Listener Modules doc refactor #1527

ludwikbukowski · 2017-10-17T11:45:04Z

changed default ciphers
changed some default values
removed "host" and "hosts" options in ejabberd_service docs

Those were removed in 4103892 commit and the "password" option was introduced.

fenek · 2017-10-25T15:09:21Z

doc/advanced-configuration/Listener-modules.md

@@ -16,14 +16,15 @@ You only need to declare running `ejabberd_c2s`, to have the other 2 modules sta

 ### Configuration

-* `certfile` (string, default: no certfile will be used) - Path to the X509 PEM file with a certificate and a private key (not protected by a password).
+* `certfile` (string, default: no certfile will be used) - Path to the X509 PEM file with a certificate and a private key (not protected by a password). If the certificate is signed by an intermediate CA, you should specify here the whole CA chain.


Specify the whole chain - how?

concatenate all public keys and the append private one.
I should put it in docs I guess

fenek · 2017-10-25T15:10:03Z

doc/advanced-configuration/Listener-modules.md

 * `starttls` (default: disabled) - Enables StartTLS support; requires `certfile`.
 * `starttls_required` (default: disabled) - enforces StartTLS usage.
+* `tls` (default: disabled) - enables the old SSL connection.


What does 'old' mean? (I know it but the reader might not :))

you're right, its not informative - I just took it from ejabberd.cfg file [1]
Can be changed in both files then

[1] https://github.com/esl/MongooseIM/blob/master/rel/files/ejabberd.cfg#L238

fenek · 2017-10-25T15:54:29Z

doc/advanced-configuration/Listener-modules.md

-* `host` ( tuple: `{host, Domain, [{password, "password here"}]}`, optional when `hosts` present) - Only allowed domain for components, protected by password.
- Must be set when `hosts` are not present.
-* `shaper_rule` (atom, default: `fast`) - Connection shaper to use for incoming component traffic.
+* `password` (string) - with this password the service is protected


The dark side I sense in you. ;)

_.' : `._ .-.'`. ; .'`.-. __ / : ___\ ; /___ ; \ __ ,'_ ""--.:__;".-.";: :".-.":__;.--"" _`, :' `.t""--.. '<@.`;_ ',@>` ..--""j.' `; `:-.._J '-.-'L__ `-- ' L_..-;' "-.__ ; .-" "-. : __.-" L ' /.------.\ ' J "-. "--" .-" __.l"-:_JL_;-";.__ .-j/'.; ;"""" / .'\"-. .' /:`. "-.: .-" .'; `. .-" / ; "-. "-..-" .-" : "-. .+"-. : : "-.__.-" ;-._ \ ; \ `.; ; : : "+. ; : ; ; ; : ; : \: : `."-; ; ; MIM : ; ,/; ; -: ; : ; : .-"' : :\ \ : ; : \.-" : ;`. \ ; : ;.'_..-- / ; : "-. "-: ; :/." .' : \ .-`.\ /t-"" ":-+. : `. .-" `l __/ /`. : ; ; \ ; \ .-" .-"-.-" .' .'j \ / ;/ \ / .-" /. .'.' ;_:' ; :-""-.`./-.' / `.___.' \ `t ._ / "-.t-._:'

deadjdona · 2017-11-13T16:42:10Z

doc/advanced-configuration/Listener-modules.md

@@ -20,10 +20,10 @@ You only need to declare running `ejabberd_c2s`, to have the other 2 modules sta
 * `starttls` (default: disabled) - Enables StartTLS support; requires `certfile`.
 * `starttls_required` (default: disabled) - enforces StartTLS usage.
 * `zlib` (atom or a positive integer, default: disabled) - Enables ZLIB support, the integer value is a limit for a decompressed output size (to prevent successful [ZLIB bomb attack](http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/)); the limit can be disabled with an atom 'unlimited'.
-* `ciphers` (string, default: as of OpenSSL 1.0.0 it's `ALL:!aNULL:!eNULL` [(source)](https://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS)) - cipher suites to use with StartTLS.
- Please refer to the [OpenSSL documentation](http://www.openssl.org/docs/apps/ciphers.html) for the cipher string format.
+* `ciphers` (string, default: as of OpenSSL 1.0.2 it's `ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2` [(source)](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER_STRINGS)) - cipher suites to use with StartTLS.


https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites

!EXPORT:!LOW:!SSLv2:!aNULL:!eNULL:!IDEA:!RC4:!3DES:!SSLv3:!SSLv2:!DSS:!SRP:!PSK

https://pubs.vmware.com/horizon-7-view/index.jsp#com.vmware.horizon-client-agent.security.doc/GUID-632339F2-6341-4362-8CA3-0A504846E726.html

ECDHE-RSA-AES256-SHA:HIGH:!AESGCM:!CAMELLIA:!3DES:!EDH:!EXPORT:!MD5:!PSK:!RC4:!SRP:!aNULL:!eNULL

deadjdona · 2017-11-13T16:48:34Z

https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Cryptographic_Ciphers

Some ciphers are insecure or obsolete.
Consider disable by default, like !IDEA.

mongoose-im · 2018-11-05T14:05:25Z

5811.1 / Erlang 19.3 / small_tests / 9924bee
Reports root / small

5811.3 / Erlang 19.3 / mysql_redis / 9924bee
Reports root/ big
OK: 2874 / Failed: 0 / User-skipped: 222 / Auto-skipped: 0

5811.2 / Erlang 19.3 / internal_mnesia / 9924bee
Reports root/ big
OK: 1129 / Failed: 2 / User-skipped: 51 / Auto-skipped: 0

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_ungraceful_reconnection_to_different_server

{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve34.261857@localhost/res1">>,escalus_tcp,
          <0.13137.1>,
          [{event_manager,<0.13128.1>},
           {server,<<"localhost">>},
           {username,<<"eve34.261857">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.13128.1>},
            {server,<<"localhost">>},
            {username,<<"eve34.261857">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve34.261857">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {username,<<"eve34.261857">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5222},
           {stream_management,true},
           {stream_id,<<"A34EE5CCE4F3A5D1">>}]},
        10000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,138}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_ungraceful_reconnection_to_different_server/1-fun-0-',
       4,
       [{file,"mod_global_distrib_SUITE.erl"},{line,607}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_story.erl"},
        {line,72}]},
    ...

Report log

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_ungraceful_reconnection_to_different_server

{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve73.559626@localhost/res1">>,escalus_tcp,
          <0.13601.1>,
          [{event_manager,<0.13592.1>},
           {server,<<"localhost">>},
           {username,<<"eve73.559626">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.13592.1>},
            {server,<<"localhost">>},
            {username,<<"eve73.559626">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve73.559626">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {username,<<"eve73.559626">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5222},
           {stream_management,true},
           {stream_id,<<"15666256FD9FF2A8">>}]},
        10000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,138}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_ungraceful_reconnection_to_different_server/1-fun-0-',
       4,
       [{file,"mod_global_distrib_SUITE.erl"},{line,607}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_story.erl"},
        {line,72}]},
    ...

Report log

5811.6 / Erlang 19.3 / elasticsearch_and_cassandra_mnesia / 9924bee
Reports root/ big
OK: 445 / Failed: 0 / User-skipped: 8 / Auto-skipped: 0

5811.4 / Erlang 19.3 / odbc_mssql_mnesia / 9924bee
Reports root/ big
OK: 2888 / Failed: 0 / User-skipped: 208 / Auto-skipped: 0

5811.5 / Erlang 19.3 / ldap_mnesia / 9924bee
Reports root/ big
OK: 1081 / Failed: 1 / User-skipped: 86 / Auto-skipped: 0

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_ungraceful_reconnection_to_different_server

{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve96.792394@localhost/res1">>,escalus_tcp,
          <0.12153.1>,
          [{event_manager,<0.12144.1>},
           {server,<<"localhost">>},
           {username,<<"eve96.792394">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.12144.1>},
            {server,<<"localhost">>},
            {username,<<"eve96.792394">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve96.792394">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {username,<<"eve96.792394">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5222},
           {stream_management,true},
           {stream_id,<<"1829E8DB2E981BA7">>}]},
        10000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,138}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_ungraceful_reconnection_to_different_server/1-fun-0-',
       4,
       [{file,"mod_global_distrib_SUITE.erl"},{line,607}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_story.erl"},
        {line,72}]},
    ...

Report log

5811.8 / Erlang 20.0 / pgsql_mnesia / 9924bee
Reports root/ big / small
OK: 2920 / Failed: 0 / User-skipped: 176 / Auto-skipped: 0

5811.9 / Erlang 21.0 / riak_mnesia / 9924bee
Reports root/ big / small
OK: 1326 / Failed: 0 / User-skipped: 49 / Auto-skipped: 0

5811.2 / Erlang 19.3 / internal_mnesia / 9924bee
Reports root/ big
OK: 1103 / Failed: 0 / User-skipped: 51 / Auto-skipped: 0

codecov · 2018-11-05T15:35:33Z

Codecov Report

Merging #1527 into master will decrease coverage by 0.31%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1527      +/-   ##
==========================================
- Coverage   76.91%   76.59%   -0.32%     
==========================================
  Files         323      323              
  Lines       28116    28173      +57     
==========================================
- Hits        21626    21580      -46     
- Misses       6490     6593     +103

Impacted Files	Coverage Δ
src/inbox/mod_inbox_rdbms_mssql.erl	`0% <0%> (-100%)`	⬇️
src/rdbms/rdbms_queries_mssql.erl	`0% <0%> (-85.72%)`	⬇️
src/rdbms/mongoose_rdbms_odbc.erl	`8.86% <0%> (-69.63%)`	⬇️
src/ejabberd_rdbms.erl	`88.88% <0%> (-11.12%)`	⬇️
src/rdbms/mongoose_rdbms.erl	`65.02% <0%> (-4.92%)`	⬇️
src/wpool/mongoose_wpool_rdbms.erl	`79.16% <0%> (-4.17%)`	⬇️
src/mam/mod_mam_rdbms_prefs.erl	`92.52% <0%> (-3.74%)`	⬇️
src/rdbms/rdbms_queries.erl	`76.82% <0%> (-3.66%)`	⬇️
src/auth/ejabberd_auth_external.erl	`29.56% <0%> (-2.52%)`	⬇️
src/mod_bosh.erl	`92.85% <0%> (-2.15%)`	⬇️
... and 12 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7ec67f8...da067ed. Read the comment docs.

goddammit · 2018-11-07T14:18:49Z

doc/advanced-configuration/Listener-modules.md

 * `certfile` (string, default: no certfile will be used) - Path to the X509 PEM file with a certificate and a private key (not protected by a password).
+  If the certificate is signed by an intermediate CA, you should specify here the whole CA chain by concatenating all public keys together and appending private key after that.


If the certificate is signed by an intermediate CA, you should specify here the whole CA chain by concatenating all public keys together and appending the private key after that.

ludwikbukowski added 8 commits October 17, 2017 13:09

remove "hosts" and "host" options from documentation

5c7227e

Those were removed in 4103892 commit and the "password" option was introduced.

fix default shaper value; add comment regarding the host

ccd68a2

change the default cipher string due to current documentation

f75d908

add ssl option to c2s doc

ea67049

precise the certfile option

03e7eb2

add default options for mod_websocket options for ejabberd_cowboy

839d6ab

fix indentation

553f5f1

minor fixes[skip ci]

0d74fc9

ludwikbukowski force-pushed the ejabberd-service-doc branch from 666d798 to 0d74fc9 Compare October 17, 2017 11:45

ludwikbukowski requested a review from fenek October 17, 2017 11:46

fenek added this to the 2.1.1 milestone Oct 25, 2017

fenek requested changes Oct 25, 2017

View reviewed changes

fenek added doc WIP 🚧 labels Oct 25, 2017

Listener modules doc fixes due to review [skip ci]

bcb8219

ludwikbukowski force-pushed the ejabberd-service-doc branch from fc63950 to bcb8219 Compare October 31, 2017 18:20

deadjdona reviewed Nov 13, 2017

View reviewed changes

fenek removed this from the 2.1.1 milestone Jan 16, 2018

Merge branch 'master' into ejabberd-service-doc

da067ed

goddammit reviewed Nov 7, 2018

View reviewed changes

[skip ci] small language improvement

724c124

michalwski merged commit 6e192e2 into master Nov 7, 2018

michalwski deleted the ejabberd-service-doc branch November 7, 2018 18:50

fenek added this to the 3.1.0++ milestone Nov 8, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Listener Modules doc refactor #1527

Listener Modules doc refactor #1527

ludwikbukowski commented Oct 17, 2017

fenek Oct 25, 2017

ludwikbukowski Oct 26, 2017 •

edited

fenek Oct 25, 2017

ludwikbukowski Oct 26, 2017

fenek Oct 25, 2017

ludwikbukowski Oct 26, 2017 •

edited

deadjdona Nov 13, 2017

deadjdona Nov 13, 2017

deadjdona commented Nov 13, 2017

mongoose-im commented Nov 5, 2018 •

edited

codecov bot commented Nov 5, 2018 •

edited

goddammit Nov 7, 2018

		* `certfile` (string, default: no certfile will be used) - Path to the X509 PEM file with a certificate and a private key (not protected by a password).
		If the certificate is signed by an intermediate CA, you should specify here the whole CA chain by concatenating all public keys together and appending private key after that.

Listener Modules doc refactor #1527

Listener Modules doc refactor #1527

Conversation

ludwikbukowski commented Oct 17, 2017

fenek Oct 25, 2017

Choose a reason for hiding this comment

ludwikbukowski Oct 26, 2017 • edited

Choose a reason for hiding this comment

fenek Oct 25, 2017

Choose a reason for hiding this comment

ludwikbukowski Oct 26, 2017

Choose a reason for hiding this comment

fenek Oct 25, 2017

Choose a reason for hiding this comment

ludwikbukowski Oct 26, 2017 • edited

Choose a reason for hiding this comment

deadjdona Nov 13, 2017

Choose a reason for hiding this comment

deadjdona Nov 13, 2017

Choose a reason for hiding this comment

deadjdona commented Nov 13, 2017

mongoose-im commented Nov 5, 2018 • edited

codecov bot commented Nov 5, 2018 • edited

Codecov Report

goddammit Nov 7, 2018

Choose a reason for hiding this comment

ludwikbukowski Oct 26, 2017 •

edited

ludwikbukowski Oct 26, 2017 •

edited

mongoose-im commented Nov 5, 2018 •

edited

codecov bot commented Nov 5, 2018 •

edited