Mercurial > prosody-wiki
view mod_s2s_auth_dane.wiki @ 435:fae8b0661edf
Add info about _xmpp-server IN TLSA
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Mon, 10 Mar 2014 16:08:19 +0100 |
parents | 31cf9ab1d440 |
children | 6e91b7ab36c1 |
line wrap: on
line source
#summary S2S authentication using DANE #labels Stage-Alpha, Type-S2SAuth = Introduction = This module implements DANE as described in [http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations]. However it covers only outgoing server-to-server connections. For incoming connections, an experimental method is used, but requires another TLSA record. = Dependecies = This module requires a DNSSEC aware DNS resolver. Prosodys internal DNS module does not support DNSSEC. Therefore, to use this module, a replacement is needed, such as [http://code.zash.se/luaunbound this libunbound and LuaJIT FFI based one]. = Configuration = This module has no options. Just add it to `modules_enabled`; {{{ modules_enabled = { ... "s2s_auth_dane"; } }}} = DNS Setup = {{{ _xmpp-server._tcp IN SRV 0 0 5269 xmpp _5269._tcp.xmpp IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 _xmpp-server IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 }}} = Compatibility = Requires 0.9 or above.