Mercurial > prosody-modules

comparison mod_s2s_auth_dane/README.wiki @ 1782:29f3d6b7ad16

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Import wiki pages
author Kim Alvefur <zash@zash.se>
date Mon, 24 Aug 2015 16:43:56 +0200
parents
children
comparison
equal deleted inserted replaced
1781:12ac88940fe3 1782:29f3d6b7ad16
1 #summary S2S authentication using DANE
2 #labels Stage-Alpha,Type-S2SAuth
3
4 = Introduction =
5
6 This module implements DANE as described in
7 [http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations].
8
9 = Dependencies =
10
11 This module requires a DNSSEC aware DNS resolver. Prosodys internal DNS
12 module does not support DNSSEC. Therefore, to use this module, a
13 replacement is needed, such as [https://www.zash.se/luaunbound.html this one].
14
15 More installation instructions can be found at [https://www.zash.se/prosody-dane.html Prosody with DANE].
16
17 = Configuration =
18
19 After [https://prosody.im/doc/installing_modules installing the module], just add it to `modules_enabled`;
20
21 {{{
22 modules_enabled = {
23 ...
24 "s2s_auth_dane";
25 }
26 }}}
27
28 = DNS Setup =
29
30 In order for other services to verify your site using using this plugin,
31 you need to publish TLSA records (and they need to have this plugin).
32 Here's an example using "DANE-EE Cert SHA2-256" for a host named
33 xmpp.example.com serving the domain example.com.
34
35 {{{
36 $ORIGIN example.com.
37 ; Your standard SRV record
38 _xmpp-server._tcp.example.com IN SRV 0 0 5269 xmpp.example.com.
39 ; IPv4 and IPv6 addresses
40 xmpp.example.com. IN A 192.0.2.68
41 xmpp.example.com. IN AAAA 2001:0db8:0000:0000:4441:4e45:544c:5341
42
43 ; The DANE TLSA records. These three are equivalent, you would use only one of them.
44 ; First, using symbolic names:
45 _5269._tcp.xmpp.example.com. 300 IN TLSA DANE-EE Cert SHA2-256 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
46 ; Using numbers:
47 _5269._tcp.xmpp.example.com. 300 IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
48 ; Raw binary format, should work even with very old DNS tools:
49 _5269._tcp.xmpp.example.com. 300 IN TYPE52 \# 35 030001E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
50 }}}
51
52 [http://www.internetsociety.org/deploy360/dnssec/tools/ List of DNSSEC and DANE tools]
53
54 = Further reading =
55
56 * [http://tools.ietf.org/html/draft-ietf-dane-ops DANE TLSA implementation and operational guidance]
57
58 = Compatibility =
59
60 Requires 0.9 or above.