to introduce OpenZiti Python SDK.

It allows you to:

* embed zero trust secure networking right into your Python application

* run your Python services without any open network ports.

Powered by: https://github.com/openziti/ziti

there are few things that improve your defense posture:

- DDOS attacks can only attack the fabric and not the business logic service. Fabric nodes can be easily moved around or added to change attack surface.

- you can have multiple services hidden and you don't have to worry about protecting them individually

- service nodes themselves can be moved around or added for redundancy without having to stand up additional protection middleware

I created this project to demonstrate the ease of embedding OpenZiti SDK in golang applications. The server is a fully functional MQTT server listening on the overlay network without any open listening ports. The client can be used for testing.