{"action":"created","comment":{"url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/comments/22645787","id":22645787,"diff_hunk":"@@ -31,30 +31,46 @@ \\subsection{ejabberd}\n \n \\subsubsection{Tested with Versions}\n \\begin{itemize*}\n-  \\item Debian Wheezy 2.1.10-4+deb7u1\n+  \\item 13.6 - 14.12\n \\end{itemize*}\n \n \\subsubsection{Settings}\n ejabberd is one of the popular Jabber servers. In order to be compliant\n with the manifesto, you should adapt your configuration\\footnote{\\url{http://www.process-one.net/docs/ejabberd/guide_en.html}}:\n \n-\\configfile{ejabberd.cfg}{108-109,111-111,120-126,172-172,179-179,184-184}{%\n+\\configfile{ejabberd.yml}{104-107,113-113,114-114,119-119,123-123,125-125,127-127,135-137,141-143,192-192,200-200,204-206}{%\n   TLS setup for ejabberd}\n % \n \\subsubsection{Additional settings}\n-Older versions of ejabberd ($ < $ 2.0.0) need to be patched\\footnote{\\url{http://hyperstruct.net/2007/06/20/installing-the-startcom-ssl-certificate-in-ejabberd/}} to be able to parse all of the certificates in the CA chain.\n+It is possible to explicitly specify a cipher string for TLS connections.\n+\\configfile{ejabberd.yml}{104-107,113-114,119-119,123-123,125-125,127-127,134-137,139-139,141-143,192-192,200-200,204-207,211-211}{Specifying a cipher order and enforcing it}\n \n-Newer versions of ejabberd now support specifying the cipher string in the config file. See the commit message: \\url{https://github.com/processone/ejabberd/commit/1dd94ac0d06822daa8c394ea2da20d91c8209124}. However, this change did not yet make it into the stable release at the time of this writing. \n+Note that we are setting the SSL option cipher\\_server\\_preference. This enforces our cipher order when negotiating which ciphers are used, as the cipher order of some clients chooses weak ciphers over stronger ciphers.\\footnote{\\url{https://blog.thijsalkema.de/me/blog//blog/2013/09/02/the-state-of-tls-on-xmpp-3/}}\n \n+Other options you may want to take a look at are:\n+\\begin{itemize}\n+\\item The log level logs all login, including username and IP address, by default. Change the \\texttt{loglevel} setting to avoid this:\\\\\n+\\configfile{ejabberd.yml}{31-39}{Changing the logging behaviour}","path":"src/practical_settings/im.tex","position":null,"original_position":27,"commit_id":"1f1a3a8cf4441f39fc944b32a3a44fff44adee51","original_commit_id":"432e9a602b14ac3ac799363607a7ebe49c3076c0","user":{"login":"azet","id":855369,"avatar_url":"https://avatars.githubusercontent.com/u/855369?v=3","gravatar_id":"","url":"https://api.github.com/users/azet","html_url":"https://github.com/azet","followers_url":"https://api.github.com/users/azet/followers","following_url":"https://api.github.com/users/azet/following{/other_user}","gists_url":"https://api.github.com/users/azet/gists{/gist_id}","starred_url":"https://api.github.com/users/azet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/azet/subscriptions","organizations_url":"https://api.github.com/users/azet/orgs","repos_url":"https://api.github.com/users/azet/repos","events_url":"https://api.github.com/users/azet/events{/privacy}","received_events_url":"https://api.github.com/users/azet/received_events","type":"User","site_admin":false},"body":"ACK.","created_at":"2015-01-08T11:02:34Z","updated_at":"2015-01-08T11:02:34Z","html_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90#discussion_r22645787","pull_request_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90","_links":{"self":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/comments/22645787"},"html":{"href":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90#discussion_r22645787"},"pull_request":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90"}}},"pull_request":{"url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90","id":26972942,"html_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90","diff_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90.diff","patch_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90.patch","issue_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/90","number":90,"state":"open","locked":false,"title":"Updated for newer versions of ejabberd","user":{"login":"malexmave","id":1688580,"avatar_url":"https://avatars.githubusercontent.com/u/1688580?v=3","gravatar_id":"","url":"https://api.github.com/users/malexmave","html_url":"https://github.com/malexmave","followers_url":"https://api.github.com/users/malexmave/followers","following_url":"https://api.github.com/users/malexmave/following{/other_user}","gists_url":"https://api.github.com/users/malexmave/gists{/gist_id}","starred_url":"https://api.github.com/users/malexmave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malexmave/subscriptions","organizations_url":"https://api.github.com/users/malexmave/orgs","repos_url":"https://api.github.com/users/malexmave/repos","events_url":"https://api.github.com/users/malexmave/events{/privacy}","received_events_url":"https://api.github.com/users/malexmave/received_events","type":"User","site_admin":false},"body":"As [promised](https://twitter.com/malexmave/status/550763597828485120), I updated the guide for the current version of ejabberd, which uses a different config file syntax. I also added some additional hints (specifying cipher orders and enforcing them, changing the logging options, registration settings and password storage).\r\n\r\nFeedback is obviously welcome, but what really **needs** to be reviewed before merging is the cipher specs [here](https://github.com/malexmave/Applied-Crypto-Hardening/blob/ejabberd-update/src/configuration/IM/ejabberd/ejabberd.yml#L139) and [here](https://github.com/malexmave/Applied-Crypto-Hardening/blob/ejabberd-update/src/configuration/IM/ejabberd/ejabberd.yml#L211) (the cipher strings are identical, but not reviewed and may contain bad ciphers. They resulted from me trying to achieve a cipher order which favored ciphers with PFS and forbad terrible ciphers like DES and RC4). Please provide me with a better cipher string than the one I provided, and I will add it (keep in mind that some clients only support comparatively terrible ciphers, as per [this article](https://blog.thijsalkema.de/me/blog//blog/2013/09/02/the-state-of-tls-on-xmpp-3/)).\r\n\r\nI also removed the outdated config for older versions of ejabberd (it was called ejabberd.cfg instead of ejabberd.yml and used the erlang format instead of YAML) in order to avoid confusion if people look into the directory.\r\n\r\nThis is my first time contributing to this guide, so please let me know about any formatting problems or similar errors I may have introduced, or guidelines I may have violated. Thank you for your great work and time.\r\n\r\n(sorry for the large commit, but config files tend to be rather large... :))","created_at":"2015-01-07T17:30:28Z","updated_at":"2015-01-08T11:02:34Z","closed_at":null,"merged_at":null,"merge_commit_sha":"25328f89277f7d449ef82c8befb4fdb68de6bd0f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90/commits","review_comments_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90/comments","review_comment_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/comments/{number}","comments_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/90/comments","statuses_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/statuses/1f1a3a8cf4441f39fc944b32a3a44fff44adee51","head":{"label":"malexmave:ejabberd-update","ref":"ejabberd-update","sha":"1f1a3a8cf4441f39fc944b32a3a44fff44adee51","user":{"login":"malexmave","id":1688580,"avatar_url":"https://avatars.githubusercontent.com/u/1688580?v=3","gravatar_id":"","url":"https://api.github.com/users/malexmave","html_url":"https://github.com/malexmave","followers_url":"https://api.github.com/users/malexmave/followers","following_url":"https://api.github.com/users/malexmave/following{/other_user}","gists_url":"https://api.github.com/users/malexmave/gists{/gist_id}","starred_url":"https://api.github.com/users/malexmave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malexmave/subscriptions","organizations_url":"https://api.github.com/users/malexmave/orgs","repos_url":"https://api.github.com/users/malexmave/repos","events_url":"https://api.github.com/users/malexmave/events{/privacy}","received_events_url":"https://api.github.com/users/malexmave/received_events","type":"User","site_admin":false},"repo":{"id":28688812,"name":"Applied-Crypto-Hardening","full_name":"malexmave/Applied-Crypto-Hardening","owner":{"login":"malexmave","id":1688580,"avatar_url":"https://avatars.githubusercontent.com/u/1688580?v=3","gravatar_id":"","url":"https://api.github.com/users/malexmave","html_url":"https://github.com/malexmave","followers_url":"https://api.github.com/users/malexmave/followers","following_url":"https://api.github.com/users/malexmave/following{/other_user}","gists_url":"https://api.github.com/users/malexmave/gists{/gist_id}","starred_url":"https://api.github.com/users/malexmave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malexmave/subscriptions","organizations_url":"https://api.github.com/users/malexmave/orgs","repos_url":"https://api.github.com/users/malexmave/repos","events_url":"https://api.github.com/users/malexmave/events{/privacy}","received_events_url":"https://api.github.com/users/malexmave/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/malexmave/Applied-Crypto-Hardening","description":"Paper (DRAFT) on Best Current Practices regarding the configuration of cyptographic tools and online communication","fork":true,"url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening","forks_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/forks","keys_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/keys{/key_id}","collaborators_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/teams","hooks_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/hooks","issue_events_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/issues/events{/number}","events_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/events","assignees_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/assignees{/user}","branches_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/branches{/branch}","tags_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/tags","blobs_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/git/refs{/sha}","trees_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/git/trees{/sha}","statuses_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/statuses/{sha}","languages_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/languages","stargazers_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/stargazers","contributors_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/contributors","subscribers_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/subscribers","subscription_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/subscription","commits_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/commits{/sha}","git_commits_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/git/commits{/sha}","comments_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/comments{/number}","issue_comment_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/issues/comments/{number}","contents_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/contents/{+path}","compare_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/compare/{base}...{head}","merges_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/merges","archive_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/downloads","issues_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/issues{/number}","pulls_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/pulls{/number}","milestones_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/milestones{/number}","notifications_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/labels{/name}","releases_url":"https://api.github.com/repos/malexmave/Applied-Crypto-Hardening/releases{/id}","created_at":"2015-01-01T15:12:09Z","updated_at":"2015-01-01T15:12:13Z","pushed_at":"2015-01-07T21:05:53Z","git_url":"git://github.com/malexmave/Applied-Crypto-Hardening.git","ssh_url":"git@github.com:malexmave/Applied-Crypto-Hardening.git","clone_url":"https://github.com/malexmave/Applied-Crypto-Hardening.git","svn_url":"https://github.com/malexmave/Applied-Crypto-Hardening","homepage":"https://bettercrypto.org","size":114906,"stargazers_count":0,"watchers_count":0,"language":"TeX","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"BetterCrypto:master","ref":"master","sha":"4cdd6fea240cf28f9fee6c9e30c6fea1809e9ae8","user":{"login":"BetterCrypto","id":6088859,"avatar_url":"https://avatars.githubusercontent.com/u/6088859?v=3","gravatar_id":"","url":"https://api.github.com/users/BetterCrypto","html_url":"https://github.com/BetterCrypto","followers_url":"https://api.github.com/users/BetterCrypto/followers","following_url":"https://api.github.com/users/BetterCrypto/following{/other_user}","gists_url":"https://api.github.com/users/BetterCrypto/gists{/gist_id}","starred_url":"https://api.github.com/users/BetterCrypto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BetterCrypto/subscriptions","organizations_url":"https://api.github.com/users/BetterCrypto/orgs","repos_url":"https://api.github.com/users/BetterCrypto/repos","events_url":"https://api.github.com/users/BetterCrypto/events{/privacy}","received_events_url":"https://api.github.com/users/BetterCrypto/received_events","type":"Organization","site_admin":false},"repo":{"id":14877557,"name":"Applied-Crypto-Hardening","full_name":"BetterCrypto/Applied-Crypto-Hardening","owner":{"login":"BetterCrypto","id":6088859,"avatar_url":"https://avatars.githubusercontent.com/u/6088859?v=3","gravatar_id":"","url":"https://api.github.com/users/BetterCrypto","html_url":"https://github.com/BetterCrypto","followers_url":"https://api.github.com/users/BetterCrypto/followers","following_url":"https://api.github.com/users/BetterCrypto/following{/other_user}","gists_url":"https://api.github.com/users/BetterCrypto/gists{/gist_id}","starred_url":"https://api.github.com/users/BetterCrypto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BetterCrypto/subscriptions","organizations_url":"https://api.github.com/users/BetterCrypto/orgs","repos_url":"https://api.github.com/users/BetterCrypto/repos","events_url":"https://api.github.com/users/BetterCrypto/events{/privacy}","received_events_url":"https://api.github.com/users/BetterCrypto/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening","description":"Paper (DRAFT) on Best Current Practices regarding the configuration of cyptographic tools and online communication","fork":false,"url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening","forks_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/forks","keys_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/keys{/key_id}","collaborators_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/teams","hooks_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/hooks","issue_events_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/events{/number}","events_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/events","assignees_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/assignees{/user}","branches_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/branches{/branch}","tags_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/tags","blobs_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/git/refs{/sha}","trees_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/git/trees{/sha}","statuses_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/statuses/{sha}","languages_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/languages","stargazers_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/stargazers","contributors_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/contributors","subscribers_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/subscribers","subscription_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/subscription","commits_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/commits{/sha}","git_commits_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/git/commits{/sha}","comments_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/comments{/number}","issue_comment_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/comments/{number}","contents_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/contents/{+path}","compare_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/compare/{base}...{head}","merges_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/merges","archive_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/downloads","issues_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues{/number}","pulls_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls{/number}","milestones_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/milestones{/number}","notifications_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/labels{/name}","releases_url":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/releases{/id}","created_at":"2013-12-02T23:01:28Z","updated_at":"2015-01-07T21:01:37Z","pushed_at":"2014-12-12T20:25:54Z","git_url":"git://github.com/BetterCrypto/Applied-Crypto-Hardening.git","ssh_url":"git@github.com:BetterCrypto/Applied-Crypto-Hardening.git","clone_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening.git","svn_url":"https://github.com/BetterCrypto/Applied-Crypto-Hardening","homepage":"https://bettercrypto.org","size":114906,"stargazers_count":298,"watchers_count":298,"language":"TeX","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":59,"mirror_url":null,"open_issues_count":6,"forks":59,"open_issues":6,"watchers":298,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90"},"html":{"href":"https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/90"},"issue":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/90"},"comments":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/issues/90/comments"},"review_comments":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90/comments"},"review_comment":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/pulls/90/commits"},"statuses":{"href":"https://api.github.com/repos/BetterCrypto/Applied-Crypto-Hardening/statuses/1f1a3a8cf4441f39fc944b32a3a44fff44adee51"}}}}