Jabberd2:安装和管理指南

可选的名称

          su
          groupadd jabber
          useradd -g jabber jabber
          su
          mkdir -p /usr/local/var/jabberd/pid/
          chown -R jabber:jabber /usr/local/var/jabberd/pid/
          mkdir -p /usr/local/var/jabberd/log/
          chown -R jabber:jabber /usr/local/var/jabberd/log
      tar -zxvf  jabberd-2.0s3.tar.gz
      cd jabberd-2.0s3
          ./configure --help
          ./configure --enable-mysql --enable-ssl --enable-idn
      ./configure --enable-db --enable-debug --enable-ssl --enable-idn
      ./configure --enable-pgsql --enable-ssl --enable-idn \
      --with extra-include-path=/usr/local/include:/usr/local/include/mysql \
      --with-extra-library-path=/usr/local/lib:/usr/local/lib/mysql
      ./configure
      make
      su
      make install
      /usr/local/etc/jabberd     Jabberd Configuration Files
      /usr/local/bin       Jabberd Binaries (jabberd, c2s, resolver, router, s2s, sm)
      chown -R root:jabber /usr/local/etc/jabberd/*
      chmod -R 640 /usr/local/etc/jabberd/*
          ln -s /usr/local/etc/jabberd/ /etc/jabberd
      <!-- Session manager configuration -->
      <sm>
        <!-- Our ID on the network. Users will have this as the domain part of
             their JID. If you want your server to be accessible from other
             Jabber servers, this ID must be resolvable by DNS.s
             (default: localhost) -->
        <id>somemachine.somedomain.com</id>
      <!-- Local network configuration -->
      <local>
        <!-- Who we identify ourselves as. This should correspond to the
             ID (host) that the session manager thinks it is. You can
             specify more than one to support virtual hosts, as long as you
             have additional session manager instances on the network to
             handle those hosts. The realm attribute specifies the auth/reg
             or SASL authentication realm for the host. If the attribute is
             not specified, the realm will be selected by the SASL
             mechanism, or will be the same as the ID itself. Be aware that
             users are assigned to a realm, not a host, so two hosts in the
             same realm will have the same users.
             If no realm is specified, it will be set to be the same as the
             ID. -->
        <id>somemachine.somedomain.com</id>
           mkdir -p /usr/local/var/jabberd/db
           chown -R jabber:jabber /usr/local/var/jabberd
      <!-- Storage database configuration -->
        <storage>
          <!-- By default, we use the MySQL driver for all storage -->
          <driver>db</driver>
          <!-- Berkeley DB driver configuration -->
          <db>
            <!-- Directory to store database files under -->
            <path>/usr/local/var/jabberd/db</path>
 
            <!-- Synchronize the database to disk after each write. If you
                 disable this, database accesses may be faster, but data may
                 be lost if jabberd crashes. -->
            <sync/>
          </db>
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>db</module>
          <!-- Berkeley DB module configuration -->
          <db>
            <!-- Directory to store database files under -->
            <path>/usr/local/var/jabberd/db</path>
 
            <!-- Synchronize the database to disk after each write. If you
                 disable this, database accesses may be faster, but data may
                 be lost if jabberd crashes. -->
            <sync/>
          </db>
   mysql -u root -p
   mysql>\. db-setup.mysql
 GRANT select,insert,delete,update ON jabberd2.* 
      to jabberd2@localhost IDENTIFIED by 'secret';
      ln -s /var/lib/mysql/mysql.sock /tmp/mysql.sock
 <!-- Storage database configuration -->
        <storage>
          <!-- By default, we use the MySQL driver for all storage -->
          <driver>mysql</driver>
 <!-- MySQL driver configuration -->
      <mysql>
        <!-- Database server host and port -->
        <host>localhost</host>
        <port>3306</port>
 
        <!-- Database name -->
        <dbname>jabberd2</dbname>
 
        <!-- Database username and password -->
        <user>jabberd2</user>
        <pass>secret</pass>
 
        <!-- Transaction support. If this is commented out, transactions
             will be disabled. This might make database accesses faster,
             but data may be lost if jabberd crashes.
 
             This will need to be disabled if you are using a MySQL
             earlier than v3.23.xx, as transaction support did not appear
             until this version. -->
        <transactions/>
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>mysql</module>
      <!-- MySQL module configuration -->
      <mysql>
        <!-- Database server host and port -->
        <host>localhost</host>
        <port>3306</port>
 
        <!-- Database name -->
        <dbname>jabberd2</dbname>
 
        <!-- Database username and password -->
        <user>jabberd2</user>
        <pass>secret</pass>
      </mysql>
      createdb -U postgres jabberd2
      createdb -U postgres -E UNICODE jabberd2
      createuser -P -U postgres jabberd2
      Enter password for user "jabberd2":
      Enter it again:
      Shall the new user be allowed to create databases? (y/n) n
      Shall the new user be allowed to create more new users? (y/n) n
      CREATE USER
      psql -U jabberd2 jabberd2
      jabberd2=>\i db-setup.pgsql
      <!-- Storage database configuration -->
        <storage>
          <!-- By default, we use the MySQL driver for all storage -->
          <driver>pgsql</driver>
      <!-- PostgreSQL driver configuration -->
      <pgsql>
        <!-- Database server host and port -->
        <host>localhost</host>
        <port>5432</port>
 
        <!-- Database name -->
        <dbname>jabberd2</dbname>
 
        <!-- Database username and password -->
        <user>jabberd2</user>
        <pass>secret</pass>
 
        <!-- Transaction support. If this is commented out, transactions
             will be disabled. This might make database accesses faster,
             but data may be lost if jabberd crashes. -->
        <transactions/>
      </pgsql>
     <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>pgsql</module>
      <!-- PostgreSQL module configuration -->
      <pgsql>
        <!-- Database server host and port -->
        <host>localhost</host>
        <port>5432</port>
 
        <!-- Database name -->
        <dbname>jabberd2</dbname>
 
        <!-- Database username and password -->
        <user>jabberd2</user>
        <pass>secret</pass>
      </pgsql>
      cp /etc/pam.d/system-auth /etc/pam.d/jabberd
      auth       required     pam_winbind.so
      password   required     pam_winbind.so
      account    required     pam_winbind.so
      session    required     pam_winbind.so
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>pam</module>
      <!-- Registration configuration -->
      <register>
        <!-- Account registration is enabled by default (provided the
             auth/reg module in use supports it). Comment this out to
             disable. -->
        <!-- <enable/> -->
      <!-- User options -->
      <user>
        <!-- By default, users must explicitly created before they can start
             a session. The creation process is usually triggered by a c2s
             component in response to a client registering a new user.
 
             Enableing this option will make it so that a user create will be
             triggered the first time a non-existant user attempts to start
             a session. This is useful if you already have users in an
             external authentication database (eg LDAP) and you don't want
             them to have to register. -->
        <auto-create/>
      allow bind_v2
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>ldap<module>
      <!-- LDAP module configuration -->
      <ldap>
        <!-- LDAP server host and port (default: 389) -->
        <host>ldap.example.com</host>
        <port>389</port>
 
        <!-- Use LDAP v3 if possible. If disabled, v2 will be used.
             Encryption options are only available if v3 is enabled. -->
        <!--
        <v3/>
        -->
 
        <!-- Encryption. If enabled, this will create an encrypted channel
             to the LDAP server using the LDAP STARTTLS mechanism. -->
        <!--
        <starttls/>
        -->
 
        <!-- Encryption. If enabled, this will create an encrypted channel
             to the server using the old-style "ldaps://" mechanism. It is
             recommended that you use <starttls/> instead of this. -->
        <!--
        <ssl/>
        -->
      <!-- DN to bind as for searches. If unspecified, the searches
           will be done anonymously. -->
      <!--
      <binddn>cn=Directory Manager</binddn>
      <bindpw>secret</bindpw>
      -->
      <!-- LDAP attribute that holds the user ID (default: uid) -->
      <uidattr>uid</uidattr>
 
      <!-- base DN of the tree. You should specify a DN for each
           authentication realm declared in the <local/> section above,
           by using the realm attribute. -->
      <basedn realm='company'>o=Company.com</basedn>
      <basedn>o=Example Corp.</basedn>
    </ldap>
      <!-- LDAP module configuration -->
      <ldap>
        <!-- LDAP server host and port (default: 389) -->
        <host>ldap.mydomain.org</host>
        <port>389</port>
 
        <!-- Use LDAP v3 if possible. If disabled, v2 will be used.
             Encryption options are only available if v3 is enabled. -->
 
        <v3/>
 
        <!-- Encryption. If enabled, this will create an encrypted channel
             to the LDAP server using the LDAP STARTTLS mechanism. -->
 
        <starttls/>
 
        <!-- Encryption. If enabled, this will create an encrypted channel
             to the server using the old-style "ldaps://" mechanism. It is
             recommended that you use <starttls/> instead of this. -->
        <!--
        <ssl/>
        -->
 
        <!-- DN to bind as for searches. If unspecified, the searches
             will be done anonymously. -->
 
        <!--
        <binddn>cn=admin,dc=mydomain,dc=org</binddn>
        <bindpw>snip</bindpw>
        -->          
 
        <!-- LDAP attribute that holds the user ID (default: uid) -->
        <uidattr>uid</uidattr>
 
        <!-- base DN of the tree. You should specify a DN for each
             authentication realm declared in the <local/> section above,
             by using the realm attribute. -->
 
        <basedn>ou=people,ou=design,dc=mydomain,dc=org</basedn>
      </ldap>
      <!-- Registration configuration -->
      <register>
        <!-- Account registration is enabled by default (provided the
             auth/reg module in use supports it). Comment this out to
             disable. -->
        <!-- <enable/> -->
      <!-- User options -->
      <user>
        <!-- By default, users must explicitly created before they can start
             a session. The creation process is usually triggered by a c2s
             component in response to a client registering a new user.
 
             Enableing this option will make it so that a user create will be
             triggered the first time a non-existant user attempts to start
             a session. This is useful if you already have users in an
             external authentication database (eg LDAP) and you don't want
             them to have to register. -->
        <auto-create/>
        su
        su jabber
        cd /usr/local/bin
        ./jabberd
        /usr/local/bin/jabberd -D
        <!-- File containing a SSL certificate and private key for client
             connections. If this is commented out, clients will not be
             offered the STARTTLS stream extension -->
 
        <pemfile>/usr/local/etc/jabberd/server.pem</pemfile>
        <ssl-port>5223</ssl-port>
        <!-- Require STARTTLS. If this is enabled, clients must do STARTTLS
             before they can authenticate. Until the stream is encrypted,
             all packets will be dropped. -->
 
        <require-starttls/>
        router.xml
        sm.xml
        resolver.xml
        s2s.xml
        c2s.xml
        <!-- Router connection configuration -->
        <router>
          <!-- IP/port the router is waiting for connections on -->
          <ip>127.0.0.1</ip>      <!-- default: 127.0.0.1 -->
          <port>5347</port>       <!-- default: 5347 -->
 
          <!-- Username/password to authenticate as -->
          <user>jabberd</user>    <!-- default: jabberd -->
          <pass>secret</pass>     <!-- default: secret -->
 
          <!-- File containing a SSL certificate and private key to use when
               setting up an encrypted channel with the router. If this is
               commented out, or the file can't be read, no attempt will be
               made to establish an encrypted channel with the router. -->
 
          <pemfile>/usr/local/etc/jabberd/server.pem</pemfile>
      <users>
        <user>
          <name>jabberd</name>
          <secret>newpass</secret>
        </user>
      </users>
      <!-- Router connection configuration -->
      <router>
        <!-- IP/port the router is waiting for connections on -->
        <ip>127.0.0.1</ip>      <!-- default: 127.0.0.1 -->
        <port>5347</port>       <!-- default: 5347 -->
 
        <!-- Username/password to authenticate as -->
        <user>jabberd</user>    <!-- default: jabberd -->
        <pass>newpass</pass>     <!-- default: secret -->
      <!-- Access control information -->
      <aci>
        <!-- The usernames listed here will get access to all restricted
             functions, regardless of restrictions further down -->
        <acl type='all'>
          <user>jabberd</user>
        </acl>
      <acl type='all'>  
        <jid>admin@lsomedomain.com</jid>
      </acl>
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>mysql</module>
 
        <!-- Registration configuration -->
        <register>
          <!-- Account registration is enabled by default (provided the
               auth/reg module in use supports it). Comment this out to
               disable. -->
          <!--
          <enable/>
          -->
      <!-- Authentication/registration database configuration -->
      <authreg>
        <!-- Backend module to use -->
        <module>mysql</module>
 
        <!-- Registration configuration -->
        <register>
          <!-- Account registration is enabled by default (provided the
               auth/reg module in use supports it). Comment this out to
               disable. -->
          <enable/>
 
          <!-- Human-readable instructions to be returned to client when
               registration is requested. -->
          <instructions>Enter a username and password to register with this server.</instructions>
 
          <!-- Password change only. When registration is disabled, it may
               still be useful to allow clients to change their password. If
               you want this, uncomment this when you disable registration. -->
          <password/>
        _jabber._tcp.<domain>   ->    <host>.<domain>:5269
        _xmpp-server._tcp.<domain>    ->    <host>.<domain>:5269 
        _xmpp-client._tcp.<domain>    ->    <host>.<domain>:5222
        _jabber._tcp.some_domain.com. 86400 IN SRV 5 0 5269 host.some_domain.com.
        _xmpp-server._tcp.some_domain.com. 86400 IN SRV 5 0 5269 host.some_domain.com.
        _xmpp-client._tcp.some_domain.com. 86400 IN SRV 5 0 5222 host.some_domain.com.
            :_jabber._tcp.some_domain.com:33:\000\012\000\000\024\225\004host\013some_domain\003com\000 
            :_xmpp-client._tcp.some_domain.com:33:\000\012\000\000\024\146\004host\013some_domain\003com\000 
            :_xmpp-server._tcp.some_domain.com:33:\000\012\000\000\024\225\004host\013some_domain\003com\000
        dig @my.dns_server.com _jabber._tcp.some_domain.com any +short
        10 0 5269 host.some_domain.com.

约定	名称	描述
P	参数	一个配置文件中关于你的特定安装的信息, 等等.
C	检查点	一个点，停止并检查你的安装
N	注意	强调信息
I	重要	重要的强调或警告
F	必需的文件	完成这一步或下列步骤所需要的软件或特定文件
O	可选步骤	这一步在大部分基本安装中不是必需的步骤
E	外部系统	这一步可能需要在外部系统配置，如路由器

参数	必需的	章节	描述	你的信息
Jabberd User and Group	Y	2.2	Linux(或其他OS)用户和组，将用于运行Jabberd	user: jabber group: jabber
PID Directory	Y	2.3	Jabberd存储PID文件的目录	/usr/local/var/jabberd/pid
Log Directory	N	2.3	用于Jabberd logs的目录. 如果在配置文件中不指定, 日志缺省存在syslog.	/usr/local/var/jabberd/log
Authentication Package	Y	2.4.3 3.3,	Jabberd验证管理使用的第三方包	MySQL, PostgreSQL, Berkeley DB, OpenLDAP or PAM
Data Storage Package	Y	2.4.4 4.3	用于存储Jabberd数据的第三方包	MySQL, PostgreSQL or Berkeley DB
Data Directory	Berkeley DB	4.1.1, 4.2.1,	用于存储Berkeley DB数据文件的目录	/usr/local/var/jabberd/db
MySQL User and Password	MySQL	3.5.2.2, 4.1.2, 4.2.2,	Jabberd用于连接MySQL的MySQL用户名和密码	user: jabberd2 password: secret
PostgreSQL User and Password	PostgreSQL	3.5.3.1, 1 3, 4.2.3,	Jabberd用于连接PostgreSQL的PostgreSQL用户名和密码	user: jabberd2 password: secret
OpenLDAP Connection Settings	OpenLDAP	2.5	用于你的OpenLDAP服务器连接设置: 指定LDAP服务器(或IP)的FQDN,端口,和LDAP使用的版本(要么v2要么v3)
OpenLDAP User and Password	OpenLDAP	4.2.5	连接到你的OpenLDAP服务器的用户名和密码. 只有你的OpenLDAP服务器不允许匿名绑定(访问)时才需要
OpenLDAP Query Settings	OpenLDAP	4.2.5	Base DN (识别名) 和 User ID 属性用于为OpenLDAP服务器建立查询. Base DN 可以要么是服务器的root DN 要么是一个可以在它那找到 User ID's 的 RDN (相对的识别名).
Hostname	Y	4.4	你的安装了Jabberd服务器的主机名. 对于可从互联网访问的服务器, 看起来类似 somedomain.com
SSL Key Location	N	5.3.1, 5.3.2	OpenSSL证书文件的位置. 对于SSL加密通讯是必需的	/usr/local/etc/jabberd/server.pem
Router User and Password	N	5.4	用于别的组件连接到Jabberd Router组件的用户名和密码	user: jabberd2 password: secret

Jabberd2:安装和管理指南

目录

绪论

目的和范围

需要的背景知识

如何使用本文档

本文使用的约定

更多阅读

法律术语

来源

准备安装Jabberd2

收集必需的信息

新建Jabber用户和组

为PID's和Logs新建目录

安装先决条件

OpenSSL

Libidn

数据存储包

验证包

安装Jabberd 2

下载Jabberd 2

提取Jabberd安装文件

配置Jabberd编译

编译Jabberd

安装Jabberd

缺省文件位置

设置配置文件的所有权

基本配置

在sm.xml和c2s.xml设置主机名

对存储和验证包的提供和配置

提供和配置BerkeleyDB

提供BerkeleyDB

配置存储使用BerkeleyDB(sm.xml)

配置验证使用BerkeleyDB(c2s.xml)

提供和配置MySQL

提供MySQL

配置存储使用MySQL(sm.xml)

配置验证使用MySQL(c2s.xml)

提供和配置PostgreSQL

提供PostgreSQL

配置存储使用PostgreSQL(sm.xml)

配置验证使用PostgreSQL(c2s.xml)

提供和配置PAM

提供PAM

配置验证使用PAM(c2s.xml)

提供和配置OpenLDAP

提供OpenLDAP

配置验证使用OpenLDAP(c2s.xml)

测试服务器

常规配置任务

为互联网访问配置防火墙

配置Jabberd 2使用SSL连接

分配一个用于Jabber客户端的证书

分配一个用于Jabberd组件的证书

修改Router密码

创建管理员用户

禁止公开注册

允许用户修改密码

设置DNS SRV记录

Jabberd使用SRV记录

在 Bind 里创建SRV记录

在 TinyDNS 里创建SRV记录

测试SRV记录

使用Jabberd 1.4连接外部服务

XDB段落

Log段落

Router的IP地址和端口

共享密码

Router别名

例子:muc.xml

使用JCR作为Jabberd 2组件

安装一个使用Users-Agent的JUD

集成vCard数据到Users-Agent(仅限私有服务器)

查看

个人工具

导航

XMPP资源

搜索

工具箱