Subject: [Wocky] Jabber on Mac OS X 10.4

From: Albert Willis <[email-masked]>
Date: Fri, 7 Oct 2005 15:42:33 -0400

In my testing of the next version of Mac OS X 10.4, iChat still  
complains that the password goes over insecurely when connecting to  
the MIT Jabber server; my understanding is that our Jabber server  
doesn't allow for that.

I'd like to file a bug with Apple; to do that, I'd need some basic  
information, such as what Jabber server software we're running and  
any configuration information that may be useful.

Thanks.

   -- Al

______________________________
Albert Willis
Macintosh Platform Coordinator - Software Release Team
Information Services and Technology
Massachusetts Institute of Technology
[email-masked]

---

From: Greg Hudson <[email-masked]>
Date: Sat, 08 Oct 2005 03:45:24 -0400

> information, such as what Jabber server software we're running and any
> configuration information that may be useful.

We're running Jabberd 2.0s4.  But I suspect this is a server issue;
specifically, I think the server is failing to realize that it's
operating over an SSL connection (because iChat uses old-style SSL on a
different port, rather than new-style SSL negotiated over the main
port), and is erroneously rejecting the attempt to do password
authentication.

I will look into this issue during the coming week.  If we do have a
line into Apple, though, one thing we might ask for is whether they have
a secret way to turn on connection tracing within iChat.  (gaim has this
with "gaim -d", which has been extremely helpful to me so far.)  An
external packet trace isn't likely to be very helpful because of the SSL
encryption.

---

From: Greg Hudson <[email-masked]>
Date: Tue, 11 Oct 2005 13:34:45 -0400

I misunderstood what was going on when connecting with Tiger's iChat
to our Jabber server.  I thought logins were being refused, when the
problem is just a spurious warning dialog.

For the record, according to jdreed, when you try to connect, you get
a dialog with the title ""Non-secure Jabber Login" and the content
"Your name and password will be sent in a way that is not secure.  Do
you still wish to connect to this server?".  If you click continue,
everything works, and a packet trace indicates that everything is
SSL-encrypted.

I no longer believe this behavior originates from the server.
Certainly, the text "not secure" does not appear in the source code we
are running.

Al, you can go ahead and file a bug with Apple.  As I mentioned
before, we are running jabberd 2.0s4 at the moment.  The only relevant
configuration I know of is that the server requires SSL for logins.

---

From: Jonathan Reed <[email-masked]>
Date: Mon, 17 Oct 2005 13:30:08 -0400

>configuration I know of is that the server requires SSL for logins.

Ooops, I screwed up.  I thought this was on the server, because when 
I looked in the resource bundle for iChat, and even the binary 
itself, I didn't find that.  I didn't think to check for a framework, 
and sure enough, the text appears in iChatAgent in 
InstantMessage.Framework.

There's also a bunch of stuff about certificates in there, so I 
wonder if it's merely failing to verify the certificate chain.  Does 
jabber.mit.edu have a real cert signed by the MIT CA, or is it a 
self-signed cert?  Regardless, even if the cause is failed CA 
verification, it's still a bug, since the error message should be 
more verbose.

I have the MIT CA in my keychain, so it should work, unless for some 
reason iChatAgent doesn't use the Keychain.

-Jon
-- 
-------------------
Jonathan Reed

[email-masked]
-------------------

---

From: Albert Willis <[email-masked]>
Date: Mon, 17 Oct 2005 17:58:41 -0400

On Oct 17, 2005, at 1:30 PM, Jonathan Reed wrote:

> Ooops, I screwed up.  I thought this was on the server, because  
> when I looked in the resource bundle for iChat, and even the binary  
> itself, I didn't find that.  I didn't think to check for a  
> framework, and sure enough, the text appears in iChatAgent in  
> wonder if it's merely failing to verify the certificate chain.   
> Does jabber.mit.edu have a real cert signed by the MIT CA, or is it  
> a self-signed cert?  Regardless, even if the cause is failed CA  
> I have the MIT CA in my keychain, so it should work, unless for  
> some reason iChatAgent doesn't use the Keychain.
>
> -Jon

The response I received from Apple is that it's a known issue that is  
being investigated by engineering.

I also thought about the certificate possibility as well; so far,  
having the MIT CA in the X509Anchors keychain and having my personal  
certificate in the login keychain hasn't made a difference.

   -- Al