|
1803
|
1 ---
|
|
|
2 labels:
|
|
|
3 - 'Stage-Alpha'
|
|
|
4 - 'Type-S2SAuth'
|
|
|
5 summary: S2S authentication using DANE
|
|
|
6 ...
|
|
|
7
|
|
|
8 Introduction
|
|
|
9 ------------
|
|
|
10
|
|
|
11 This module implements DANE as described in[Using DNS Security
|
|
|
12 Extensions (DNSSEC) and DNS-based Authentication of Named Entities
|
|
|
13 (DANE) as a Prooftype for XMPP Domain Name
|
|
|
14 Associations](http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype).
|
|
|
15
|
|
|
16 Dependencies
|
|
|
17 ------------
|
|
|
18
|
|
|
19 This module requires a DNSSEC aware DNS resolver. Prosodys internal
|
|
|
20 DNSmodule does not support DNSSEC. Therefore, to use this module,
|
|
|
21 areplacement is needed, such as [this
|
|
|
22 one](https://www.zash.se/luaunbound.html).
|
|
|
23
|
|
|
24 More installation instructions can be found at [Prosody with
|
|
|
25 DANE](https://www.zash.se/prosody-dane.html).
|
|
|
26
|
|
|
27 Configuration
|
|
|
28 -------------
|
|
|
29
|
|
|
30 After [installing the
|
|
|
31 module](https://prosody.im/doc/installing_modules), just add it to
|
|
|
32 `modules_enabled`;
|
|
|
33
|
|
|
34 modules_enabled = {
|
|
|
35 ...
|
|
|
36 "s2s_auth_dane";
|
|
|
37 }
|
|
|
38
|
|
|
39 DNS Setup
|
|
|
40 ---------
|
|
|
41
|
|
|
42 In order for other services to verify your site using using this
|
|
|
43 plugin,you need to publish TLSA records (and they need to have this
|
|
|
44 plugin).Here's an example using "DANE-EE Cert SHA2-256" for a host
|
|
|
45 namedxmpp.example.com serving the domain example.com.
|
|
|
46
|
|
|
47 $ORIGIN example.com.
|
|
|
48 ; Your standard SRV record
|
|
|
49 _xmpp-server._tcp.example.com IN SRV 0 0 5269 xmpp.example.com.
|
|
|
50 ; IPv4 and IPv6 addresses
|
|
|
51 xmpp.example.com. IN A 192.0.2.68
|
|
|
52 xmpp.example.com. IN AAAA 2001:0db8:0000:0000:4441:4e45:544c:5341
|
|
|
53
|
|
|
54 ; The DANE TLSA records. These three are equivalent, you would use only one of them.
|
|
|
55 ; First, using symbolic names:
|
|
|
56 _5269._tcp.xmpp.example.com. 300 IN TLSA DANE-EE Cert SHA2-256 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
|
|
|
57 ; Using numbers:
|
|
|
58 _5269._tcp.xmpp.example.com. 300 IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
|
|
|
59 ; Raw binary format, should work even with very old DNS tools:
|
|
|
60 _5269._tcp.xmpp.example.com. 300 IN TYPE52 \# 35 030001E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
|
|
|
61
|
|
|
62 [List of DNSSEC and DANE
|
|
|
63 tools](http://www.internetsociety.org/deploy360/dnssec/tools/)
|
|
|
64
|
|
|
65 Further reading
|
|
|
66 ---------------
|
|
|
67
|
|
|
68 - [DANE TLSA implementation and operational
|
|
|
69 guidance](http://tools.ietf.org/html/draft-ietf-dane-ops)
|
|
|
70
|
|
|
71 Compatibility
|
|
|
72 -------------
|
|
|
73
|
|
|
74 Requires 0.9 or above.
|
