How to install Openfire Meetings on ClearOS

Openfire 4.x and ClearOS 7.1

Todo

• Secure by default. Remove all http and force https

Background

ClearOS is an operating system for your Server, Network, and Gateway systems. It is designed for homes, small to medium businesses, and distributed environments. ClearOS is commonly known as the Next Generation Small Business Server, while including indispensable Gateway and Networking functionality. It delivers a powerful IT solution with an elegant user interface that is completely web-based. Simply put.. ClearOS is the new way of delivering IT. Source: https://www.clearos.com/

Openfire is a real time collaboration (RTC) server licensed under the Open Source Apache License. It uses the only widely adopted open protocol for instant messaging, XMPP (also called Jabber). Openfire is incredibly easy to setup and administer, but offers rock-solid security and performance. Source: http://www.igniterealtime.org/projects/openfire/index.jsp

Openfire Meetings is an Openfire plugin that uses WebRTC and the Jitsi Videobridge to provide high quality, scalable video conferences for your Openfire users.You will also need the Openfire Meetings Chrome extension for screen sharing, co-browsing and application sharing. Source: https://www.igniterealtime.org/projects/openfire/plugins/ofmeet/readme.html

The Openfire Fastpath Plugin adds support for managed queued chat requests, such as a support team might use. For example, a web based "Live Support" interface can point a potential customer at a workgroup representing the Sales team. Members of that workgroup will receive notification that a someone is waiting and when someone from that workgroup accepts, the customer and the team member will be connected to communicate with each other.

Assumptions

• This guide assumes your ClearOS server will be the main server for your domain. Thus, your website (powered by Tiki) will be on the same server. E-mails could also be handled (with Roundcube on ClearOS) but are also easily handled by your domain name provider.

Information

To Install Openfire on ClearOS within the WikiSuite environment follow the next steps.

1.- Install a fresh ClearOS Server, be sure to run the latest Software updates to the core system and include in the installation of:

a. The Web Server
b. Software Repository Modules
c. and the Directory Server(Open LDAP)

If not already installed, you may do so through the Webconfig-Market Place Module (https://yourserver.wikisuite.org:81/app/marketplace).

2.- Using Software Repository Module (https://yourserver.wikisuite.org:81/app/software_repository), make sure the clearos-epel, clearos-centos and clearos-centos-updates repositories are enable.

Configure domain name

In ClearOS, your domain name is set at https://example.org:81/app/network

You may need to add an A record in your DNS. DNS is typically offered with your domain name registrar. (Optional)

@luis: what are all the A records to set ?

See ClearOS docs:

• https://www.clearos.com/resources/documentation/clearos/content:en_us:6_ip_settings
• https://www.clearos.com/resources/documentation/clearos/content:en_us:7_b_installation_wizard#network_and_hostname

Configure Firewall

ClearOS's Firewall should configured to block all ports, and open the following:

• 9091 : Openfire administration
• 80 : HTTP
• 443 : HTTPS
• 22 : SSH
• 81 : Webconfig
• 7070 : Used by Openfire
• 7443 : Used by Openfire
• 9090 : Used by Openfire @luis: is this needed if we have 9091 for https?
• 5222 : Used by Openfire
• 5223 : Used by Openfire
• 25: SMTP: For emails for Openfire Meeting Planner
• 587 SMTP: For emails for Openfire Meeting Planner if you use Gmail
• 993 IMAPS: For emails for Openfire Meeting Planner
• 143 IMAP: For emails for Openfire Meeting Planner
• 8843 Woot realtime collaborative editing

@luis: in https://evoludata.com:81/app/incoming_firewall there are other ports. Why are they not documented here?

Configure OpenLDAP

1.-Initialize your OpenLDAP service through the Webconfig-Open LDAP Directory Server Module (https://yourserver.wikisuite.org:81/app/openldap_directory).

2.-On the Directory Server Settings page set the server mode and Base Domain (https://yourserver.wikisuite.org:81/app/openldap_directory/settings/edit)

3.-On the Directory Server Policies page set the Publish Policy and Accounts access according to your requirements (https://yourserver.wikisuite.org:81/app/openldap_directory/policies/edit)

4.-Don't forget to create one or two users as they will be use in the Openfire configuration phase. Use: (https://yourserver.wikisuite.org:81/app/users/add)

Install Openfire

1.-Login to your ClearOS via SSH using root

2.-Install the Openfire RPM

Type:

rpm -ivh http://www.igniterealtime.org/downloadServlet?filename=openfire/openfire-4.0.1-1.i386.rpm

For Openfire to work on ClearOS 64-bit the 32-bit zlib library is required.
Source: https://community.igniterealtime.org/thread/43673

Type:

yum install zlib.i686

And type "y" when requested.

3.- Start the Openfire service:

Type:

/etc/init.d/openfire start

And check the status

/etc/init.d/openfire status

Configure Openfire

Use a web browser to connect to the admin console. The default port for the web-based Initial setup admin console is 9090. Initial setup and administration can be done from a remote computer using LAN IP address instead or hostname if it is resolvable by the remote computer. i.e. (http://yourserver.wikisuite.org:9090). Source: http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/install-guide.html

1.-The first screen will request you to choose your preferred language and press continue.

2.-For the second screen, Type your host domain and press continue. The Default Admin Console Port is 9090 and the Secure Admin Console Port is 9091.

3.-Select to use the "Embedded Database" and press continue.

4.-Choose "Directory Server (LDAP)" as the user and group system to use with the server and press continue.

5.-Configure the connection settings for your LDAP directory and press "Test Settings". (Connections settings such as password can be obtained from OpenLDAP Directory Setup (https://yourserver.wikisuite.org:81/app/openldap_directory)

6.-Once the test has been successful press "Save and Continue"

7.-Configure how the server finds and loads users from your LDAP directory and press "Test Settings"

8.-Once the test has been successful press "Save and Continue"

9.-Configure how the server finds and loads groups from your LDAP directory and press "Test Settings"

11.-Once the test has been successful press "Save and Continue"

12.-Choose one or more users from your LDAP directory to be administrators by entering their usernames. Press "Save and Continue"

13.- You Can test the user settings by clicking on the "Test" icon.

14.- Once the test has been successful press "Continue"

15.-Setup is complete! Click on "Login to Admin Console"

16.-Log in to the Admin Console.

17.- You should restart openfire throug your secure shell console.

Type:

service openfire restart

18.- Now you can login to your Admin Console through the Secure port at (https://yourserver.wikisuite.org:9091)

Install Openfire Meetings Plugin

1.- Login to your Openfire Admin Console with a administrator user.

2.- Click on the Plugins Tab to manage Plugins

3.- Click on the available plugins link and scroll down to find the Openfire Meetings plugin

4.- Click on then ¨+¨ to add the plugin to the Openfire server

Source: http://www.igniterealtime.org/projects/openfire/plugins/ofmeet/readme.html

Install Openfire Fastpath plugin

1.- Go to the Openfire plugins administration console (https://yourserver.wikisuite.org:9091/plugin-admin.jsp)

2.- Click on the "Available plugins" tab and look for the Fastpath plugin. Click on the "+" sign to install.

3.- Once the plugin has been successfully installed, you can proceed to configure in its own console.

4.- Refresh the Openfire console and the Fastpath tab should be available, click on it to configure Workgroups (https://yourserver.wikisuite.org:9091/plugins/fastpath/workgroup-summary.jsp)

Notes:

• You can find a Quick start guide here:https://community.igniterealtime.org/docs/DOC-1513

• Here is a live example: http://avan.tech/Fastpath and some notes from Guus (keep or delete what you think)

• The snippet is provided on the Openfire Admin Console (Fastpath -> Workgroup Manager -> Workgroup Settings -> Text)

• jivelive.jsp is available on http://evoludata.com:9090/webchat/jivelive.jsp - perhaps you'll need to edit the snippet above, if you're redirecting access to that resource through a reversed proxy.

• There's a simple landing page here: http://evoludata.com:9090/webchat/

Configure email

@Luis and @ Charles: this needs to be documented and screenshotted with Roundcube

In ClearOS

https://example.org:81/app/smtp
https://example.org:81/app/imap

In Openfire

https://example.org:9091/system-email.jsp
https://example.org:9091/plugins/ofmeet/ofmeet-email-listener.jsp

Adding admins

1.-There is no ClearOS group for the Openfire admins. Instead: Edit server properties (https://yourserver.wikisuite.org:9091/server-properties.jsp)

2.- Find the admin.authorizedJIDs property, edit it and add comma separated full JIDs. In our specific case user at example.org. "Click on Save Property"

3.- Openfire needs a restart, Login to your ClearOS via SSH using root and type:

service openfire restart

Configure SSL

As of Openfire 3.2 certificate management can be performed from the Admin Console. (And in 4.0, code has been revamped)

Once the setup process is completed Openfire will create self-signed certificates for the assigned Openfire's domain. Most users should either get the created certificates signed by a Certificate Authority or replace the created certificates with your own certificates. Source: http://www.igniterealtime.com/builds/openfire/docs/latest/documentation/ssl-guide.html

• You can access the certificate store at: https://yourserver.wikisuite.org:9091/security-certificate-store-management.jsp

• Manage the existing certificates in the Openfire Identity Certificate Store

• Import Private Key and Certificate

As ClearOS also manages SSL certificates, they can co-exist independently as their storage files are different and independent. i.e. Openfire generated certificates will only be used within open fire applications.

Avoiding non-standard ports

In some contexts, (corporate environments, captive portals in Internet cafes, etc.), some ports can be blocked. Thus, if you want to get rid of port number, you can put the following apache configuration (Apache 2.4+ so you need ClearOS 7.x):

ProxyPass /ofmeet/ http://localhost:7070/ofmeet/
ProxyPassReverse /ofmeet/ http://localhost:7070/ofmeet/
ProxyPass /ofmeetws/ wss://localhost:7070/ofmeetws/
ProxyPassReverse /ofmeetws/ wss://localhost:7070/ofmeetws/

Team room

@Luis and @Charles: please document how to make a room called "team" for all team members, accessible via XMPP or WebRTC or CandyChat

Advanced configuration

• If your XMPP server is not on the same server as your website, and you want to support (typically older) XMPP clients which don't support SRV records, you will need something like http://sourceforge.net/p/penloadbalancer/wiki/penctl.1/

Related links

• https://www.clearos.com/clearfoundation/social/community/how-to-install-openfire-3-7-1-on-cos-6-3-64bit-manual-install
• http://rtcquickstart.org/guide/RTCQuickStartGuide.pdf

• How to install and Configure Openfire Meetings on ClearOS