XMPP Service Operators - 2021-03-26

csh: https://www.ted.com/talks/james_veitch_this_is_what_happens_when_you_reply_to_spam_email Maybe you weren't friendly enough?

don't respond ever

How's jabber.network different from xmpp.net?

raghavgururajan: the one checks the server xeps the other messures tsl.

tls

menel: Ah thanks!

hey btw

you can also test the server's tls with testssl.sh

it supports the xmpp STARTTLS variant

yes, but you need a very recent version for s2s tests

the XMPP observatory seems to have severe threading limitations

the xmpp observatory runs on a very old stack which nobody knows how to maintain anymore

oh

I do have a rewrite (incidentally based on testssl.sh) in the pipeline :)

oh neat, thanks jonas’!

jonas’: what is the old stack?

it is actually mostly done, only needs the DNSSEC and DANE stuff sorted out.

tom, a fork of a subset of prosody’s XMPP stack with some strange patches, surrounded by more bits of lua and php

jonas’: I would like to follow your work on the rewrite

tom, you’re welcome to: https://github.com/horazont/testxmpp

thanks

Whats about: ``` echo | openssl s_client -starttls xmpp -servername domain.tls -connect domain.tld:5222 2>/dev/null | openssl x509 -noout -subject -dates -checkend $(($days*24*60*60)) && echo lives more than $days || echo need new cert ```

» 2>/dev/null discards stderr, » openssl x509 -noout -subject -dates -checkend $(($days*24*60*60)) && echo lives more than $days || echo need new cert downloads the certificate, checks it's experation date and checks it's it's close to expiring

» openssl s_client -starttls xmpp -servername domain.tls -connect domain.tld:5222 connects and setups up TLS over the STARTTLS method

I test my cert with above code, it's a oneliner in crontab

I just use dyhdrated.sh and a slightly modified quark

quark can be found on suckless.org

it's a minimal webserver written in less then 1000LOC

dehydrated is an ACME implementation written in a few hundred lines of bash

Change "echo need new cert" to "curl ...." to send via mod_post_msg an xmpp-msg to me

it's very good and keeping the certs fresh, and even more advanced things like stapling, cipher selection, and alternative names

there's a line in /etc/aliases the redirects root to postmaster@nuegia.net, and cronic, another small shell script ensures cron only fires an email if there's a problem

it's a very extensible and simple system

many daemons and users across the system can use it

I use https://github.com/srvrco/getssl to generate my certs