Corporate Instant Messaging system.
Task: installation of corporate Instant Messaging gateway with possibility of logging of all conversations.
Including adjustment of transport for others IM networks (ICQ, MSN, AIM ) As well as authentication of users in LDAP.
The choice between LCS (Live Communication Server M$) and XMPP/Jabber has been made instantly ;) .
It is necessary to choose only which Jabber server to use.
From the considered variants:
chime (Java) http://www.codecobra.com/chime/
DJabberd (Perl) http://danga.com/djabberd/
ejabberd (Erlang) Home page and Community Site
jabberd14 (C) http://jabberd.org/
jabberd2 (C) http://jabberd2.xiaoka.com/
Openfire (Wildfire Server) (Java) http://www.igniterealtime.org/projects/openfire/
OpenIM (Java) http://www.open-im.net/
pretzel (Python) http://code.google.com/p/pretzel/
psyced (LPC) http://www.psyced.org/
Tigase (Java) http://www.tigase.org/
WPJabber (C) http://spik.wp.pl/jabber.html
xmppd.py (Python) http://xmpppy.sourceforge.net/
For comparison the following document has been taken: http://www.jabber.org/admin/jsc/
From the advantages listed above - ejabberd option has been choosen mostly for the following reasons :
1.Protocol-standards compatibility (XMPP Core, XMPP IM),
2.fully distributable
3.database can be replicated to many nodes .
4.The default database, Mnesia, is suitable for small, as well as big deployments.
5.code can be updated while ejabberd is running (feature of Erlang)
6.loading and unloading of modules while ejabberd is running is possible (feature of Erlang)
7.Modular design
Installation
I have install ejabberd on FreeBSD 6.2 , I think that there won`t be large differences in Linux operating system.
Installation performed by ports using “portinstall”.
Before starting installation - it is necessary to download following software:
diablo-jdk
tzupdater (JDK US DST Timezone Update Tool)
Let's execute following actions:
cd /usr/ports/distfiles/
lynx 'http://www.FreeBSDFoundation.org/cgi-bin/download?download=diablo-caffe-freebsd6-i386-1.5.0_07-b01.tar.bz2'
(Read and follow the license agreement)
Download via your web browser http://java.sun.com/javase/downloads/index.jsp
and copy tzupdater-x_x_x_x_x.zip to /usr/ports/distfiles/
installing ejabberd:
cd /usr/ports/
portinstall -p ejabberd-1.1.4
Don't enable support ODBC .
If all these components successfully compiled and installed - the following line should appear in /etc/rc.conf
ejabberd_enable="YES"
DNS Records
eJabberd server and clients, are able to use DNS SRV records for hostname resolution. DNS SRV records allow for delegation of services — by port — to other hosts.
I described setting for BIND , if You use other DNS server - please check following documentation: http://jabberd.jabberstudio.org/2/docs/section05.html#5_7
There are 3 SRV records that could be created for a eJabberd server installation:
_jabber._tcp.your_domain.com. 86400 IN SRV 5 0 5269 host.your_domain.com.
_xmpp-server._tcp.your_domain.com. 86400 IN SRV 5 0 5269 host.your_domain.com.
_xmpp-client._tcp.your_domain.com. 86400 IN SRV 5 0 5222 host.your_domain.com.
Replace “you_domain” with Your Domain Name and host with hostname, and don't forget to put “.” after the domain name.
Let's configure eJabber.
cp /usr/local/etc/ejabberd/ejabberd.cfg.example /usr/local/etc/ejabberd/ejabberd.cfg
cp /usr/local/etc/ejabberd/ejabberd.defaults.example /usr/local/etc/ejabberd/ejabberd.defaults
and edit fail:
vi /usr/local/etc/ejabberd/ejabberd.cfg
{acl, admin, {user, "alex"}}.
Let's add here our user who will have the Administrator permission.
Change “localhost” to Your Server name.
% Host name:
{hosts, ["host.your_domain.com"]}.
Configure support SSL:
vi /usr/local/etc/ejabberd/ejabberd.cfg
% Listened ports:
{listen,
[{5222, ejabberd_c2s, [{access, c2s},
{max_stanza_size, 65536},
starttls, {certfile, "/usr/local/etc/ejabberd/server.pem"},
{shaper, c2s_shaper}]},
{5223, ejabberd_c2s, [{access, c2s},
{max_stanza_size, 65536},
tls, {certfile, "/usr/local/etc/ejabberd/server.pem"},
{shaper, c2s_shaper}]},
% Use STARTTLS+Dialback for S2S connections
{s2s_use_starttls, true}.
{s2s_certfile, "/usr/local/etc/ejabberd/server.pem"}. Full path to file sertificate !!!
Now We will create the certificate :
cd /usr/local/etc/ejabberd/
openssl req -new -x509 -nodes -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem -subj
"/C=XX/ST=XX/L=XX/O=XX/OU=XX/CN=host.your_domain.com/emailAddress="postmaster@your_domain.com
cat privkey.pem >> server.pem
rm privkey.pem
...and start our server by: /usr/local/etc/rc.d/ejabberd start
(Try to telnet localhost 5222 or 5223 for SSL in order to check this.)
Now you have working and reliable jabber server.
LDAP
What about authentication abilities ? We need to authenticate users against LDAP server and to use LDAP Directory as vCard storage.
Edit the file - ejabberd.cfg
vi /usr/local/etc/ejabberd/ejabberd.cfgand then just restart eJabber /usr/local/etc/rc.d/ejabberd restart
% Authentication method.
%{auth_method, internal}. <---!!! Comment this line !!!!
% For LDAP authentication use these lines instead of above one:
{auth_method, ldap}.
{ldap_servers, ["ldap.your_domain.com"]}. % List of LDAP servers
{ldap_uidattr, "uid"}. % LDAP attribute that holds user ID
{ldap_base, "ou=People,dc=your_domain,dc=com"}. % Search base of LDAP directory
{ldap_rootdn, "cn=jabber,ou=DSA,dc=your_domain,dc=com"}. % LDAP manager
{ldap_password, "password"}. % Password to LDAP manager
Now We want to use user`s LDAP-info as their vCard. In order to implement this - find and edit the following
line in section
% Used modules:
{mod_vcard_ldap, [{host, "ldapyour_domain.com"}]},
Logging Messages
I usеd for this purpose "Bandersnatch" software. http://funkypenguin.co.za/
Originally , this soft works perfectly , but have a little issue with different encoding.
I need to log different languages such a France, Russian, Hebrew, Spain in my company.
So, I made a little correction in the Perl script and Data Base structure for "Bandersnatch".
If someone will be interested - please ask me by e-mail, I will send you by the reply
attached files.
...unpack "Bandersnatch" archive to special directory and make executable bandersnatch Perl script
chmod +x bandersnatch
Cofigure ejabberd:
Edit ejabberd.cfg and add this line to the 'modules' section:
{mod_service_log, [{loggers, ["bandlog.your_domain.com"]}]},
Add the following lines to 'listen' section to give eJabberd ability to listen for Bandersnatch connect.mysql -u root -pPassword bandlog < bandersnatch.sql (I recommend use my file bandersnatch.sql)
% listen for Bandersnatch connections
{5526, ejabberd_service, [{ip, {127, 0, 0, 1}}, {access, all},
{hosts, ["bandlog.your_domain.com"],
[{password, "password"}]}]}
Create DB for Log System
Configure Bandersnatch:
edit config.xml
<server>
<connectiontype>tcpip</connectiontype>
<hostname>localhost</hostname>
<port>5526</port>
<secret>password</secret>
</server>
<component>
<name>bandersnatch@bandlog.your_domain.com</name>
</component>
<mysql>
<server>localhost</server>
<dbname>bandlog</dbname>
<username>bandlog</username>
<password>bandlog</password>
</mysql>
Do not forget to add to DNS a new A record ( like this example ):
bandlog A 192.168.1.1 ( jabber server's IP)
Now restart Your eJabberd server:
/usr/local/etc/rc.d/ejabberd restart
And run in "screen" bandersnatch:
./path/to/bandersnatch/bandrsnatch config.xml
if You see output like this:
Bandersnatch: Connected to Jabber server (localhost) ...
Bandersnatch: Connected to MySQL database (bandlog@localhost) ...
You have successfully installed the system !
Transports
I srongly recomend read befor:
http://wiki.blathersource.org/wiki/index.php/PyICQt
http://wiki.blathersource.org/wiki/index.php/PyAIMt
http://delx.cjb.net/pymsnt/docs/user.html
but if you have reached this point without a problem, with "transport" installation You should not have any problems.
I describe it together (ICQ, MSN, AIM) . At the moment of a writing of this article in OS FreeBSD port jabber-yahoo-2.3.2_2 has been marked IGNORE (broken)
please check for status of Yahoo transport on site http://yahoo-transport-2.jabberstudio.org/
So, let's install all needed software:
portinstall -p jabber-pyicq-transport-0.8a
portinstall -p jabber-pymsn-transport-0.11.2_2,1
portinstall -p jabber-pyaim-transport-0.8a
Add following "A" records to DNS
icq.your_domain.com
msn.your_domain.com
aim.your_domain.com
Edit following rc scripts in /usr/local/etc/rc.d:
jabber-pyaim-transport
: ${jabber_pyaim_enable="YES"}
: ${jabber_pyaim_dir="/usr/local/lib/jabber/pyaim"}
: ${jabber_pyaim_piddir="/var/spool/ejabberd/pid"}
: ${jabber_pyaim_user="ejabberd"}
jabber-pyicq-transport
: ${jabber_pyicq_enable="YES"}
: ${jabber_pyicq_dir="/usr/local/lib/jabber/pyicq"}
: ${jabber_pyicq_piddir="/var/spool/ejabberd/pid"}
: ${jabber_pyicq_user="ejabberd"}
jabber-pymsn-transport
: ${jabber_pymsn_enable="YES"}
: ${jabber_pymsn_dir="/usr/local/lib/jabber/pymsn"}
: ${jabber_pymsn_piddir="/var/spool/ejabberd/pid"}
: ${jabber_pymsn_user="ejabberd"}
Do not forgot make symlink and change owner:
chown -R /usr/local/lib/jabber/
chown -R /var/spool/ejabberd/
ln -s /var/spool/ejabberd /var/spool/jabber
Now let's edit config of eJabberd server:
vi /usr/local/etc/ejabberd/ejabberd.cfg
in section
% Listened ports:
add
% listen for PyICQt connections
{5347, ejabberd_service, [{access, all},{host, "icq.your_domain.com",
[{password, "preved"}]}]},
% listen for PyMSNt connections
{5348, ejabberd_service, [{host, "msn.your_domain.com",
[{password, "password"}]}]},
% listen for PyAIMt connections
{5349, ejabberd_service, [{host, "aim.your_domain.com",
[{password, "password"}]}]}
Edit following config of transports:
jabber-pyicq.xml
<jid>icq.your_domain.com</jid>
<spooldir>/var/spool/ejabberd</spooldir>
<pid>/var/spool/ejabberd/pid/PyICQt.pid</pid>
<mainServer>127.0.0.1</mainServer>
<port>5347</port>
<secret>preved</secret>
jabber-pymsn.xml
<jid>msn.your_domain.com</jid>
<spooldir>/var/spool/ejabberd</spooldir>
<pid>/var/spool/ejabberd/pid/PyMSNt.pid</pid>
<mainServer>127.0.0.1</mainServer>
<port>5348</port>
<secret>password</secret>
<getAllAvatars/>
jabber-pyaim.xml
<jid>aim.your_domain.com</jid>
<spooldir>/var/spool/ejabberd</spooldir>
<pid>/var/spool/ejabberd/pid/PyAIMt.pid</pid>
<mainServer>127.0.0.1</mainServer>
<port>5349</port>
<secret>password</secret>
Last stap - add to /etc/rc.conf following lines:
jabber_pyicq_enable="YES"
jabber_pymsn_enable="YES"
jabber_pyaim_enable="YES"
Now restart Your eJabberd server:
/usr/local/etc/rc.d/ejabberd restart
and run all transports:
/usr/local/etc/rc.d/jabber-pyaim-transport start
/usr/local/etc/rc.d/jabber-pyicq-transport start
/usr/local/etc/rc.d/jabber-pymsn-transport start
P.S.
about a Jabber Client software You can find more here http://en.wikipedia.org/wiki/List_of_Jabber_client_software
I recommend "PSI" and "Gajem".
