Ok, I think I am understanding your question correctly (and think I
remember the definition of SASL). I believe that you want to use the
starttls flag in the c2s.xml file, which also requires that you have a
certificate created for your server. Below is my <local> section for the
server I run. Under the <id> tag place the jabber realm which the server
is responsible for, and also in the pemfile option that is the absolute
path to the certificate file which you created. Below that is my section
from the <authreg> section, as for the options to select there I don't
know, but those seem to work. Also, for the client side configuration of
my server I have them use the "Require SSL/TLS" field in Pidgin, which I
assume is cross-client.
Hopefully this helps,
-Ian
<local>
<id require-starttls='true'
pemfile='/usr/local/etc/Certs/jabbercert+key.pem'
>mydomain.con</id>
<!-- IP address to bind to (default: 0.0.0.0) -->
<ip>0.0.0.0</ip>
<!-- Port to bind to, or 0 to disable unencrypted access to the
server (default: 5222) -->
<port>5222</port>
<!-- Older versions of jabberd support encrypted client connections
via an additional listening socket on port 5223. If you want
this (required to allow pre-STARTTLS clients to do SSL),
uncomment this -->
<!--
<ssl-port>5223</ssl-port>
-->
<!-- File containing an SSL certificate and private key for client
connections. From SSL_CTX_use_certificate_chain_file(3):
"The certificates must be in PEM format and must be sorted
starting with the subject's certificate (actual client or server
certificate), followed by intermediate CA certificates if
applicable, and ending at the highest level (root) CA"
(the latter one being optional).
Note: This certificate is ONLY used for old style SSL
connections on port 5223 (pre-STARTTLS). If you want to
use STARTTLS over the standard XMPP port 5222 then you
MUST specify the pemfile in the 'id' tag above. -->
<!--
<pemfile>/usr/local/etc/server.pem</pemfile>
-->
<!-- SSL verify mode - see SSL_CTX_set_verify(3), mode parameter -->
<!--
<verify-mode>7</verify-mode>
-->
<!-- Forward incoming HTTP clients to a real HTTP server -->
<!--
<httpforward>http://www.jabber.org/</httpforward>
-->
</local>
--From the authentication section of c2s.xml--
!-- Available authentication mechanisms -->
<mechanisms>
<!-- These are the traditional Jabber authentication mechanisms.
Comment out any that you don't want to be offered to clients.
Note that if the auth/reg module does not support one of
these mechanisms, then it will not be offered regardless of
whether or not it is enabled here. -->
<traditional>
<plain/>
<digest/>
</traditional>
<!-- SASL authentication mechanisms. Comment out any that you
don't want to be offered to clients. Again, if the auth/reg
module does not support one of these mechanisms, then it will
not be offered. -->
<sasl>
<plain/>
<digest-md5/>
<!--
<anonymous/>
<gssapi/>
<external/>
-->
</sasl>
</mechanisms>
<!-- Additional mechanisms that are also available when the
connection is encrypted. Ie. when START-TLS had been
negotiated, or user connected on SSL-wrapped port. -->
<ssl-mechanisms>
<!-- it's advisable that you disable plain in the above
<mechanisms/> section -->
<traditional>
<plain/>
</traditional>
<sasl>
<plain/>
</sasl>
</ssl-mechanisms>
--End sample config--
Cassius V. de Magalhaes wrote:
Hello,
I'm trying to use SASL on c2s.xml, but it's not working. I didn't understand
the sample c2s.xml by documentation.
I'm using Ubuntu 9.10 32 bit.
For example: my domain is mydomain.com ; the host is jabber.mydomain.com
Any ideas, please?
TIA.
--
Ian McInerney
Junior, Illinois Mathematics and Science Academy
[email protected]
"Live Long and Prosper", Leonard Nimoy
No electrons were harmed in the making of this message.
--
To unsubscribe send a mail to [email protected]
