Core Apps » Orbot

(sorry if the description is imprecise, it's the first time I use a bug tracker)

I'm running ChatSecure for Android (info.guardianproject.otr.app.im version 14.2.3) and I cannot connect to my self-hosted XMPP server: when I add the account, the side panel shows "Connecting..." but nothing happens and I cannot chat/add buddies.

My phone is a Samsung Galaxy SII (GT-i9100G) running CyanogenMod 10.2-201309-11-NIGHTLY-i9100G (Android 4.3)

My XMPP server is ejabberd 14.07 on Debian Jessie with a certificate issued by Let's Encrypt, and it works well with other clients (e.g. Pidgin) but it has a somewhat strict security policy, so maybe I'm enforcing cipher suites that ChatSecure does not support? Here are some relevant lines extracted from my ejabberd.yml configuration file, follows the full ejabberd.yml file (with minor edits).

Thanks for any help :)

----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----
-
port: 5222
module: ejabberd_c2s
protocol_options:
- "no_sslv3"
- "no_tlsv1"
- "cipher_server_preference"
starttls_required: true
shaper: c2s_shaper
access: c2s
ciphers: "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"
-
port: 5269
module: ejabberd_s2s_in
s2s_use_starttls: required
s2s_protocol_options:
- "no_sslv3"
- "no_tlsv1"
- "cipher_server_preference"
s2s_ciphers: "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"
auth_method: internal

----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----

###

1. ejabberd configuration file ### ###

1. The parameters used in this configuration file are explained in more detail
2. in the ejabberd Installation and Operation Guide.
3. Please consult the Guide in case of doubts, it is included with
4. your copy of ejabberd, and is also available online at
5. http://www.process-one.net/en/ejabberd/docs/

1. The configuration file is written in YAML.
2. Refer to http://en.wikipedia.org/wiki/YAML for the brief description.
3. However, ejabberd treats different literals as different types: ###
4. - unquoted or single-quoted strings. They are called "atoms".
5. Example: dog, 'Jupiter', '3.14159', YELLOW ###
6. - numeric literals. Example: 3, -45.0, .0 ###
7. - quoted or folded strings.
8. Examples of quoted string: "Lizzard", "orange".
9. Example of folded string:
10. > Art thou not Romeo,
11. and a Montague?

1. =======
2. LOGGING

##

1. loglevel: Verbosity of log files generated by ejabberd.
2. 0: No ejabberd log at all (not recommended)
3. 1: Critical
4. 2: Error
5. 3: Warning
6. 4: Info
7. 5: Debug ##
   loglevel: 4

##

1. rotation: Disable ejabberd's internal log rotation, as the Debian package
2. uses logrotate(8).
   log_rotate_size: 0
   log_rotate_date: ""

##

1. overload protection: If you want to limit the number of messages per second
2. allowed from error_logger, which is a good idea if you want to avoid a flood
3. of messages when system is overloaded, you can set a limit.
4. 100 is ejabberd's default.
   log_rate_limit: 100

##

1. watchdog_admins: Only useful for developers: if an ejabberd process
2. consumes a lot of memory, send live notifications to these XMPP
3. accounts. ##
4. watchdog_admins:
5. - "bob@example.com"

1. ================
2. SERVED HOSTNAMES

##

1. hosts: Domains served by ejabberd.
2. You can define one or several, for example:
3. hosts:
4. - "example.net"
5. - "example.com"
6. - "example.org" ##
   hosts:
   - "myhost.com"

##

1. route_subdomains: Delegate subdomains to other XMPP servers.
2. For example, if this ejabberd serves example.org and you want
3. to allow communication with an XMPP server called im.example.org. ##
4. route_subdomains: s2s

1. ===============
2. LISTENING PORTS

##

1. listen: The ports ejabberd will listen on, which service each is handled
2. by and what options to start it with. ##
   listen:
   -
   port: 5222
   ##ip: "::"
   ip: "0.0.0.0"
   module: ejabberd_c2s ## ## If TLS is compiled in and you installed a SSL ## certificate, specify the full path to the ## file and uncomment this line: ##
   certfile: "/etc/ejabberd/ssl/ejabberd.pem" ## starttls: true ## ## Custom OpenSSL options ##
   protocol_options:
   - "no_sslv3"
   - "no_tlsv1"
   - "cipher_server_preference"
   starttls_required: true
   max_stanza_size: 65536
   shaper: c2s_shaper
   access: c2s
   ciphers: "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"
   -
   port: 5269
   ##ip: "::"
   ip: "0.0.0.0"
   module: ejabberd_s2s_in ## ## ejabberd_service: Interact with external components (transports, ...) ## ## - ## port: 8888 ## module: ejabberd_service ## access: all ## shaper_rule: fast ## ip: "127.0.0.1" ## hosts: ## "icq.example.org": ## password: "secret" ## "sms.example.org": ## password: "secret" ##
   1. ejabberd_stun: Handles STUN Binding requests ##
   2. -
   3. port: 3478
   4. transport: udp
   5. module: ejabberd_stun
   ##
   1. To handle XML-RPC requests that provide admin credentials: ##
   2. -
   3. port: 4560
   4. module: ejabberd_xmlrpc

1. -
2. port: 5280
3. ip: "::"
4. module: ejabberd_http
5. ## request_handlers:
6. ## "/pub/archive": mod_http_fileserver
7. web_admin: true
8. http_poll: true
9. http_bind: true
10. ## register: true
11. captcha: true

##

1. s2s_use_starttls: Enable STARTTLS + Dialback for S2S connections.
2. Allowed values are: false optional required required_trusted
3. You must specify a certificate file. ##
   s2s_use_starttls: required

##

1. s2s_certfile: Specify a certificate file. ##
   s2s_certfile: "/etc/ejabberd/ssl/ejabberd.pem"

1. Custom OpenSSL options ##
   s2s_protocol_options:
   - "no_sslv3"
   - "no_tlsv1"
   - "cipher_server_preference"
   s2s_ciphers: "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"

##

1. domain_certfile: Specify a different certificate for each served hostname. ##
2. host_config:
3. "example.org":
4. domain_certfile: "/path/to/example_org.pem"
5. "example.com":
6. domain_certfile: "/path/to/example_com.pem"

##

1. S2S whitelist or blacklist ##
2. Default s2s policy for undefined hosts. ##
3. s2s_access: s2s

##

1. Outgoing S2S options ##
2. Preferred address families (which to try first) and connect timeout
3. in milliseconds. ##
4. outgoing_s2s_families:
5. - ipv4
6. - ipv6
7. outgoing_s2s_timeout: 10000

1. ==============
2. AUTHENTICATION

##

1. auth_method: Method used to authenticate the users.
2. The default method is the internal.
3. If you want to use a different method,
4. comment this line and enable the correct ones. ##
   auth_method: internal

##

1. Store the plain passwords or hashed for SCRAM:
2. auth_password_format: plain
   auth_password_format: scram ##
3. Define the FQDN if ejabberd doesn't detect it:
   fqdn: "jabber.myhost.com"

##

1. Authentication using external script
2. Make sure the script is executable by ejabberd. ##
3. auth_method: external
4. extauth_program: "/path/to/authentication/script"

##

1. Authentication using ODBC
2. Remember to setup a database in the next section. ##
3. auth_method: odbc

##

1. Authentication using PAM ##
2. auth_method: pam
3. pam_service: "pamservicename"

##

1. Authentication using LDAP ##
2. auth_method: ldap ##
3. List of LDAP servers:
4. ldap_servers:
5. - "localhost" ##
6. Encryption of connection to LDAP servers:
7. ldap_encrypt: none
8. ldap_encrypt: tls ##
9. Port to connect to on LDAP servers:
10. ldap_port: 389
11. ldap_port: 636 ##
12. LDAP manager:
13. ldap_rootdn: "dc=example,dc=com" ##
14. Password of LDAP manager:
15. ldap_password: "******" ##
16. Search base of LDAP directory:
17. ldap_base: "dc=example,dc=com" ##
18. LDAP attribute that holds user ID:
19. ldap_uids:
20. - "mail": "%u@mail.example.org" ##
21. LDAP filter:
22. ldap_filter: "(objectClass=shadowAccount)"

##

1. Anonymous login support:
2. auth_method: anonymous
3. anonymous_protocol: sasl_anon | login_anon | both
4. allow_multiple_connections: true | false ##
5. host_config:
6. "public.example.org":
7. auth_method: anonymous
8. allow_multiple_connections: false
9. anonymous_protocol: sasl_anon ##
10. To use both anonymous and internal authentication: ##
11. host_config:
12. "public.example.org":
13. auth_method:
14. - internal
15. - anonymous

1. ==============
2. DATABASE SETUP

1. ejabberd by default uses the internal Mnesia database,
2. so you do not necessarily need this section.
3. This section provides configuration examples in case
4. you want to use other database backends.
5. Please consult the ejabberd Guide for details on database creation.

##

1. MySQL server: ##
2. odbc_type: mysql
3. odbc_server: "server"
4. odbc_database: "database"
5. odbc_username: "username"
6. odbc_password: "password" ##
7. If you want to specify the port:
8. odbc_port: 1234

##

1. PostgreSQL server: ##
2. odbc_type: pgsql
3. odbc_server: "server"
4. odbc_database: "database"
5. odbc_username: "username"
6. odbc_password: "password" ##
7. If you want to specify the port:
8. odbc_port: 1234 ##
9. If you use PostgreSQL, have a large database, and need a
10. faster but inexact replacement for "select count(*) from users" ##
11. pgsql_users_number_estimate: true

##

1. ODBC compatible or MSSQL server: ##
2. odbc_type: odbc
3. odbc_server: "DSN=ejabberd;UID=ejabberd;PWD=ejabberd"

##

1. Number of connections to open to the database for each virtual host ##
2. odbc_pool_size: 10

##

1. Interval to make a dummy SQL request to keep the connections to the
2. database alive. Specify in seconds: for example 28800 means 8 hours ##
3. odbc_keepalive_interval: undefined

1. ===============
2. TRAFFIC SHAPERS

shaper: ## ## The "normal" shaper limits traffic speed to 1000 B/s ##
normal: 1000

##

1. The "fast" shaper limits traffic speed to 50000 B/s ##
   fast: 50000

##

1. This option specifies the maximum number of elements in the queue
2. of the FSM. Refer to the documentation for details. ##
   max_fsm_queue: 1000

###. ====================
###' ACCESS CONTROL LISTS
acl: ## ## The 'admin' ACL grants administrative privileges to XMPP accounts. ## You can put here as many accounts as you want. ##
admin:
user:
- "admin": "localhost" ##

1. Blocked users ##
2. blocked:
3. user:
4. - "baduser": "example.org"
5. - "test"

1. Local users: don't modify this. ##
   local:
   user_regexp: ""

##

1. More examples of ACLs ##
2. jabberorg:
3. server:
4. - "jabber.org"
5. aleksey:
6. user:
7. - "aleksey": "jabber.ru"
8. test:
9. user_regexp: "^test"
10. user_glob: "test*"

##

1. Loopback network ##
   loopback:
   ip:
   - "127.0.0.0/8"

##

1. Bad XMPP servers ##
2. bad_servers:
3. server:
4. - "xmpp.zombie.org"
5. - "xmpp.spam.com"

##

1. Define specific ACLs in a virtual host. ##
2. host_config:
3. "localhost":
4. acl:
5. admin:
6. user:
7. - "bob-local": "localhost"

1. ============
2. ACCESS RULES
   access: ## Maximum number of simultaneous sessions allowed for a single user:
   max_user_sessions:
   all: 10 ## Maximum number of offline messages that users can have:
   max_user_offline_messages:
   admin: 5000
   all: 100 ## This rule allows access only for local users:
   local:
   local: allow ## Only non-blocked users can use c2s connections:
   c2s:
   blocked: deny
   all: allow ## For C2S connections, all users except admins use the "normal" shaper
   c2s_shaper:
   admin: none
   all: normal ## All S2S connections use the "fast" shaper
   s2s_shaper:
   all: fast ## Only admins can send announcement messages:
   announce:
   admin: allow ## Only admins can use the configuration interface:
   configure:
   admin: allow ## Admins of this server are also admins of the MUC service:
   muc_admin:
   admin: allow ## Only accounts of the local ejabberd server can create rooms:
   muc_create:
   local: allow ## All users are allowed to use the MUC service:
   muc:
   all: allow ## Only accounts on the local ejabberd server can create Pubsub nodes:
   pubsub_createnode:
   local: allow ## In-band registration allows registration of any possible username. ## To disable in-band registration, replace 'allow' with 'deny'.
   register:
   all: allow ## Only allow to register from localhost
   trusted_network:
   loopback: allow ## Do not establish S2S connections with bad servers ## s2s: ## bad_servers: deny ## all: allow

1. By default the frequency of account registrations from the same IP
2. is limited to 1 account every 10 minutes. To disable, specify: infinity
3. registration_timeout: 600

##

1. Define specific Access Rules in a virtual host. ##
2. host_config:
3. "localhost":
4. access:
5. c2s:
6. admin: allow
7. all: deny
8. register:
9. all: deny

1. ================
2. DEFAULT LANGUAGE

##

1. language: Default language used for server messages. ##
   language: "en"

##

1. Set a different default language in a virtual host. ##
2. host_config:
3. "localhost":
4. language: "ru"

1. =======
2. CAPTCHA

##

1. Full path to a script that generates the image. ##
2. captcha_cmd: "/lib/ejabberd/priv/bin/captcha.sh"

##

1. Host for the URL and port where ejabberd listens for CAPTCHA requests. ##
2. captcha_host: "example.org:5280"

##

1. Limit CAPTCHA calls per minute for JID/IP to avoid DoS. ##
2. captcha_limit: 5

1. =======
2. MODULES

##

1. Modules enabled in all ejabberd virtual hosts. ##
   modules:
   mod_adhoc: {}
   mod_announce: # recommends mod_adhoc
   access: announce
   mod_blocking: {} # requires mod_privacy
   mod_caps: {}
   mod_carboncopy: {}
   mod_configure: {} # requires mod_adhoc
   mod_disco: {} ## mod_echo: {}
   mod_irc: {}
   mod_http_bind: {} ## mod_http_fileserver: ## docroot: "/var/www" ## accesslog: "/var/log/ejabberd/access.log"
   mod_last: {}
   mod_muc: ## host: "conference.HOST"
   access: muc
   access_create: muc_create
   access_persistent: muc_create
   access_admin: muc_admin ## mod_muc_log: {}
   mod_offline:
   access_max_user_messages: max_user_offline_messages
   mod_ping: {} ## mod_pres_counter: ## count: 5 ## interval: 60
   mod_privacy: {}
   mod_private: {} ## mod_proxy65: {}
   mod_pubsub:
   access_createnode: pubsub_createnode ## reduces resource comsumption, but XEP incompliant
   ignore_pep_from_offline: true ## XEP compliant, but increases resource comsumption ## ignore_pep_from_offline: false
   last_item_cache: false
   plugins:
   - "flat"
   - "hometree"
   - "pep" # pep requires mod_caps
   mod_register: ## ## Protect In-Band account registrations with CAPTCHA. ## ## captcha_protected: true ##
   1. Set the minimum informational entropy for passwords. ##
   2. password_strength: 32
   ##
   1. After successful registration, the user receives
   2. a message with this subject and body. ##
      welcome_message:
      subject: "Welcome!"
      body: |-
      Hi.
      Welcome to this XMPP server.
   ##
   1. When a user registers, send a notification to
   2. these XMPP accounts. ##
   3. registration_watchers:
   4. - "admin1@example.org"
   ##
   1. Only clients in the server machine can register accounts ##
      ip_access: trusted_network
   ##
   1. Local c2s or remote s2s users cannot register accounts ##
   2. access_from: deny

   access: register
   mod_roster: {}
   mod_shared_roster: {}
   mod_stats: {}
   mod_time: {}
   mod_vcard: {}
   mod_version: {}

##

1. Enable modules with custom options in a specific virtual host ##
2. append_host_config:
3. "localhost":
4. modules:
5. mod_echo:
6. host: "mirror.localhost"

1. Local Variables:
2. mode: yaml
3. End:
4. vim: set filetype=yaml tabstop=8

----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----