XMPP Service Operators - 2020-01-11

yes

tom I'll try to write you tomorrow

That was weird, I somehow added a muc as a contact

Why is xmpp.org's xmpp server on a nonstandard port 2605:da00:5222:5269::3:1:9269

?

$ host -t srv _xmpp-server._tcp.xmpp.org _xmpp-server._tcp.xmpp.org has SRV record 1 1 9269 xmpp.xmpp.org.

It's strange

It's a good thing I didn't deploy egress filtering yet

tom: I can't recall. When we deployed it originally, it might have been running on a machine that was already using the standard port. We change probably change it to the standard port now.

s/change/can/

Curious, what's the issue with using a nonstandard port as long as the appropriate SRV records exist?

I suspect that tom wanted to set up a firewall rule that allowed only well-defined ports.

I saw a weird connection I didn't recognize in netstat

I didn't recognize it because the port number was nonstandard

I was originally going to setup egress filtering, where the xmpp daemon user could only make external requests on certain ports, namely xmpp-server

Now I'm not so sure that's a good idea if people are running their s2s connections on nonstandard ports often

Do I need to setup a STUN server if I want Jingle to work reliably? Is that not covered by the socks proxy XEP-0065?

> Now I'm not so sure that's a good idea if people are running their s2s connections on nonstandard ports often You can often see non standard s2s ports for direct tls for instance

Ah

So I should let prosody open whatever port it wants to external hosts

As long as it's TCP

Also don't forget UDP for DNS lookups

That shouldn't be coming from the xmpp daemon

I'm not so sure about that

I would also guess it uses the local dns.

Why should they nih a dns resolver?

Martin: because the system resolver often doesn't support async or SRV

If you run a resolver on 127.0.0.1, fine

If not, UDP out is required

I have unbound listening on 127.0.0.1 and that's the only dns referred in resolv.conf. So prosody should be happy. :)

Yep

Martin: but don't dare stopping it for some minutes

Why should I?

Martin: beause you do a package update?

That will stop it for minutes?

maybe long enough for prosody to freak out about the DNS server being gone

I will see :)