I’ve set up an ejabberd server that I want to use as a game server only.
What things do I have to pay attention to regarding security and which steps are needed so that I can start using it as a game server? Of course, I want to enable communication between local users only, no communication to JIDs from other servers may be possible.
How can I disable features such as IRC and server-to-server? This has to be done in the ejabberd.cfg, right? Do I have to comment these paragraphs out or fill in empty brackets for their options?
I’ve defined the following access control list:
[{acl, admin, {user, "admin", "localhost"}},
{acl, admin, {user, "admin", "***.***.***.***"}},
{acl, local, {server, "localhost"}},
{acl, local, {server, "***.***.***.***"}}].
Regarding the access rights, is the following definition okay or should I disable all communication channels except for PubSub?
[{access, c2s, [{deny, blocked}, {allow, all}]},
{access, pubsub_createnode, [{allow, all}]},
{access, s2s_shaper, [{fast, all}]},
{access, c2s_shaper, [{none, admin}, {normal, all}]},
{access, muc, [{allow, all}]},
{access, max_user_sessions, [{2, all}]},
{access, configure, [{allow, admin}]},
{access, muc_admin, [{allow, admin}]},
{access, max_user_offline_messages,
[{5000, admin}, {100, all}]},
{access, announce, [{allow, admin}]},
{access, register, [{deny, all}]},
{access, local, [{allow, local}]}].
Afterwards, can I access the server via client libraries such as smack / asmack or do I need BOSH, HTTP-polling etc? Are XMPP ports open on mobile devices, usually?
Those security considerations above are most important to me, as I don’t want to run a game server with potential security risks. But apart from that, I can’t really get PubSub running yet.
On the client side, in the Android application, I use the asmack library and the following code to initiate a new XMPP session and send a message:
private void startXMPP() {
new Thread(new Runnable() {
public void run() {
try {
org.jivesoftware.smackx.ConfigureProviderManager.configureProviderManager();
ConnectionConfiguration xmppConfig = new ConnectionConfiguration("123.123.123.123");
xmppConfig.setDebuggerEnabled(true);
if (Build.VERSION.SDK_INT >= 14) {
xmppConfig.setTruststoreType("AndroidCAStore");
xmppConfig.setTruststorePassword(null);
xmppConfig.setTruststorePath(null);
xmppConfig.setSendPresence(true);
xmppConfig.setSecurityMode(SecurityMode.disabled);
}
else {
xmppConfig.setTruststoreType("BKS");
String path = System.getProperty("javax.net.ssl.trustStore");
if (path == null) {
path = "/system/etc/security/cacerts.bks";
}
xmppConfig.setTruststorePath(path);
}
SASLAuthentication.supportSASLMechanism("PLAIN", 0);
XMPPConnection xmpp = new XMPPConnection(xmppConfig);
xmpp.connect();
xmpp.login("john", "password");
PubSubManager xmppPubsub = new PubSubManager(xmpp);
ConfigureForm form = new ConfigureForm(FormType.submit);
form.setPersistentItems(false);
form.setDeliverPayloads(true);
form.setAccessModel(AccessModel.open);
form.setPublishModel(PublishModel.open);
form.setSubscribe(true);
LeafNode xmppNode;
try {
xmppNode = (LeafNode) xmppPubsub.createNode("TESTNODE", form);
}
catch (XMPPException e) {
xmppNode = (LeafNode) xmppPubsub.getNode("TESTNODE");
}
SimplePayload payload = new SimplePayload("book", "pubsub:test:book", "");
xmppNode.addItemEventListener(new ItemEventCoordinator<Item>());
xmppNode.subscribe("john@123.123.123.123");
xmppNode.publish(new PayloadItem<SimplePayload>(payload));
}
catch (Exception e) {
System.out.println("XMPP Connection failed!");
e.printStackTrace();
}
}
}).start();
}
Unfortunately, this does not work. Do you see why? As I have debugging enabled, I can see the following error message in LogCat:
<iq from='pubsub.123.123.123.123' to='john@123.123.123.123/Smack' id='Jf****6' type='result'><pubsub xmlns='http://jabber.org/protocol/pubsub'><subscription jid='john@123.123.123.123' subscription='subscribed' subid='53******B2'/></pubsub></iq>
<iq id="Je4Mf-7" to="pubsub.123.123.123.123" type="set"><pubsub xmlns="http://jabber.org/protocol/pubsub"><publish node='TESTNODE'><item></item></publish></pubsub></iq>
<iq from='pubsub.123.123.123.123' to='john@123.123.123.123/Smack' type='error' id='Jf****7'><pubsub xmlns='http://jabber.org/protocol/pubsub'><publish node='TESTNODE'><item/></publish></pubsub><error code='400' type='modify'><bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/><payload-required xmlns='http://jabber.org/protocol/pubsub#errors'/></error></iq>
Edit:
I’ve not set the PubSub node name to home/server/username/whatever as described in the documentation. But at least the creation of the node is working, though, isn’t it? I don’t want a name in that format because I need names such as “game234234” so that all participating users can join that PubSub node.
Moreover, there seem to be attempts to contact pubsub.***.***.***.*** which is not there, as I have not created the subdomain pubsub. Is that the cause of the problem? Is PubSub only available via that subdomain? I don’t know what to set up for that subdomain and would prefer to use PubSub just on the IP without subdomain.
You are getting an error on your publish() command since you have not specified the actual payload. Ideally, an exception should have been thrown since you created an invalid payload, but that seems to be the source of the error you are getting from the server.
Change
to:
and it should successfully publish.
Now there are a couple of other problems you need to address.
You are creating your connection within the run method which ends after the publish(), thus your connection passes out of scope and is eligible for GC.
Try doing a getNode() before creating. In your current order, after the first time your code is run you will always be hitting the exception case. You should simply do a getNode() first and then create one if an exception is thrown, or you could avoid the exception altogether by doing a discoverNodes() first to determine if the node exists.
As for your point about the pubsub subdomain. This is the commonly used subdomain for pubsub in many (maybe all) XMPP servers, including ejabberd. You don’t have to create it as the pubsub module already does that. It does exist already since you are already getting replies from it.