I know how to AllowPublicKeys on the laptop version but how do I restrict access similarly to only specific public keys on the Android APK version?

[621625]

I know how to AllowPublicKeys on the laptop version but how do I restrict access similarly to only specific public keys on the Android APK version?

[neilalexander]

The Android app doesn't support incoming listeners so it wouldn't really do anything.

[621625]

But I can connect to my Android device from another remote unit using Yggdrasil it seems. Shouldn't there be a way to allow only specific public keys to connect considering this?

[neilalexander]

That's not what AllowedPublicKeys does. It controls who can establish an inbound peering connection. It does not control who can reach your device over the Yggdrasil Network.

[621625]

I think generally speaking the users believe and for good reasons that when we set AllowedPublicKeys those are the only ones that can establish an SSH connection or VPN connection to the computer for example. Otherwise it's kind of misleading. For example I have seen at least one other user being happy that it's so easy to make access control and a popular LLM also believes that is how to set access control.

[neilalexander]

Honestly I have toyed with the idea of removing the AllowedPublicKeys option altogether, mostly because as you have pointed out, it is not really clear what it does. (Well, more that the distinction between peering connections and actual Yggdrasil traffic is very fuzzy for many users.)

The main point though is that Yggdrasil does not embed a firewall, so if you want to truly control access to your Yggdrasil IPv6 address, then you need an IPv6 firewall to do so.

We might change things up a bit in v0.6 to make it easier to have a closed-loop setup, whereby only devices with a shared password or so can communicate with each other, but we haven't finalised what that might look like yet.

[621625]

For starters and at the very least please update the comment section of the config file so it is very clear that AllowedPublicKeys does not do what people think it does.

[neilalexander]

Did the other day: yggdrasil-network/yggdrasil-go@ff0ef7f