Securing XMPP

Aim: Encrypt All XMPP Connections

This page provides instructions for XMPP server administrators to secure XMPP client and server connections ready for the following ubiquitous encryption manifesto test days:

• January 4, 2014 - first test day requiring encryption
• February 22, 2014 - second test day
• March 22, 2014 - third test day
• April 19, 2014 - fourth test day
• May 19, 2014 - permanent upgrade to encrypted network

To achieve this, we need to:

• encrypt connections between clients and servers (c2s)
• encrypt server to server connections (s2s)

Step1: Get a server certificate

Let's say you run an XMPP service for example.com (jids of user@example.com), you will need to order a certificate for with a subject or alt-name of example.com (not servername.example.com) from your preferred cert provider (StartSSL offers free certificates and is quite good)

Step 2: Configure your DNS

Ensure that the following DNS records are set:

_xmpp-server._tcp.example.com. 18000 IN SRV 0 5 5269 servername.example.com. 
servername.example.com.        18000  A 10.10.10.10 # you must have an A record for your server

You can test your DNS setup at xmpp.net

Step 3: Only permit encrypted connections

eJabberd

Configure ejabberd.conf

% Ordinary client-2-server service
[{5222, ejabberd_c2s, [{access, c2s},
starttls_required, {certfile, "/etc/ssl/certs/ejabberd.pem"},
{shaper, c2s_shaper}]},
% Use STARTTLS+Dialback for S2S connections
{s2s_use_starttls, true}.
{s2s_certfile, "/etc/ejabberd/ejabberd.pem"}.

Prosody

Ensure that prosody.cfg.lua contains the following settings in the global section of your config, or under the specific VirtualHost you want to secure:

 c2s_require_encryption = true
 s2s_require_encryption = true

Further help:

• Chatroom: prosody@conference.prosody.im
• Documentation: Prosody.IM: Security

Tigase

See http://www.tigase.org/content/vhost-tls-required for more details

--vhost-tls-required = true

By default Tigase will read VHosts certificates from certs/ subdirectory match domain name against .pem filename of the certificate. Alternatively configuration for particular vhost certificate could be specified explicitly in init.properties:

basic-conf/virt-hosts-cert-<domain>=path/to/cert.pem

• TLS for s2s connection is enabled by default; no option to configure it as required (certain domains can be configured to skip TLS for s2s with following configuration. For more information: --s2s-skip-tls-hostnames):

--s2s-skip-tls-hostnames = domain1,domain2

Openfire

???