XMPP Service Operators - 2024-04-03

Wirlaburla: whats up. joined here to antagonize me some more i suppose??

ignored.

I've been here for quite awhile.

dont care, save your sly remarks for some other place. no one wants to hear it

ignored here aswell

My certificates will expire soon. What will happen federation wise with my server?

depends on configuration of other servers, some servers like mine will accept "invalid" certs. others will not.

just renew your certs?

Work in progress

> depends on configuration of other servers, some servers like mine will accept "invalid" certs. others will not. Will all users in a muc recieve my messages? Only some? Will the whole muc not see my messages? ↺

most will probably get a certificate error

meaning they will not even be able to connect to your server

but like i said it depends on the configuration of whatever server they are using, aswell

luca: I'm not sure. It will likely differ from client to client. I don't expect that users that are idle will receive a warning. Users that try to send a message may receive errors like 'service unavailable'

What about federated mucs like this one? Assuming xmpp.org allows expired certs, will everything work as usual? Or it's still client dependent

My server will drop your connection. Your clients/member will got no msg anymore

Yes, we all will see your messages here. Because xmpp.org is the relevant server, and it allows that

The rest of us here is also only connected to xmpp.org, not to your sever. So I'll see your messages here. If we would try to talk 1:1, not in this channel, then it wouldn't work. Because my sever would reject the connection

Ok, thanks!

*This* server will work on, but others not. What is the problem to get a new cert ?

> My server will drop your connection. > Your clients/member will got no msg anymore ernst.on.tour: most (all?) servers (and clients) won't actually drop active connections when a cert expires, they just won't successfully connect again when they get disconnected ↺

For sure, but my line is dropped once a night 😉

> What about federated mucs like this one? Assuming xmpp.org allows expired certs, will everything work as usual? Or it's still client dependent Clients only ever connect to your own server, so this behavior is not client dependent. The only client dependent thing is: if your own clients will connect to your server with an expired cert ↺

> *This* server will work on, but others not. What is the problem to get a new cert ? Some authentication issue from acme.sh (the script) to cloudflare. I'll find a fix for it eventually, but it might take a while ↺

Many servers will drop server-to-server connections after a time of inactivity. With an expired cert, those connections won't be re-established.

Didn't know acme.sh, I'm using getssl.sh

I'm happily using acme.sh for many years

Same for me with getssl.sh 😉

> Didn't know acme.sh, I'm using getssl.sh Thanks, I might switch if I don't figure this out :P ↺

Then there is dehydrated too, that's my favorite. I hope we have all relevant shell clients covered then 😊

> https://b1t.rip/xmpp.php rewtkid is it really wise to have no logs, and no way of seeing how your service is being used... I get privacy and everything but this leaves you open to nasty allegations... how do you know the service isn't being exploited?

Well he has no proof it is right? ;)

> Well he has no proof it is right? ;) Well as soon as I saw "Anarchism now" I kinda figured it all out 🙂 ↺

Establishing a secure connection to chat.cluxia.eu failed. Certificate hash: ff7670eb77c7a3f65d589252906b52ea1ffc00e5. Error with certificate 0: certificate has expired.

operator around from that server?

Polarian: if abuse is reported to the admin account, i can block it then. as of right now ive had no issues.

Polarian: hey whats wrong with the anarchism blinkie?

oh and, i do get a message when someones registered, however it only includes their username and timestamp, not anything else. i guess i should add that there

so if someone starts creating tons of accounts to spam or whatever, it wouldnt be hard to find which ones are them and block them.

the service is relatively new, (started in 2023), so i havent faced any issues like this, yet.

> Polarian: if abuse is reported to the admin account, i can block it then. as of right now ive had no issues. hmmm ↺

> Polarian: hey whats wrong with the anarchism blinkie? let's not get political :) ↺

it just explains the... point of view let's just say

dont worry, im not all leftist anarchist-antifa or anything, i just dont like the idea of a central authority :D

but yes, lets not get politial, probably not the place

s/politial/political

rewtkid: it's crystal clear to anyone paying attention that data is toxic, so less is better, and none is best, keep it up https://www.schneier.com/essays/archives/2016/03/data_is_a_toxic_asse.html

Data is not the new gold or oil?

> rewtkid: it's crystal clear to anyone paying attention that data is toxic, so less is better, and none is best, keep it up https://www.schneier.com/essays/archives/2016/03/data_is_a_toxic_asse.html Don't confuse data required to provide a service, and data required to protect yourself the same as data harvesting ↺

keeping logs is important

One of the most important parts of security is monitoring logs for bad actors... no logs... no ability to do so

its got a name, I forgot it... but you get the point

Polarian: my XMPP server is not a huge attack surface, its in its own container with nothing else besides the XMPP daemon. i also have low and high interaction honeypots set up on my server, for any possible threats. the logs for all of those get sent to an XMPP muc on my server.

> Polarian: my XMPP server is not a huge attack surface, its in its own container with nothing else besides the XMPP daemon. i also have low and high interaction honeypots set up on my server, for any possible threats. the logs for all of those get sent to an XMPP muc on my server. but then you quote ZERO log storage ↺

and yet you send them to a muc

i actually have honeypots set up on my backend and all my frontend round robin servers.

yes, the XMPP server keeps not logs.

no*

but you said you send the logs to a muc

meaning the XMPP service only. i never claimed there werent other services running on the same server that keeps logs.

you can disable logs for the XMPP daemon and have other services still keep logs.

hmmm

normal XMPP users wont have anything logged. any threat actors scanning or trying to hack into my box will likely get caught in a pot and i will see it.

No IPv6 support?

damn

soon there will be. not yet, though.

also server info is unsupported

I assume that is intentional though

hmm

rewtkid, you proxy your traffic through someone else though? ✏

no, the round robin servers are also ran by me. i dont use anything like cloudflare

> no, the round robin servers are also ran by me. i dont use anything like cloudflare CGI global limited? thats you? ↺

that is the ISP.

or they provide hardware?

oh

they are a ISP

what if your ISP logs your packets, then surely there is logging 😉

no srv records?

thats what encryption is for, also as far as i know there is nothing like this going on. however you cant be too sure.

well the ISP owns no IPv6 blocks

so... you will need to proxy for IPv6 support

when it comes to privacy its probably safe to assume everything is being intercepted or logged on the internet, so just use encryption. theres a reason encryption is standard in everything now.

which thus means you got a third party to worry about too 🙂

welp im done being nosy... see it as some friendly karma for /info'ing me 🙂

> no srv records? Why no srv records though? ↺

doesn't hurt to have them?

what exactly do i need them for?

standardisation I guess

i guess i can add them, i just didnt see a reason to.

technically you don't need tcp round robin if you used srv records

wait no you

but also yes

it allows flexibility, put a higher weight in

also i dont see it as karma, its all public information, as is anything i can get by /info'ing you. so i dont mind

also multiple A records already have a similar affect as round robin too

clients tend to pick a random address but I guess its on implementation

meh if it works it works, I was just curious why there was no srv records

it was not criticism

i understand

mainly the only reason i have it set up like that, is because we were under DDoS attacks in the past. and the way i set it up seemed to distribute their attack across all servers, and prevented downtime.

im sure there is a better way to handle it, thats just how i set it up in a pinch, and it certainly does need improvement. im still yet to get moparisthebest's xmpp-proxy set up properly with prosody. tried before, but couldnt seem to get it to work properly.

it would work for some users, then for some reason others would not be able to connect. so im still yet to get that part figured out

actually, i did have it properly set up. but it was s2s_proxy module that would not work properly, for some reason, i could not establish any outbound connections to other servers when using it.