XMPP Service Operators - 2022-05-01

FYI: hookipa.net/xmpp.social will shut down for maintenance (relocation to a new server)

Hello

We hello

Hi

hello. basic xmpp question:

if a user joins a muc on a brand new server, and then leaves the muc, does the s2s connection stay open?

smooth_operator, it depends™.

Some servers (Ejabberd for instance) like to close s2s connections when no stanza has been exchanged in some time, some other (Prosody for instance) don’t.

The trade-offs are that it takes a few seconds to open a connection, so the next message you send might get delayed a bit if the connection got closed.

makes sense. so in the case of prosody, surely there is an eventual timeout?

On the other hand, it takes a few KiB of memory to have an open connection, so for resource reasons it might be preferable to close the connections on servers starved for RAM.

Not that I know of, the s2s connection gets closed only when the other end closes it, or when the server gets restarted.

hmmm

Or ip change, TCP time out

I have never found this problematic, but if you have very little RAM and a lot of idle s2s you might want to change that.

so the scenario i have is, if a user on my muc joins all these random mucs just to browse, but then leaves them all, all of those connections stay open indefinitely

There is mod_s2s_idle_timeout in prosody-modules to do that.

oh cool, perfect

smooth_operator, is that an issue though?

As I said, it only takes a few KiB of memory to keep a TCP + TLS connection open.

not really, im just micromanaging since im new to xmpp

And as Menel said, you will get timeouts for other reasons anyway.

smooth_operator, note that it has nothing to do with MUC, the s2s doesn’t care what gets transmitted over it.

yeah that makes sense

smooth_operator, and be aware of the time it takes to reestablish a connection, especially if you have a weak CPU, especially if the other end uses a large certificate (4096 bits RSA for instance).

If you are less new, in time, you'll notice the defaults are there for a reason and most micromanagement not useful.

Yup. ^^

yeah i bet. i just like knowing what traffic my server is doing, is all

By definition, an idle connection will have almost no traffic.

yeah im not concerned about amount of traffic. just the various connections my server holds open and if they are solicited or not

All connections are solicited. :D

No server goes “nothing asked me to, but I’ll open a connection anyway!” :D

lol i mean like all the internet scanners scanning for 5269, i wanna know if that connection is because a user is doing something with the server or not, i guess

Those probably close it right after they’ve done their scanning.

It would be too expensive on their end not to.

well that's only stage 1 :)

stage 2 is fingerprinting

stage 3 is hacking

I’ve only ever seen DoS over unauthenticated streams, never hacking.

Doesn’t mean it doesn’t happen, but I am not aware of any case in the past fifteen years I’ve been following XMPP stuff.

okay, so another xmpp noob question: is there actually authentication over s2s aside from cert validation?

If the certificate is valid, that is authentication.

Presenting a valid certificate for a domain is kind of a proof that you do own said domain.

There are other ways to prove it, but that’s the current most accepted one.

yeah that's what i was thinking. all they need is a domain and cert which isn't hard to get

so maybe a more useful question is, are there any good guides for hardening our servers?

or at least best practices

What do you want to harden it against?

As Menel said earlier, “in time, you'll notice the defaults are there for a reason”. :)

minimizing attack surface

smooth_operator: best practice is use the software.. I'm not aware of any xmpp "hack" beside DOS. The attach surface is with the default very small as far as I see. There are endless servers out there.. But has any been hacked via xmpp?

Ever?

Probably, don’t load random community modules that haven’t been vetted by the devs of your server or reviewed by you, would be the best answer I could give you.

Menel: i don't know of xmpp server hacking either, but that doesn't mean it doesn't happen. and if it's normal for the server to hold open tons of idle connections, how would operators know those aren't malicious or not

and i'm just being theoretical here. anytime i expose something to the internet i just like knowing what i'm exposing

so things like bosh, websocket, proxy65: i have no idea what those are for so i just disable them

smooth_operator: > so things like bosh, websocket, proxy65: i have no idea what those are for so i just disable them you can read...

Web client old standard, new standard, file transfer helper, etc

well yeah i can look them all up and spend hours reading xeps, but the argument was about not messing with defaults. now that i think about it, it's impossible for me to _not_ mess with defaults lol. character flaw. so never mind my rambling :)

Well, if you are like that you'll _have_ to read about it or never sleep well 😀

I just don't think its a big difference if your s2s closes connections or not. If the open connection is used by a malicious actor.. They will just hold it open. And a timeout will not help with security

As you already discoverd a server will happily listen to a valid connection

yeah, you're right

smooth_operator: either accept defaults or read, and you'll read anyway when stuff is not working lol

yeah. i'm just looking for the easy button first ;)

Make default working, then read and prune what's not wanted.

No need for s2s or proxy65 at start, no one would use them when you start, since no one knows your server yet.

Before reading xeps, I would start with the prosody doc from the top, and then all the modules you use.. Xeps are a bit abstract..

hookipa.net/xmpp.social is online again (since a few hours)