Difference between revisions of "Securing XMPP"

Jump to navigation Jump to search
122 bytes removed ,  16:51, 26 December 2023
m
no edit summary
(Mention that server certificates should include SANs for subdomains.)
m
 
(2 intermediate revisions by one other user not shown)
Line 10: Line 10:


=== Step1: Get a server certificate===
=== Step1: Get a server certificate===
Let's say you run an XMPP service for <code>example.net</code> (jids of user@example.net), you will need to order a certificate for with a subject or alt-name of <code>example.net</code> (not <code>server.example.net</code>) from your preferred cert provider. The certificate should also include alt-names for subomains such as <code>conference.example.net</code>, at least for services that should be accessible to remote users.
Let's say you run an XMPP service for <code>domain.tld</code> (jids of user@domain.tld), you will need to order a certificate for with a subject or alt-name of <code>domain.tld</code> (not <code>server.domain.tld</code>) from your preferred cert provider. The certificate should also include alt-names for subomains such as <code>conference.domain.tld</code>, at least for services that should be accessible to remote users.


=== Step 2: Disable cleartext connections ===
=== Step 2: Disable cleartext connections ===
Line 42: Line 42:


==== Prosody ====
==== Prosody ====
Ensure that ''prosody.cfg.lua'' contains the following settings in the [https://prosody.im/doc/configure#overview global section] of your config, or under the specific <code>VirtualHost</code> you want to secure:
Prosody is aiming to be secure by default, as of version 0.12.x no changes to the default configuration is required to enable or enforce encrypted connections.
  c2s_require_encryption = true
  s2s_require_encryption = true


Further help:
Further help:
216

edits

Navigation menu