3

I have MongooseIM server configured with docker-compose in an EC2 instance in AWS.

I intend to give access to some mobile clients with SSL through an ELB (AWS) on port 5222 (module ejabberd_c2s of mongooseim) in the following way:

     SSL (Secure TCP) -> 5222 -> TCP -> 5222  (EC2 Instance Port)

In the ejabberd_c2s module configuration I have the following:

    { 5222, ejabberd_c2s, [

                %%
                %% If TLS is compiled in and you installed a SSL
                %% certificate, specify the full path to the
                %% file and uncomment this line:
                %%
                {certfile, "priv/ssl/fake_server.pem"}, starttls,

                %%{zlib, 10000},
                %% https://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS
                %% {ciphers, "DEFAULT:!EXPORT:!LOW:!SSLv2"},
                {access, c2s},
                {shaper, c2s_shaper},
                {max_stanza_size, 65536},
                {protocol_options, ["no_sslv3"]}

               ]},

But customers can not connect, the only message I get on the server is this:

    mongooseim_server_dev | 10:58:25.885 [info] (#Port<0.27608>) Accepted connection {{10,0,17,246},42571} -> {{172,18,0,2},5222}
    mongooseim_server_dev | 10:58:25.885 [debug] Received XML on stream = "���yw�\��.ndEt�;�����fn�A>� n:�=5��</A
     "ngooseim_server_dev | ��kj98����g@32ED�(#
    mongooseim_server_dev | 10:58:25.885 [debug] Send XML on stream = <<"<?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' id='2B421BCD2D077161' from='localhost' version='1.0'>">>
    mongooseim_server_dev | 10:58:25.886 [debug] Send XML on stream = <<"<stream:error><xml-not-well-formed xmlns='urn:ietf:params:xml:ns:xmpp-streams'/></stream:error>">>
    mongooseim_server_dev | 10:58:25.886 [debug] Send XML on stream = <<"</stream:stream>">>

The Mongoose documentation does not offer me any solution and I do not see anyone with this error.

Any help or clue?

AndoniRodriguez
  • 47
  • 6

1 Answers1

5

From your description and MongooseIM log snippet I reckon that the client is starting an encrypted connection from the beginning - that's why the "Received XML" seems to be garbage.

In XMPP an initially plaintext connection is upgraded to a secure connection using STARTTLS. This should work fine with ELB with TCP forwarding and no TLS termination, you just have to make sure the client is not trying to use SSL/TLS from the get go, but uses STARTTLS. All popular XMPP libraries should have this option, it's part of core XMPP.

[...] it is easier to put an ELB TCP to TCP and encrypt by TLS once the connection is open?

Exactly.

I mainly use an ELB to avoid having to handle SSL by myself and if I can not get it, would it be better to directly expose the mongoose server to the Internet?

ELB can't be used for SSL termination for plain XMPP. The available options are:

  1. ELB forwards plain TCP, MongooseIM plain XMPP listener is used - Client opens a TCP connection but upgrades it via STARTTLS, all EC2 instances require cert provisioning.

  2. ELB is set up for HTTPS termination, MongooseIM uses BOSH listener - BOSH is XMPP over HTTP, so has some overhead, but the benefit of SSL/TLS offloading might be worth it, no headache with certs on EC2 instances.

Community
  • 1
  • 1
erszcz
  • 1,630
  • 10
  • 16
  • First of all, thanks for your answer! So I understand that it is easier to put an ELB TCP to TCP and encrypt by TLS once the connection is open? Because I mainly use an ELB to avoid having to handle SSL by myself and if I can not get it, would it be better to directly expose the mongoose server to the Internet? Any recommendations on how to expose a MongooseIM server in AWS? Thank you very much for your attention. – AndoniRodriguez Jan 16 '19 at 14:00
  • Ahhh, my bad! I didn't read "SSL (Secure TCP) -> 5222 -> TCP -> 5222 (EC2 Instance Port)" properly. I've updated the answer accordingly. – erszcz Jan 16 '19 at 15:31
  • "would it be better to directly expose the mongoose server to the Internet?" You might do that if you don't want ELB for load balancing and consider DNS load balancing sufficient - which you'll have to set up. DNS records will probably take a while to update when MongooseIM EC2 instances go up/down, but it might or might not be a problem in your case. – erszcz Jan 16 '19 at 15:34
  • Thanks for answer! "ELB can't be used for SSL termination for plain XMPP." Ok, then I go for plain TCP in ELB and self-signed certificates (upgrading the connection with STARTTLS in mobile clients) We can not use SSL with BOSH because XMPPFramework does not support it. https://stackoverflow.com/questions/26689261/enable-bosh-services-in-xmpp-ios-framework-xmppframework-to-create-chat-based Once again, thanks for your time and your knowledge, really useful. Regards! – AndoniRodriguez Jan 17 '19 at 08:25