From 822a4b93964ea6d3a11d42380a127cd38668554d Mon Sep 17 00:00:00 2001 From: rra Date: Tue, 9 Jan 2018 12:54:21 +0100 Subject: [PATCH] updated article and config for debian stable & prosody 0.10 --- ...configuring_an_xmpp_server_prosody_0.10.md | 240 ++++++++++++++++++ ...configuring_an_xmpp_server_prosody_0.9.md} | 0 raw/downloads/prosody.cfg.lua | 7 +- 3 files changed, 244 insertions(+), 3 deletions(-) create mode 100644 raw/configuring_an_xmpp_server_prosody_0.10.md rename raw/{configuring_an_xmpp_server.md => configuring_an_xmpp_server_prosody_0.9.md} (100%) diff --git a/raw/configuring_an_xmpp_server_prosody_0.10.md b/raw/configuring_an_xmpp_server_prosody_0.10.md new file mode 100644 index 0000000..8b6fc5f --- /dev/null +++ b/raw/configuring_an_xmpp_server_prosody_0.10.md @@ -0,0 +1,240 @@ +Title: Configuring an XMPP server for secure, mobile instant messaging +Date: 2018-1-09 +Category: xmpp +Tags: xmpp, chat, guide, instant messaging, prosody +Slug: configuring-a-modern-xmpp-server +Description: Hands-on step-by-step guide that shows how to configure Prosody 0.10 for security, mobile messaging and ease of use. + +This is a guide to set up a modern XMPP server focused on security and mobile messaging. The whole guide assumes Debian stable running on the server, the fact that you will end up hosting a few of your friends and that you have some basic skills working on a linux command line. + +To make your server communicate make sure following ports are open in your firewall: + + :::console + 5222 (for client to server) + 5269 (server to server) + 5280 (default http port for prosody) + 5281 (default https port for prosody) + + +Enabling HTTPS +--- + +First we acquire a signed HTTPS-certificate via Let's Encrypt: +This is among others required for Gajim plugins to work properly; self-generated certs will not work. + +Install Certbot and get new certificates for your domain (replace myserver.org with your own): + + :::console + sudo apt-get update && sudo apt-get install certbot + certbot certonly -d muc.myserver.org -d dump.myserver.org -d myserver.org + +Should you succeed, you will be able to read something like: + + :::console + Congratulations! Your certificate and chain have been saved at + /etc/letsencrypt/live/myserver.org/fullchain.pem. Your cert will + expire on 2018-01-13. To obtain a new or tweaked version of this + certificate in the future, simply run certbot-auto again. To + non-interactively renew *all* of your certificates, run + "certbot-auto renew" + +Take note of the path where the certificate is stored as we will use it later. + +Installing and setting up MySQL as a storage back-end +--- + +First update your repositories and install MySQL + + :::console + apt-get update && apt-get install mysql-server + +Run mysql as the root user: + + :::console + mysql -u root -p + +In mysql: + + :::console + mysql> create database prosody; + mysql> show databases; + +Result should be something like: + + :::console + +--------------------+ + | Database | + +--------------------+ + | information_schema | + | mysql | + | performance_schema | + | prosody | + +--------------------+ + + 4 rows in set (0.00 sec) + +Create a database account for prosody + + :::console + mysql> create user prosody; + +Give the user prosody the rights to access the database, make sure to change the password and take note of it + + :::console + mysql> grant all on prosody.* to 'prosody'@'localhost' identified by 'userPassword'; + +Exit mysql: + + :::console + exit; + +Installing and configuring Prosody, the XMPP server +--- + +Install the newest version of Prosody and its dependencies from the official prosody repository: + + :::console + echo deb http://packages.prosody.im/debian $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list + + wget https://prosody.im/files/prosody-debian-packages.key -O- | sudo apt-key add - + + sudo apt get update && apt-get install prosody lua-dbi-mysql lua-zlib lua-sec + +Add the Let's Encrypt Certificates to Prosody and make sure Prosody can use them + + :::console + cp /etc/letsencrypt/live/myserver.org/*.pem /etc/prosody/certs/ + +Make sure the certificates are owned by prosody and legible only by root: + + :::console + chown -R prosody:prosody /etc/prosody/ + chmod -R 700 /etc/prosody/certs/ + +Install the newest prosody plugins: + + :::console + apt-get install mercurial + cd /usr/src + hg clone https://hg.prosody.im/prosody-modules/ prosody-modules + +Make a backup of the default prosody configuration and install [the one by the homebrewserver.club](https://homebrewserver.club/downloads/prosody.cfg.lua) + + :::console + cd /etc/prosody + cp prosody.cfg.lua prosody.cfg.lua.original + wget https://homebrewserver.club/downloads/prosody.cfg.lua + +The homebrewserver.club prosody config: + + :::console + -- a custom prosody config focused on high security and ease of use across (mobile) clients + -- provided to you by the homebrewserver.club + -- the original config file (prosody.cfg.lua.original) will have more information + + plugin_paths = { "/usr/src/prosody-modules" } -- non-standard plugin path so we can keep them up to date with mercurial + +modules_enabled = { + "roster"; -- Allow users to have a roster. Recommended ;) + "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in. + "tls"; -- Add support for secure TLS on c2s/s2s connections + "dialback"; -- s2s dialback support + "disco"; -- Service discovery + "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. + "private"; -- Private XML storage (for room bookmarks, etc.) + "vcard"; -- Allow users to set vCards + "version"; -- Replies to server version requests + "uptime"; -- Report how long server has been running + "time"; -- Let others know the time here on this server + "ping"; -- Replies to XMPP pings with pongs + "register"; --Allows clients to register an account on your server + "pep"; -- Enables users to publish their mood, activity, playing music and more + "carbons"; -- XEP-0280: Message Carbons, synchronize messages accross devices + "smacks"; -- XEP-0198: Stream Management, keep chatting even when the network drops for a few seconds + "mam"; -- XEP-0313: Message Archive Management, allows to retrieve chat history from server + "csi"; -- XEP-0352: Client State Indication + "http"; -- mod_http needed for XEP-363 + "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands + "blocklist"; -- XEP-0191 blocking of users + --"cloud_notify"; -- Support for XEP-0357 Push Notifications for compatibility with ChatSecure/iOS. + -- iOS typically end the connection when an app runs in the background and requires use of Apple's Push servers to wake up and receive a message. Enabling this module allows your server to do that for your contacts on iOS. + -- However we leave it commented out as it is another example of vertically integrated cloud platforms at odds with federation, with all the meta-data-based surveillance consequences that that might have. + "omemo_all_access"; -- Allow for OMEMO E2E between contacts that haven't added each other + "pep_vcard_avatar"; -- use XEP-0153: vCard-Based Avatars to see the avatars of clients that use XEP-0084: User Avatar and vice versa. + +}; + + allow_registration = false; -- Enable to allow people to register accounts on your server from their clients, for more information see http://prosody.im/doc/creating_accounts + + -- These are the SSL/TLS-related settings. + ssl = { + certificate = "/etc/prosody/certs/fullchain.pem"; + key = "/etc/prosody/certs/privkey.pem"; + } + + c2s_require_encryption = true -- Force clients to use encrypted connections + + -- Force certificate authentication for server-to-server connections? + -- This provides ideal security, but requires servers you communicate + -- with to support encryption AND present valid, trusted certificates. + -- NOTE: Your version of LuaSec must support certificate verification! + -- For more information see http://prosody.im/doc/s2s#security + + s2s_secure_auth = false + + pidfile = "/var/run/prosody/prosody.pid" + + authentication = "internal_hashed" + + storage = "sql" + + -- Make sure to change the password + sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "userPassword", host = "localhost" } + + log = { + info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging + error = "/var/log/prosody/prosody.err"; + "*syslog"; + } + + VirtualHost "myserver.org" + + -- Enable http_upload to allow image sharing across multiple devices and clients + Component "dump.myserver.org" "http_upload" + + ---Set up a MUC (multi-user chat) room server on conference.example.com: + Component "muc.myserver.org" "muc" + + + + +Replace all instances of the placeholder domain name and passwords in the config file with your own: + + :::console + sed -i 's/myserver.org/yourdomain.net/g' prosody.cfg.lua && sed -i 's/userPassword/yourownpassword/g' prosody.cfg.lua + +Alternatively you can change them by hand. They are on line 62, 70, 73, 76 of prosody.cfg.lua + +Finishing up +--- + +After you've set up all of the above it is time to start the server: + + :::console + /etc/init.d/prosody restart + +Users can be added from the command line, you will also be prompted for a password: + + :::console + prosodyctl adduser me@myserver.org + +Alternatively you can change "allow_registration = false;" to "allow_registration = true;" in the config (line 35) to allow users to register accounts on your server via their clients. + +Now you can try connecting to your own server by using a client like Gajim or Conversations. Login with the above configured username and password. + +If you have questions about Prosody, the project's [documentation](http://prosody.im/doc) is quite good. If you can't find answers there, try contacting prosody developers and users directly via [the Prosody XMPP chatroom](xmpp://prosody.conference.prosody.im?join) + +This guide is a companion to our article [Have You Considered The Alternative?](http://homebrewserver.club/have-you-considered-the-alternative.html) on instant messaging. Also check out our guide on [XMPP clients](http://homebrewserver.club/picking-modern-xmpp-clients.html). + +**edit 9th of january 2018** +updated config for new debian stable and prosody 0.10 diff --git a/raw/configuring_an_xmpp_server.md b/raw/configuring_an_xmpp_server_prosody_0.9.md similarity index 100% rename from raw/configuring_an_xmpp_server.md rename to raw/configuring_an_xmpp_server_prosody_0.9.md diff --git a/raw/downloads/prosody.cfg.lua b/raw/downloads/prosody.cfg.lua index e13307a..000a821 100644 --- a/raw/downloads/prosody.cfg.lua +++ b/raw/downloads/prosody.cfg.lua @@ -13,7 +13,6 @@ modules_enabled = { "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. "private"; -- Private XML storage (for room bookmarks, etc.) "vcard"; -- Allow users to set vCards - "compression"; -- Stream compression (requires the lua-zlib package installed) "version"; -- Replies to server version requests "uptime"; -- Report how long server has been running "time"; -- Let others know the time here on this server @@ -26,10 +25,13 @@ modules_enabled = { "csi"; -- XEP-0352: Client State Indication "http"; -- mod_http needed for XEP-363 "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands - "blocking"; -- XEP-0198 blocking of users + "blocklist"; -- XEP-0191 blocking of users --"cloud_notify"; -- Support for XEP-0357 Push Notifications for compatibility with ChatSecure/iOS. -- iOS typically end the connection when an app runs in the background and requires use of Apple's Push servers to wake up and receive a message. Enabling this module allows your server to do that for your contacts on iOS. -- However we leave it commented out as it is another example of vertically integrated cloud platforms at odds with federation, with all the meta-data-based surveillance consequences that that might have. + "omemo_all_access"; -- Allow for OMEMO E2E between contacts that haven't added each other + "pep_vcard_avatar"; -- use XEP-0153: vCard-Based Avatars to see the avatars of clients that use XEP-0084: User Avatar and vice versa. + }; allow_registration = false; -- Enable to allow people to register accounts on your server from their clients, for more information see http://prosody.im/doc/creating_accounts @@ -73,4 +75,3 @@ Component "dump.placeholderdomain.org" "http_upload" ---Set up a MUC (multi-user chat) room server on conference.example.com: Component "muc.placeholderdomain.org" "muc" -compression_level = 9