• # XMPP

    Posté par (site web personnel) . En réponse au journal Tout le monde a bien activé TLS sur ses serveurs SMTP ?. Évalué à 6.

    Les communications, c'est pas que SMTP, c'est aussi XMPP. Avec Prosody que j'utilise, voici les bouts de config intéressants pour du TLS/SSL:

    modules_enabled = {
    ...
     "tls"; -- Assez explicite
    ...
    }
    -- These are the SSL/TLS-related settings. If you don't want
    -- to use SSL/TLS, you may comment or remove this
    ssl = {
     key = "/chemin/vers/ma/cle.key";
     certificate = "/chemin/vers/ma/cle.crt";
    }
    -- Force certificate authentication for server-to-server connections?
    -- This provides ideal security, but requires servers you communicate
    -- with to support encryption AND present valid, trusted certificates.
    -- NOTE: Your version of LuaSec must support certificate verification!
    -- For more information see http://prosody.im/doc/s2s#security
    s2s_secure_auth = true
    -- Many servers don't support encryption or have invalid or self-signed
    -- certificates. You can list domains here that will not be required to
    -- authenticate using certificates. They will be authenticated using DNS.
    s2s_insecure_domains = { "gmail.com", "ddg.gg", "juick.com" }
    -- Even if you leave s2s_secure_auth disabled, you can still require valid
    -- certificates for some domains by specifying a list here.
    s2s_secure_domains = { "jabber.org" }
    -- Pinnage de certificats, pour tous ceux qui ne veulent pas se soumettre à la cabale PKIstique mondiale
    s2s_trusted_fingerprints = {
     --["jabber.org"] = "11:C2:3D:87:3F:95:F8:13:F8:CA:81:33:71:36:A7:00:E0:01:95:ED";
     --["matthewwild.co.uk"] = {
     --"FD:7F:B2:B9:4C:C4:CB:E2:E7:48:FB:0D:98:11:C7:D8:4D:2A:62:AA";
     --"CF:F3:EC:43:A9:D5:D1:4D:D4:57:09:55:52:BC:5D:73:06:1A:A1:A0";
     --};
     ["superhorse.se"] = "71:E6:7E:1E:DA:1F:01:E9:56:94:2C:52:D0:B5:86:07:F6:3D:7F:83";
     ["ddg.gg"] = "2A:72:69:C0:E4:36:1C:B4:98:05:D5:72:AC:CB:B9:E4:00:65:D7:30"
    }

    Globalement, spécifier que le TLS est voulu et le chemin vers ses certificat et clé, et on a un serveur sécurisé. Pour tester, je ne peux que recommander xmpp.net.