Difference between revisions of "Securing XMPP"

From XMPP WIKI
Jump to navigation Jump to search
m
(Mention that server certificates should include SANs for subdomains.)
 
(11 intermediate revisions by 5 users not shown)
Line 1: Line 1:
== Aim: Encrypt All XMPP Connections ==
+
== Clients ==
 +
need to add something...
 +
 
 +
== Servers ==
 +
An XMPP Server is considered secure when the following (minimum) items are present:
 +
* The server is running with a server certificate
 +
* The server is configured to not allow any cleartext communications - S2S and C2S
 +
* The server supports XEP-198
 +
* ...
 +
 
 +
=== Step1: Get a server certificate===
 +
Let's say you run an XMPP service for <code>example.net</code> (jids of user@example.net), you will need to order a certificate for with a subject or alt-name of <code>example.net</code> (not <code>server.example.net</code>) from your preferred cert provider. The certificate should also include alt-names for subomains such as <code>conference.example.net</code>, at least for services that should be accessible to remote users.
  
This page provides instructions for XMPP server administrators to secure XMPP client and server connections ready for the following [https://github.com/stpeter/manifesto/blob/master/manifesto.txt ubiquitous encryption manifesto] test days:
+
=== Step 2: Disable cleartext connections ===
* January 4, 2014 - first test day requiring encryption
+
These instructions will disable any cleartext communication between servers and client connections.
* February 22, 2014 - second test day
 
* March 22, 2014 - third test day
 
* April 19, 2014 - fourth test day
 
* May 19, 2014 - '''permanent upgrade''' to encrypted network
 
  
To achieve this, we need to:
+
==== ejabberd ====
* Encrypt connections between clients and servers (C2S)
+
Make sure that your ''ejabberd.yml'' contains the [http://docs.ejabberd.im/admin/guide/configuration/#listening-ports following settings].
* Encrypt server to server connections (S2S)
 
  
== Step1: Get a server certificate==
+
* For ejabberd >= 17.12 list all available PEM files in this top-level option
Let's say you run an XMPP service for <code>example.net</code> (jids of user@example.net), you will need to order a certificate for with a subject or alt-name of <code>example.net</code> (not <code>server.example.net</code>) from your preferred cert provider ([http://startssl.com/ StartSSL] offers free certificates and is quite good).
+
certfiles:
 +
  - "/etc/ejabberd/*.pem"
  
== Step 2: Disable cleartext connections ==
+
* For client-to-server connections:
These instructions will disable any cleartext communication between servers and client connections.
+
listen:
 +
  -
 +
    port: 5222
 +
    module: ejabberd_c2s
 +
    starttls_required: true
 +
    # For ejabberd < 17.12
 +
    # certfile: "/etc/ejabberd/certificate.pem"
  
=== ejabberd ===
+
* For server-to-server connections:
Configure ejabberd.conf
+
  s2s_use_starttls: required
% Ordinary client-2-server service
+
  # For ejabberd < 17.12
  [{5222, ejabberd_c2s, [{access, c2s},
+
  # s2s_certfile: "/etc/ejabberd/certificate.pem"
  starttls_required, {certfile, "/etc/ssl/certs/ejabberd.pem"},
 
{shaper, c2s_shaper}]},
 
% Use STARTTLS+Dialback for S2S connections
 
  {s2s_use_starttls, required}.
 
{s2s_certfile, "/etc/ejabberd/ejabberd.pem"}.
 
  
 
Further help:
 
Further help:
* Homepage: [http://ejabberd.im/ ejabberd.im]
+
* Homepage: [https://www.ejabberd.im/ ejabberd IM]
* Chatroom: [xmpp:ejabberd@conference.jabber.ru?join ejabberd@conference.jabber.ru]
+
* Chatroom: [xmpp:ejabberd@conference.process-one.net?join ejabberd@conference.process-one.net]
* Documentation: [http://www.process-one.net/docs/ejabberd/guide_en.html ejabberd Installation and Operation Guide]
+
* Documentation: [http://docs.ejabberd.im/admin/guide/ ejabberd Installation and Operation Guide]
  
=== Prosody ===
+
==== Prosody ====
 
Ensure that ''prosody.cfg.lua'' contains the following settings in the [https://prosody.im/doc/configure#overview global section] of your config, or under the specific <code>VirtualHost</code> you want to secure:
 
Ensure that ''prosody.cfg.lua'' contains the following settings in the [https://prosody.im/doc/configure#overview global section] of your config, or under the specific <code>VirtualHost</code> you want to secure:
 
   c2s_require_encryption = true
 
   c2s_require_encryption = true
Line 43: Line 51:
 
* Documentation: [https://prosody.im/doc/security Prosody.IM: Security]
 
* Documentation: [https://prosody.im/doc/security Prosody.IM: Security]
  
=== Metronome ===
+
==== Metronome ====
 
In Metronome's latest development tip, encryption requirement is the default setting, as long as TLS capability
 
In Metronome's latest development tip, encryption requirement is the default setting, as long as TLS capability
 
is available, and no configuration change is needed. Otherwise ensure that ''metronome.cfg.lua'' contains the
 
is available, and no configuration change is needed. Otherwise ensure that ''metronome.cfg.lua'' contains the
Line 51: Line 59:
  
 
Further help:
 
Further help:
* Homepage: [http://www.lightwitch.org/metronome Metronome IM]
+
* Homepage: [https://metronome.im Metronome IM]
 
* Chatroom: [xmpp:grimoire@muc.metronome.im?join grimoire@muc.metronome.im]
 
* Chatroom: [xmpp:grimoire@muc.metronome.im?join grimoire@muc.metronome.im]
* Documentation: [http://www.lightwitch.org/metronome/documentation lightwitch.org/metronome/documentation]
+
* Documentation: [https://metronome.im/documentation metronome.im/documentation]
  
=== Tigase ===
+
==== Tigase ====
 
See http://www.tigase.org/content/vhost-tls-required for more details:
 
See http://www.tigase.org/content/vhost-tls-required for more details:
 
  --vhost-tls-required = true
 
  --vhost-tls-required = true
Line 65: Line 73:
 
  --s2s-skip-tls-hostnames = domain1,domain2
 
  --s2s-skip-tls-hostnames = domain1,domain2
  
In order to have improved security Tigase features [http://www.tigase.org/content/hardened-mode 'hardened mode'] which turns off workaround for SSL issues, turns off SSLv2, forces enabling more secure ciphers suites and also forces requirement of StartTLS.
+
In order to have improved security Tigase features "[http://www.tigase.org/content/hardened-mode hardened mode]" which turns off workaround for SSL issues, turns off SSLv2, forces enabling more secure ciphers suites and also forces requirement of StartTLS.
 
  --hardened-mode=true
 
  --hardened-mode=true
  
Line 72: Line 80:
 
* Documentation: [http://www.tigase.org/admin-guide Admin guide]
 
* Documentation: [http://www.tigase.org/admin-guide Admin guide]
  
=== Openfire ===
+
==== Openfire ====
 
# Open the Openfire administration console
 
# Open the Openfire administration console
 
# Go to '''Server Settings''' under '''Server'''
 
# Go to '''Server Settings''' under '''Server'''
Line 85: Line 93:
 
* Documentation: [http://igniterealtime.org/projects/openfire/documentation.jsp Openfire documentation]
 
* Documentation: [http://igniterealtime.org/projects/openfire/documentation.jsp Openfire documentation]
  
== Step 3: Check your XMPP Security ==
+
=== Step 3: Check your XMPP Server Security ===
 
[http://xmpp.net/ Test your XMPP security] to be sure.
 
[http://xmpp.net/ Test your XMPP security] to be sure.
 +
 +
= Encryption Manifesto (archived) =
 +
== Aim: Encrypt All XMPP Connections ==
 +
 +
This page provides instructions for XMPP server administrators to secure XMPP client and server connections ready for the following [https://github.com/stpeter/manifesto/blob/master/manifesto.txt ubiquitous encryption manifesto] test days:
 +
* January 4, 2014 - first test day requiring encryption
 +
* February 22, 2014 - second test day
 +
* March 22, 2014 - third test day
 +
* April 19, 2014 - fourth test day
 +
* May 19, 2014 - '''permanent upgrade''' to encrypted network
 +
 +
To achieve this, we need to:
 +
* Encrypt connections between clients and servers (C2S)
 +
* Encrypt server to server connections (S2S)

Latest revision as of 10:09, 29 October 2020

Clients

need to add something...

Servers

An XMPP Server is considered secure when the following (minimum) items are present:

  • The server is running with a server certificate
  • The server is configured to not allow any cleartext communications - S2S and C2S
  • The server supports XEP-198
  • ...

Step1: Get a server certificate

Let's say you run an XMPP service for example.net (jids of user@example.net), you will need to order a certificate for with a subject or alt-name of example.net (not server.example.net) from your preferred cert provider. The certificate should also include alt-names for subomains such as conference.example.net, at least for services that should be accessible to remote users.

Step 2: Disable cleartext connections

These instructions will disable any cleartext communication between servers and client connections.

ejabberd

Make sure that your ejabberd.yml contains the following settings.

  • For ejabberd >= 17.12 list all available PEM files in this top-level option
certfiles:
 - "/etc/ejabberd/*.pem"
  • For client-to-server connections:
listen:
  -
    port: 5222
    module: ejabberd_c2s
    starttls_required: true
    # For ejabberd < 17.12
    # certfile: "/etc/ejabberd/certificate.pem"
  • For server-to-server connections:
s2s_use_starttls: required
# For ejabberd < 17.12
# s2s_certfile: "/etc/ejabberd/certificate.pem"

Further help:

Prosody

Ensure that prosody.cfg.lua contains the following settings in the global section of your config, or under the specific VirtualHost you want to secure:

 c2s_require_encryption = true
 s2s_require_encryption = true

Further help:

Metronome

In Metronome's latest development tip, encryption requirement is the default setting, as long as TLS capability is available, and no configuration change is needed. Otherwise ensure that metronome.cfg.lua contains the following settings in the global section of your configuration:

 c2s_require_encryption = true
 s2s_require_encryption = true

Further help:

Tigase

See http://www.tigase.org/content/vhost-tls-required for more details:

--vhost-tls-required = true

By default Tigase will read VHosts certificates from certs/ subdirectory match domain name against .pem filename of the certificate. Alternatively configuration for particular vhost certificate could be specified explicitly in init.properties:

basic-conf/virt-hosts-cert-<domain>=path/to/cert.pem

TLS for s2s connection is enabled by default; no option to configure it as required (certain domains can be configured to skip TLS for s2s with following configuration. For more information: --s2s-skip-tls-hostnames):

--s2s-skip-tls-hostnames = domain1,domain2

In order to have improved security Tigase features "hardened mode" which turns off workaround for SSL issues, turns off SSLv2, forces enabling more secure ciphers suites and also forces requirement of StartTLS.

--hardened-mode=true

Further help:

Openfire

  1. Open the Openfire administration console
  2. Go to Server Settings under Server
  3. Then open Security Settings in the list to the left
  4. Check both radiobuttons labeled Required
  5. Check the checkbox marked Accept self-signed certificates
  6. Done!

Further help:

Step 3: Check your XMPP Server Security

Test your XMPP security to be sure.

Encryption Manifesto (archived)

Aim: Encrypt All XMPP Connections

This page provides instructions for XMPP server administrators to secure XMPP client and server connections ready for the following ubiquitous encryption manifesto test days:

  • January 4, 2014 - first test day requiring encryption
  • February 22, 2014 - second test day
  • March 22, 2014 - third test day
  • April 19, 2014 - fourth test day
  • May 19, 2014 - permanent upgrade to encrypted network

To achieve this, we need to:

  • Encrypt connections between clients and servers (C2S)
  • Encrypt server to server connections (S2S)