Mercurial > prosody-wiki

annotate mod_s2s_auth_dane.wiki @ 441:80ce8d7f7f56

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_auth_dane.wiki: more text, examples and links
author Kim Alvefur <zash@zash.se>
date Sat, 22 Mar 2014 13:30:47 +0100
parents 6e91b7ab36c1
children 7308cd1cd354
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 #summary S2S authentication using DANE
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 #labels Stage-Alpha, Type-S2SAuth
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 = Introduction =
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
6 This module implements DANE as described in
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 [http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations].
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 = Dependecies =
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
11 This module requires a DNSSEC aware DNS resolver. Prosodys internal DNS
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
12 module does not support DNSSEC. Therefore, to use this module, a
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 replacement is needed, such as
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
14 [https://www.zash.se/luaunbound.html this libunbound and LuaJIT FFI based one].
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 = Configuration =
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
18 After [https://prosody.im/doc/installing_modules installing the module], just add it to `modules_enabled`;
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 {{{
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 modules_enabled = {
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 ...
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 "s2s_auth_dane";
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 }
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 }}}
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26
435
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
27 = DNS Setup =
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
28
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
29 In order for other services to verify your site using using this plugin,
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
30 you need to publish TLSA records (and they need to have this plugin).
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
31 Here's an example using "DANE-EE Cert SHA2-256" for a host named
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
32 xmpp.example.com serving the domain example.com.
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
33
435
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
34 {{{
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
35 $ORIGIN example.com
435
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
36 _xmpp-server._tcp IN SRV 0 0 5269 xmpp
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
37 xmpp IN A 192.0.2.68
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
38 xmpp IN AAAA 2001:0db8:0000:0000:4441:4e45:544c:5341
435
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
39 _5269._tcp.xmpp IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
40 }}}
fae8b0661edf Add info about _xmpp-server IN TLSA
Kim Alvefur <zash@zash.se>
parents: 418
diff changeset
41
441
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
42 [http://www.internetsociety.org/deploy360/dnssec/tools/ List of DNSSEC and DANE tools]
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
43
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
44 = Further reading =
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
45
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
46 * [http://tools.ietf.org/html/draft-ietf-dane-ops TLSA implementation and operational guidance]
80ce8d7f7f56 mod_s2s_auth_dane.wiki: more text, examples and links
Kim Alvefur <zash@zash.se>
parents: 440
diff changeset
47
417
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48 = Compatibility =
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
49
880259dc82a8 DANE \o/
Kim Alvefur <zash@zash.se>
parents:
diff changeset
50 Requires 0.9 or above.