Howto install Openfire on NethServer

[mrmarkuz (Markus Neuberger)]

@Wellington_Rodrigues reminded me of Openfire in Doubt about openfire, which is a nice chat server with postgresql and LDAP/AD support.

HowTo Updates

30.3.2020 - Added chapter for Openfire 4.4.4 including inverse plugin

Installation and database setup

wget -O openfire-4.2.1-1.noarch.rpm https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire-4.2.1-1.noarch.rpm
yum -y install openfire-4.2.1-1.noarch.rpm nethserver-postgresql
su - postgres -c "createuser openfire"
su - postgres -c psql
alter user openfire with encrypted password 'openfire';
\q
su - postgres -c "createdb -T template0 -E UNICODE -O openfire openfire"
psql -U openfire -d openfire -f /opt/openfire/resources/database/openfire_postgresql.sql

Enter Password: openfire

Firewall settings and enabling/starting service

config set openfire service status enabled TCPPorts 5222,5223,7070,7443,5269,5275,5276,5262,5263,9090,9091,7777,5229 access green
signal-event firewall-adjust
systemctl enable openfire
systemctl start openfire

Setup

Browse to http://YOURNETHSERVER:9090

• Select your language
• Server settings should be autofilled
• Choose Standard Database Connection
• Setup database:
  
• In profile settings you have to choose between db users or LDAP/AD

For AD you may use following settings:

• Enter AD data that could be found out via account-provider-test dump
• Don’t forget to set “Use SSL” to “Yes”
  
  
• If you want full names to be shown change name from {cn} to {displayname}
• The correct mail field is {userPrincipalName}
  
• Continue
• Group mapping is ok so continue
• Add administrator admin or another user you like and continue
• Login to admin console

Restart openfire with systemctl restart openfire to activate secure port 9091 so you can browse to https://YOURNETHSERVER:9091

Applications button

This step is not necessary, it just creates an Openfire button in Nethgui “Applications”.

Create /usr/share/nethesis/NethServer/Module/Dashboard/Applications/Openfire.php

<?php
namespace NethServer\Module\Dashboard\Applications;

class Openfire extends \Nethgui\Module\AbstractModule implements \NethServer\Module\Dashboard\Interfaces\ApplicationInterface
{

  public function getName()
  {
    return "Openfire";
  }

  public function getInfo()
  {
    $host = explode(':',$_SERVER['HTTP_HOST']);
    return array(
      'url' => "https://".$host[0].":9091",
    );
  }
}

Todos

• Change port 9090 because of cockpit, which uses same port
• LDAP
• Test untested update

Untested update to 4.4.4 including inverse plugin - converse for openfire

wget -O openfire-4.4.4-1.noarch.rpm https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire-4.4.4-1.noarch.rpm
yum -y install openfire-4.4.4-1.noarch.rpm nethserver-postgresql

su - postgres -c "createuser openfire"
su - postgres -c psql
alter user openfire with encrypted password 'openfire';
\q
su - postgres -c "createdb -T template0 -E UNICODE -O openfire openfire"
psql -U openfire -d openfire -f /opt/openfire/resources/database/openfire_postgresql.sql

config set openfire service status enabled TCPPorts 5222,5223,7070,7443,5269,5275,5276,5262,5263,9095,9096,7777,5229 access green
signal-event firewall-adjust
sed -i -e 's!<port>9090</port>!<port>9095</port>!' -e 's!<securePort>9091</securePort>!<securePort>-1</securePort>!' /opt/openfire/conf/openfire.xml
systemctl enable openfire
systemctl start openfire

Inverse plugin:

Get and enable inverse plugin:

wget -O /opt/openfire/plugins/inverse.jar https://www.igniterealtime.org/projects/openfire/plugins/5.0.5.1/inverse.jar
systemctl restart openfire

[robb (Rob Bosch)]

@mrmarkuz

Setup
Browse to http://YOURNETHSERVER:9090

I was about to post because bells and whistles were ringing, just to read in your last remarks:

@mrmarkuz

Todos

Change port 9090 because of cockpit, which uses same port

Great howto!

[Wellington_Rodrigues]

Nice topic about how to install Openfire.

[Wellington_Rodrigues]

@mrmarkuz

Applications button

I like this option.
I tested here today at the company and it was cool

[Wellington_Rodrigues]

Hi @mrmarkuz, how are you?
Sorry for reviving this topic but I found it better than creating a new one.
In the company where I work we are with version 7.4.1708 and we want to migrate to version 7.5. I created a VM to test first and I’m having problems when installing Openfire. Even following the installation steps, it gives the following error:

Would you know or anyone how to resolve this problem?

Active Directory local accounts provider for test.local
Samba DC version
4.7.8
DNS domain name
ad.test.local
NetBIOS domain name
TEST
Domain Controller IP address
192.168.1.6

I noticed that on the old server Samba DC is in version 4.7.7

[mrmarkuz (Markus Neuberger)]

Hi @Wellington_Rodrigues,

it works for me when disabling strong auth:

AD / LDAP UID vs UserPrincipalName

Another less secure solution is disable ssl requirement, like documented here https://wiki.samba.org/index.php/Updating_Samba#New_Default_for_LDAP_Connections_Requires_Strong_Authentication Edit /var/lib/machines/nsdc/etc/samba/smb.conf then restart samba nsdc service systemctl -M nsdc restart samba IIRC in some past discussion a Zentyal user told me that AD LDAP can be browsed anonymously…

and disabling SSL and TLS in the openfire settings:

Another solution would be to let samba use letsencrypt certs (I didn’t test with openfire):

SSL certificates for Samba AD (NSDC host)

So, basically, all I need for this to work like I already expect it to work, would be for the letsencrypt routine to a) add the nsdc-hostname.domainname.tld to the list of requested CN’s, or ‘Domains’ as they are called in the Gui b) Next step is to simply copy the created certificate and key to the expected locations. Defaults are: cp /etc/pki/tls/certs/localhost.crt /var/lib/machines/nsdc/var/lib/samba/private/tls/cert.pem cp /etc/pki/tls/private/localhost.key /var/lib/machines/nsdc/var/l…

[Wellington_Rodrigues]

@mrmarkuz

it works for me when disabling strong auth:

I’ll test this option, thank you

[Wellington_Rodrigues]

@mrmarkuz, thank you
It worked disabling strong auth!