need to add something...
An XMPP Server is considered secure when the following (minimum) items are present:
- The server is running with a server certificate
- The server is configured to not allow any cleartext communications - S2S and C2S
- The server supports XEP-198
Step1: Get a server certificate
Let's say you run an XMPP service for
example.net (jids of email@example.com), you will need to order a certificate for with a subject or alt-name of
server.example.net) from your preferred cert provider. The certificate should also include alt-names for subomains such as
conference.example.net, at least for services that should be accessible to remote users.
Step 2: Disable cleartext connections
These instructions will disable any cleartext communication between servers and client connections.
Make sure that your ejabberd.yml contains the following settings.
- For ejabberd >= 17.12 list all available PEM files in this top-level option
certfiles: - "/etc/ejabberd/*.pem"
- For client-to-server connections:
listen: - port: 5222 module: ejabberd_c2s starttls_required: true # For ejabberd < 17.12 # certfile: "/etc/ejabberd/certificate.pem"
- For server-to-server connections:
s2s_use_starttls: required # For ejabberd < 17.12 # s2s_certfile: "/etc/ejabberd/certificate.pem"
- Homepage: ejabberd IM
- Chatroom: firstname.lastname@example.org
- Documentation: ejabberd Installation and Operation Guide
Prosody is aiming to be secure by default, as of version 0.12.x no changes to the default configuration is required to enable or enforce encrypted connections.
- Homepage: Prosody IM
- Chatroom: email@example.com
- Documentation: Prosody.IM: Security
In Metronome's latest development tip, encryption requirement is the default setting, as long as TLS capability is available, and no configuration change is needed. Otherwise ensure that metronome.cfg.lua contains the following settings in the global section of your configuration:
c2s_require_encryption = true s2s_require_encryption = true
- Homepage: Metronome IM
- Chatroom: firstname.lastname@example.org
- Documentation: metronome.im/documentation
See http://www.tigase.org/content/vhost-tls-required for more details:
--vhost-tls-required = true
By default Tigase will read VHosts certificates from certs/ subdirectory match domain name against .pem filename of the certificate. Alternatively configuration for particular vhost certificate could be specified explicitly in init.properties:
TLS for s2s connection is enabled by default; no option to configure it as required (certain domains can be configured to skip TLS for s2s with following configuration. For more information: --s2s-skip-tls-hostnames):
--s2s-skip-tls-hostnames = domain1,domain2
In order to have improved security Tigase features "hardened mode" which turns off workaround for SSL issues, turns off SSLv2, forces enabling more secure ciphers suites and also forces requirement of StartTLS.
- Homepage: Tigase.org
- Documentation: Admin guide
- Open the Openfire administration console
- Go to Server Settings under Server
- Then open Security Settings in the list to the left
- Check both radiobuttons labeled Required
- Check the checkbox marked Accept self-signed certificates
- Homepage: Openfire
- Chatroom: email@example.com
- Documentation: Openfire documentation
Step 3: Check your XMPP Server Security
Test your XMPP security to be sure.
Encryption Manifesto (archived)
Aim: Encrypt All XMPP Connections
This page provides instructions for XMPP server administrators to secure XMPP client and server connections ready for the following ubiquitous encryption manifesto test days:
- January 4, 2014 - first test day requiring encryption
- February 22, 2014 - second test day
- March 22, 2014 - third test day
- April 19, 2014 - fourth test day
- May 19, 2014 - permanent upgrade to encrypted network
To achieve this, we need to:
- Encrypt connections between clients and servers (C2S)
- Encrypt server to server connections (S2S)