s2s deny?

[mrusme]

I've been going to multiple issues here on GitHub, which however were mostly around a decoade old and didn't appear to correspond to the current version of ejabberd anymore. I would like to know how to effectively block s2s (federations) with specific servers. My current attempt is the following one:

acl:
  bad_servers:
    server:
      - "bad-serve.rs"

access_rules:
  s2s:
    deny: bad_servers
    allow: all

s2s_access: s2s

However, it doesn't appear that federation is successfully blocked, as I can still se visitoros from blocked servers joining the MUC.

Happy for any help with this!

[badlop]

Your configuration looks correct.

Another way to express it would be

access_rules:
  s2s:
    - deny:
      - server: "bad-server.rs"
    - allow

s2s_access: s2s

---

Idea A)

The option documentation says:

s2s_access:
This Access Rule defines to what remote servers can s2s connections be established.

One explanation is that maybe s2s_access affects only outgoing s2s connections: your users are not allowed to connect to those remote servers; but the option does not affect to incoming s2s connections: remote servers can connect to your server... not only to the MUC service, but also contact your users and send messages.

I don't see any other option that could block incoming s2s connections. If that option does not apply, then there's no solution right now.

---

Idea B)

I can still se visitoros from blocked servers joining the MUC.

Maybe connections are blocked to your XMPP server "yourserver.org", but are allowed to your MUC service "muc.yoursever.org" ?

Looking at ejabberd_s2s_in.erl , which manages incoming s2s connections, I see that immediately after authentication is done, the allow_host function checks the option. But maybe the option is checked for the MUC service, not for the XMPP server, and ejabberd doesn't apply correctly the restriction.

In your ejabberd.log file do you get lines like this?

Accepted inbound s2s EXTERNAL authentication bad-server.rs -> yourserver.org

Or does it look like this?

Accepted inbound s2s EXTERNAL authentication bad-server.rs -> muc.yourserver.org