Using any/fake domains with ejabberd

Question

I've recently purchased a cloud server which has public IP and I am using it to host an xmpp server.

My first task was to ensure my users connected using my subdomain - as an example m.chat.com.

In my configuration I have the following:

%% Hostname
{hosts, ["m.chat.com"]}.

I then created an admin user with that domain.

In parrellel I have created the following DNS record with my host provider, hostgator for my subdomain m.chat.com

Name             TTL    Class   Type    Record
m.chat.com       14400  IN      A       [IP of the server]

One thing that puzzled me was my ability to access the ejabberd web admin console. This was achieved via: [IP of the server]:5280/admin however I could not access it via m.chat.com:5280/admin

That aside, inside the web console, under "Virtual Hosts" I could see the host "m.chat.com". I created a user "[email protected]" and tried to connect via Adium.

Inside Adium, simply typing in [email protected] with the password did not work. Instead I had to also specify the "Connect server" which in this case was the [IP of the server].

It has connected fine and I have registered other users to check everything is working and it is.

Then I thought I'd go back to the ejabberd configuration and start messing around. I changed the hostname to the following:

%% Hostname
{hosts, ["m.chat.com", "facebook.com"]}.

I registered a user with that domain and restarted ejabberd. Upon checking the web console, to my surprise, I could see the Virtual host "facebook.com". I tested this user in Adium with the [IP of the server] defined in the "Connect server" section and it connected fine. I asked other people with their own internet connections to use this account on their PCs and they were able to connect too.

Story over - my question to everyone is how is this possible? Am I missing something? Is there no domain authentication. After searching online, it seems you can even use fake domains.

If I am to operate my own service in the future (iOS chat app) I do not want anyone using my domain names with their own public servers.

Can someone shine some light.

Thanks!

Edit: A second question - Preferably I do not want to have to define the "Connect Server" upon using a client. I would like the client to recognise the @m.chat.com domain and establish a connection to the Servers IP automatically. Have I configured my DNS record correctly? For anyone else using Hostgator, is there an additional task I must do?

Edit: I can now access the web console via m.chat.com:5280/admin and I no longer have to specify the Connect server when using a client. I didnt do anything, I think it was a case of Hostgater updating the DNS or something, they say it usually takes 4 hours. However I am still slightly puzzled as to why I can create accounts with the facebook.com domain. I understand that because I can not access the DNS admin for this domain I can not create any records but that does not prevent me from using the domain and just specifying a Connect server.

Answer 1

Your initial problems (unable to access the server by using m.chat.com) were almost certainly DNS issues, and it seems you have isolated that down to the time taken to update the record.

Your second question - about the fact that you can name virtual hosts without restriction, is simple but interesting. What makes you think there should be any kind of restriction? It would be like you dictating that I can't save "m.chat.com" in a file on my disk, or that I can't send "m.chat.com" in a message across the internet.

This is why DNS exists and is structured the way it is. Although I can tell my server that it hosts facebook.com, nobody will connect to it because the DNS record for facebook.com does not point at my server (users generally don't set the "connect host" manually). Which begs the question... why would I want to tell my server it hosts facebook.com, and if I did, why should Facebook care?

An additional, but relevant, identity layer on top of DNS are certificates - which clients should validate for the virtual host name in spite of any "connect host" set. Since it's not possible to have a certificate for facebook.com, clients should generally pop up warnings or fail to connect at all. If they don't, they're probably not validating the certificate correctly.