Mise à jour de 'Configuration prosody'
parent
00b97e8790
commit
d258a0b0b6
421
Configuration-prosody.md
Normal file
421
Configuration-prosody.md
Normal file
@ -0,0 +1,421 @@
|
||||
Voici un exemple de configuration du serveur prosody avec pywallter
|
||||
|
||||
## Configuration de prosody
|
||||
|
||||
Vous avez préalablement :
|
||||
* Configuré correctement votre zone DNS
|
||||
* Générer votre certificat ssl
|
||||
|
||||
On edite en premier le fichier /etc/prosody/prosody.cfg.lua
|
||||
|
||||
admins = { "admin@mondomaine.net" }
|
||||
|
||||
-- Drop privileges
|
||||
prosody_user = "_prosody"
|
||||
prosody_group = "_prosody"
|
||||
|
||||
-- Enable POSIX-only options
|
||||
pidfile = "/var/prosody/prosody.pid"
|
||||
|
||||
plugin_paths = { "/var/prosody/plugins" }
|
||||
|
||||
modules_enabled = {
|
||||
|
||||
-- Generally required
|
||||
"roster"; -- Allow users to have a roster. Recommended ;)
|
||||
"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
|
||||
"tls"; -- Add support for secure TLS on c2s/s2s connections
|
||||
"dialback"; -- s2s dialback support
|
||||
"disco"; -- Service discovery
|
||||
|
||||
-- Not essential, but recommended
|
||||
"carbons"; -- Keep multiple clients in sync
|
||||
"pep"; -- Enables users to publish their avatar, mood, activity, playing music and more
|
||||
"bidi";
|
||||
"private"; -- Private XML storage (for room bookmarks, etc.)
|
||||
"blocklist"; -- Allow users to block communications with other users
|
||||
"vcard4"; -- User profiles (stored in PEP)
|
||||
--"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
|
||||
"limits"; -- Enable bandwidth limiting for XMPP connections
|
||||
"smacks";
|
||||
-- Nice to have
|
||||
"version"; -- Replies to server version requests
|
||||
"uptime"; -- Report how long server has been running
|
||||
"time"; -- Let others know the time here on this server
|
||||
"ping"; -- Replies to XMPP pings with pongs
|
||||
"register"; -- Allow users to register on this server using a client and change passwords
|
||||
"mam"; -- Store messages in an archive and allow users to access it
|
||||
"csi_simple"; -- Simple Mobile optimizations
|
||||
|
||||
-- HTTP modules
|
||||
"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
|
||||
"websocket"; -- XMPP over WebSockets
|
||||
"http_files"; -- Serve static files from a directory over HTTP
|
||||
-- Other specific functionality
|
||||
"groups"; -- Shared roster support
|
||||
-- "proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
|
||||
}
|
||||
|
||||
allow_registration = false
|
||||
|
||||
-- Force clients to use encrypted connections? This option will
|
||||
-- prevent clients from authenticating unless they are using encryption.
|
||||
|
||||
c2s_require_encryption = true
|
||||
|
||||
-- Force servers to use encrypted connections? This option will
|
||||
-- prevent servers from authenticating unless they are using encryption.
|
||||
|
||||
s2s_require_encryption = true
|
||||
|
||||
-- Enable rate limits for incoming client and server connections
|
||||
|
||||
limits = {
|
||||
c2s = {
|
||||
rate = "10kb/s";
|
||||
};
|
||||
s2sin = {
|
||||
rate = "30kb/s";
|
||||
};
|
||||
}
|
||||
|
||||
-- Select the authentication backend to use. The 'internal' providers
|
||||
-- use Prosody's configured data storage to store the authentication data.
|
||||
|
||||
authentication = "internal_hashed"
|
||||
|
||||
archive_expires_after = "1w" -- Remove archived messages after 1 week
|
||||
|
||||
log = {
|
||||
info = "/var/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging
|
||||
error = "/var/prosody/prosody.err";
|
||||
-- "*syslog"; -- Uncomment this for logging to syslog
|
||||
-- "*console"; -- Log to the console, useful for debugging with daemonize=false }
|
||||
|
||||
|
||||
certificates = "/var/prosody/"
|
||||
|
||||
- WebSocket configuration (mod_websocket)
|
||||
consider_websocket_secure = true
|
||||
cross_domain_websocket = true
|
||||
|
||||
|
||||
------ Components ------
|
||||
-- You can specify components to add hosts that provide special services,
|
||||
-- like multi-user conferences, and transports.
|
||||
include "virtualHosts/*.conf"
|
||||
|
||||
Puis ensuite on créé le dossier virtualHosts :
|
||||
|
||||
# mkdir /etc/prosody/virtualHosts
|
||||
|
||||
Et on édite le fichier correspondant à notre domaine (mondomaine.net dans cet exemple)
|
||||
donc le fichier virtualHosts/mondomaine.net.conf :
|
||||
|
||||
VirtualHost "mondomaine.net"
|
||||
enable = true
|
||||
|
||||
|
||||
ssl = {
|
||||
key = "/etc/prosody/certs/mondomaine.net.key";
|
||||
certificate = "/etc/prosody/certs/mondomaine.net.crt";
|
||||
-- Configuration Avancé
|
||||
protocol = "tlsv1_2+";
|
||||
dhparam = "/etc/prosody/certs/dh-2048.pem";
|
||||
ciphers = "HIGH+kEECDH:!RSA:!SRP:!PSK:!3DES:!aNULL";
|
||||
options = { cipher_server_preference = true, no_compression = true, cipher_server_preference = true };
|
||||
|
||||
}
|
||||
|
||||
archive_expires_after = "15d";
|
||||
|
||||
-- Discovery items
|
||||
disco_items = {
|
||||
{ "muc.mondomaine.net" },
|
||||
{ "pubsub.mondomaine.net" },
|
||||
{ "jabber.mondomaine.net" },
|
||||
{ "upload.mondomaine.net" },
|
||||
};
|
||||
|
||||
-- contact_info = {
|
||||
-- abuse = { "mailto:abuse@mondomaine.net", "xmpp:admin@mondomaine.net" };
|
||||
-- admin = { "mailto:root@mondomaine.net", "xmpp:admin@mondomaine.net" };
|
||||
-- };
|
||||
|
||||
-- BOSH configuration (mod_bosh)
|
||||
consider_bosh_secure = true
|
||||
cross_domain_bosh = true
|
||||
|
||||
bosh_ports = {
|
||||
{
|
||||
port = 5280;
|
||||
path = "http-bind";
|
||||
},
|
||||
{
|
||||
port = 5281;
|
||||
path = "http-bind";
|
||||
ssl = {
|
||||
certificate = "/etc/ssl/mondomaine.net.crt";
|
||||
key = "/etc/ssl/private/mondomaine.net.key";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
http_ports = { 5280 }
|
||||
http_interfaces = { "localhost" }
|
||||
|
||||
https_ports = { 5281 }
|
||||
https_interfaces = { "localhost" }
|
||||
|
||||
https_ssl = {
|
||||
certificate = "/etc/prosody/certs/mondomaine.net.crt";
|
||||
key = "/etc/prosody/certs/mondomaine.net.key";
|
||||
}
|
||||
|
||||
|
||||
Component "muc.mondomain.net" "muc"
|
||||
name = "mondomaine.net Chatrooms"
|
||||
|
||||
modules_enabled = {
|
||||
"muc_limits";
|
||||
"muc_log";
|
||||
"muc_log_mam";
|
||||
"muc_log_http";
|
||||
"muc_vcard";
|
||||
}
|
||||
|
||||
muc_event_rate = 0.5
|
||||
muc_burst_factor = 10
|
||||
room_default_config = {
|
||||
logging = true,
|
||||
persistent = true
|
||||
};
|
||||
|
||||
|
||||
---Set up a PubSub server
|
||||
Component "pubsub.mondomaine.net" "pubsub"
|
||||
name = "mondomaine.net Publish/Subscribe"
|
||||
unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
|
||||
|
||||
---Set up a HTTP Upload service
|
||||
Component "upload.mondomaine.net" "http_upload_external"
|
||||
name = "mondomaine.net Sharing Service"
|
||||
http_upload_external_base_url = "https://upload.mondomaine.net/share.php/"
|
||||
http_upload_external_secret = "Mettre une phrase de passe ici"
|
||||
|
||||
|
||||
## Configuration Nginx pour l'envoie d'images:
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name upload.mondomaine.net;
|
||||
|
||||
#include snippets/acme-challenge.conf;
|
||||
|
||||
return 301 https://$http_host$request_uri;
|
||||
|
||||
access_log /var/log/nginx/upload.mondomaine.net-access.log;
|
||||
error_log /var/log/nginx/upload.mondomaine.net-error.log;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name upload.mondomaine.net;
|
||||
|
||||
ssl_certificate /etc/ssl/upload.mondomaine.net.crt;
|
||||
ssl_certificate_key /etc/ssl/private/upload.mondomaine.net.key;
|
||||
root /htdocs/;
|
||||
|
||||
include snippets/secure-ssl.conf;
|
||||
|
||||
include snippets/secure-headers.conf;
|
||||
#custom headers
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
add_header 'Access-Control-Allow-Methods' 'HEAD, GET, PUT, OPTIONS';
|
||||
add_header 'Access-Control-Allow-Headers' 'Authorization';
|
||||
add_header 'Access-Control-Allow-Credentials' 'true';
|
||||
add_header x-robots-tag "noindex, follow";
|
||||
client_max_body_size 105M; # Choose a value a bit higher than the max upload configured in XMPP server
|
||||
|
||||
|
||||
#add_header Strict-Transport-Security " max-age=63072000; includeSubDomains; preload";
|
||||
|
||||
|
||||
include snippets/acme-challenge.conf;
|
||||
location ~ share.php(?:$|/) {
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
}
|
||||
|
||||
access_log /var/log/upload.mondomaine.net-access.log;
|
||||
error_log /var/log/upload.mondomaine.net-error.log;
|
||||
}
|
||||
|
||||
|
||||
Puis dans notre dossier /htdocs nous mettrons nous éditerons notre fichier share.php :
|
||||
|
||||
<?php
|
||||
|
||||
/*
|
||||
PHP script to handle file uploads and downloads for Prosody's mod_http_upload_external
|
||||
|
||||
Tested with Apache 2.2+ and PHP 5.3+
|
||||
|
||||
** Why this script?
|
||||
|
||||
This script only allows uploads that have been authorized by mod_http_upload_external. It
|
||||
attempts to make the upload/download as safe as possible, considering that there are *many*
|
||||
security concerns involved with allowing arbitrary file upload/download on a web server.
|
||||
|
||||
With that said, I do not consider myself a PHP developer, and at the time of writing, this
|
||||
code has had no external review. Use it at your own risk. I make no claims that this code
|
||||
is secure.
|
||||
|
||||
** How to use?
|
||||
|
||||
Drop this file somewhere it will be served by your web server. Edit the config options below.
|
||||
|
||||
In Prosody set:
|
||||
|
||||
http_upload_external_base_url = "https://your.example.com/path/to/share.php/"
|
||||
http_upload_external_secret = "this is your secret string"
|
||||
|
||||
** License
|
||||
|
||||
(C) 2016 Matthew Wild <mwild1@gmail.com>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy of this software
|
||||
and associated documentation files (the "Software"), to deal in the Software without restriction,
|
||||
including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
||||
and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all copies or substantial
|
||||
portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
|
||||
BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
*/
|
||||
|
||||
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
|
||||
/* CONFIGURATION OPTIONS */
|
||||
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
|
||||
/* Change this to a directory that is writable by your web server, but is outside your web root */
|
||||
$CONFIG_STORE_DIR = '/xmpp-upload/mondomaine.net/upload';
|
||||
/* On met la même passephrase quand dans le fichier de conf de prosody */
|
||||
$CONFIG_SECRET = "Mettre une phrase de passe ici"
|
||||
/* For people who need options to tweak that they don't understand... here you are */
|
||||
$CONFIG_CHUNK_SIZE = 4096;
|
||||
|
||||
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
|
||||
/* END OF CONFIGURATION */
|
||||
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
|
||||
|
||||
/* Do not edit below this line unless you know what you are doing (spoiler: nobody does) */
|
||||
|
||||
$upload_file_name = substr($_SERVER['PHP_SELF'], strlen($_SERVER['SCRIPT_NAME'])+1);
|
||||
$store_file_name = $CONFIG_STORE_DIR . '/store-' . hash('sha256', $upload_file_name);
|
||||
|
||||
$request_method = $_SERVER['REQUEST_METHOD'];
|
||||
|
||||
/* Set CORS headers */
|
||||
header('Access-Control-Allow-Methods: GET, PUT, OPTIONS');
|
||||
header('Access-Control-Allow-Headers: Content-Type');
|
||||
header('Access-Control-Max-Age: 7200');
|
||||
header('Access-Control-Allow-Origin: *');
|
||||
|
||||
if(array_key_exists('v', $_GET) === TRUE && $request_method === 'PUT') {
|
||||
$upload_file_size = $_SERVER['CONTENT_LENGTH'];
|
||||
$upload_token = $_GET['v'];
|
||||
|
||||
$calculated_token = hash_hmac('sha256', "$upload_file_name $upload_file_size", $CONFIG_SECRET);
|
||||
if(function_exists('hash_equals')) {
|
||||
if(hash_equals($calculated_token, $upload_token) !== TRUE) {
|
||||
error_log("Token mismatch: calculated $calculated_token got $upload_token");
|
||||
header('HTTP/1.0 403 Forbidden');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
else {
|
||||
if($upload_token !== $calculated_token) {
|
||||
error_log("Token mismatch: calculated $calculated_token got $upload_token");
|
||||
header('HTTP/1.0 403 Forbidden');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
/* Open a file for writing */
|
||||
$store_file = fopen($store_file_name, 'x');
|
||||
|
||||
if($store_file === FALSE) {
|
||||
header('HTTP/1.0 409 Conflict');
|
||||
exit;
|
||||
}
|
||||
|
||||
/* PUT data comes in on the stdin stream */
|
||||
$incoming_data = fopen('php://input', 'r');
|
||||
|
||||
/* Read the data a chunk at a time and write to the file */
|
||||
while ($data = fread($incoming_data, $CONFIG_CHUNK_SIZE)) {
|
||||
fwrite($store_file, $data);
|
||||
}
|
||||
|
||||
/* Close the streams */
|
||||
fclose($incoming_data);
|
||||
fclose($store_file);
|
||||
|
||||
// https://xmpp.org/extensions/xep-0363.html#upload
|
||||
// A HTTP status Code of 201 means that the server is now ready to serve the file via the provided GET URL.
|
||||
header('HTTP/1.0 201 Created');
|
||||
exit;
|
||||
}
|
||||
else if($request_method === 'GET' || $request_method === 'HEAD') {
|
||||
// Send file (using X-Sendfile would be nice here...)
|
||||
if(file_exists($store_file_name)) {
|
||||
header('Content-Disposition: attachment');
|
||||
header('Content-Type: application/octet-stream');
|
||||
header('Content-Length: '.filesize($store_file_name));
|
||||
header("Content-Security-Policy: \"default-src 'none'\"");
|
||||
header("X-Content-Security-Policy: \"default-src 'none'\"");
|
||||
header("X-WebKit-CSP: \"default-src 'none'\"");
|
||||
if($request_method !== 'HEAD') {
|
||||
readfile($store_file_name);
|
||||
}
|
||||
} else {
|
||||
header('HTTP/1.0 404 Not Found');
|
||||
}
|
||||
} else if($request_method === 'OPTIONS') {
|
||||
} else {
|
||||
header('HTTP/1.0 400 Bad Request');
|
||||
}
|
||||
|
||||
exit;
|
||||
|
||||
## Configuration de pywallter
|
||||
Ensuite on edite le fichier config.py de pywallter pour activer la fonction XMPP :
|
||||
|
||||
XMPP_SERVER = True
|
||||
# Doas or sudo
|
||||
SETUID='doas'
|
||||
|
||||
On s'assure que la commande prosodyctl s'éxecute avec les bons droits et c'est bon on peut démarrer les services prosody et nginx
|
||||
et ensuite redemarrer pywallter:)
|
||||
Loading…
Reference in New Issue
Block a user