Slashdot Log In
Internal Instant Messaging Client / Server Combo?
Posted by
kdawson
on Mon Apr 06, 2009 10:23 PM
from the this-message-is-being-recorded dept.
from the this-message-is-being-recorded dept.
strongmantim writes "I manage an internal help desk (25-30 people) for a medium-large company in the healthcare industry. We're looking for an internal, secure, FOSS (if possible) instant messaging / presence awareness client and server combo. Transmission of Protected Health Information is a sensitive issue, so the server has to be able to log any conversations that occur. It is preferred that the client not support outside protocols such as AIM, MSN, Yahoo, etc.; if it does, I will have to promulgate and enforce yet one more policy that my techs not connect to them. All of the computers that will connect run Windows XP. The system should be scalable up to ~100 people (in case we decide to include our entire office in the roll-out). Hardware and OS for the server are not an issue. Oh, and one more thing: It has to be free. Suggestions?"
Related Stories
[+]
Technology: How To Build an Openfire Chat Server On Debian 5 108 comments
palegray.net writes "Inspired by a recent Ask Slashdot, I've written a step-by-step tutorial for setting up an Openfire server on Debian Linux, for those interested in running their own open source collaboration server. Aimed at those just getting started with collaboration software, the tutorial shows precisely how to get Openfire up and running quickly on a base Debian install, and offers a basic feature tour of the software's plugin and IM gateway functionality."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Jabber is what you need (Score:5, Insightful)
The question is which client and which server, and that I don't know. You should be able to lock it down by not allowing anyone to change its preferences.
--Sam
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
If you go that route, you could instead install Xming on the clients and run the jabber client locally, on the jabber server. Kind of high overhead, but full and complete control.
Each department could have their own eJabber server, so granularity would be rather fine.
Re:Jabber is what you need (Score:4, Insightful)
What the hell are you smoking? I find answers like this to be way over simplified. Just setup a Debian box in an hour. Really? That is a bit naive. I have to ask you. Do you actually get your production servers setup in an hour? I don't know about you, but it takes me at least an hour or two to rack mount a new server, get it cabled, verify the redundant power is done correctly and get everything labeled properly. Then you have to get the OS loaded, app loaded etc. After all that, you need to be sure backups are setup and working properly, do some tests. After all this is HIPPA related and he needs to make sure it's working correctly, not to mention something like this will become a mission critical app in short period of time, because other people will come to rely on it . I could easily see after the release of something like this, other departments putting the use of the IM system into policy and procedures, because it's all logged. For example some manager says he will approve purchase requisitions over the IM system as it's all logged. I assume you've tested the log recovery from a backup and are confident you will be able to restore yesterday's log 7 years from now. And then document the whole thing. You do document things I hope. Even if you are the only admin, you need to document in case you are unavailable during an emergency. If you don't you aren't doing the job properly. I find a proper server takes more like 16-24 man hours.
Parent
Re: (Score:3, Insightful)
This looks like a good spot to reply. :-)
At my work, we allow two IM programs, Pidgin and Trillian. Both are wide open, however all conversations are logged via Postini. My company (a financial firm) took the opposite route, rather than block a whole bunch of programs and port #s, we allow just about every form of internet communication and log it all.
So far, it's worked out fairly well. Users respect that the company respects their ability to not be "Big Brothered" to death by allowing everything but ma
Re:Jabber is what you need (Score:4, Insightful)
The problem with Jabber/XMPP is that ... it doesn't satisfy the "not used externally" part. Jabber is the basis of GoogleTalk, and several individual IM services.
But, that's a questionable goal of the request anyway. Any one of his coworkers can connect to AIM/Yahoo/GoogleTalk right now. If he doesn't want that happening, he can't just say "we said 'no no bad coworker'" and expect that this makes things all good and happy. If he wants to ensure that coworkers aren't going to connect to external IM services, he needs to block those IM services at the border (firewalls and/or routers).
In my opinion, he should block all IM traffic (Yahoo, AIM, MSN, IRC, ICB, ICQ, XMPP/Jabber, Simple, and the others (look at what pidgin supports, find out what ports those chat/IM services use, block all of them)) at the border, and then require legitimate external users to use a VPN to access the internal Jabber server. If there are remote offices, then either those workers would need to VPN in to the site that hosts the Jabber server ... or each site should have its own Jabber server, and then the Jabber servers would all talk to each other via VPN.
That's how I'd set it up. Block every chat/IM protocol/port at the border (and at the border of each remote office). Set up a Jabber server at the central and at each remote office. Link the Jabber servers to each other via VPN/tunnel/etc.. Go from there.
Parent
Re:Jabber is what you need (Score:5, Informative)
hack out the pidgin plugins. Pidgin Portable 2.5.5 is around 23MB and I removed all languages except English, plugins of everything except Jabber. Compressed it and 8MB.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
You know, I had the exact same issue this guy is having and, guess what - google gave me that exact answer (Openfire).
Of course, I used MirandaIM because I knew Miranda had Jabber support and it's a decent little client, but yeah, another vote for both Openfire and "just fucking google it next time".
Re:Not another one (Score:5, Informative)
I agree.
The OpenFire Jabber server is rock solid and integrates with LDAP, has the ability to log conversations and generally speaking is very elegant and easy to maintain.
We also use the Spark client, which is made available by the same group.
Very solid setup if you ask me.
Parent
Re:Not another one (Score:5, Informative)
I don't know about plain LDAP but I had serious trouble getting OpenFire to work with Active Directory. It integrated fine on the server side but single sign-on for the clients never worked. It seemed like it works great for 95% of people but for certain setups it's just impossible to get right. It's highly dependent upon your DNS setup, although I can't think of anywhere our DNS would be different from the norm. I also got in a little trouble because my users aren't all in cn=users but based on testing I don't think that was where the issue was.
I tried for a long time to get SSO working and eventually I had to just roll it out with separate user accounts. I suppose I could have paid for support but if I was going to do that I would have just bought one of the Windows-based enterprise IM packages that's out there.
Other than that it's been great. I was using Psi for a client but I can't seem to get it to alert people consistently. I (and the users) want something that will pop up the message and take focus no matter what. But Psi seems to be erratic in this regard.
Parent
Re:Not another one (Score:5, Informative)
Parent
Thanks for the recommendation. (Score:3, Insightful)
Re:Not another one (Score:5, Interesting)
Perhaps he also wanted some insights from people who have been in similar situations?
There is a big difference between a website found on google and a testimonial from someone who's done it.
Parent
Re:Not another one (Score:5, Insightful)
This is the exact attitude that pushes people away from FOSS in the first place.
It is almost impossible to get a real answer from people with experience when all you get in return is "RTFM n00b."
R'ing TFM does not always give you practical information or experience. Especially since there are quite a lot of people out there who are great at writing software but cannot write a manual to save their life. Either it is too technical and boasts about all of the incredible feats of writing the program with very little usability information, or overly verbose about how the program works with very little usability information.
Google does not have all of the answers. It has a wealth of information, but sometimes no answers.
Parent
Re:Not another one (Score:5, Insightful)
You will find plenty of testimonials if you Google for them.
So why not take it a step further and close down Slashdot.org?
After all, the articles on slashdot are not written by slashdot staff but borrowed of the web so anything on here can be found via Google. Most websites also have a comment section so the trollish comments can be found not only on Slashdot.org
So get over yourself, some people here may actually try to learn from the experience of others.
Don't like a story? Don't fucking reply!
Parent
Go easy on the "should" will you? (Score:5, Insightful)
As to where the parent post "should" have asked his question, the parent post asked an intelligent question on a forum that harbours a lot of people who can provide a good answer in under a minute. Slashdot.
There are lots and lots of applications like Jabber, Openfire and whatnot about. And yes, if you want you can create a great big (useless) list of them by Googling for a few minutes. And then what? What are the pros and cons of each app? Where can you find comparative tests? Are those tests any good? Has anyone got practical experience with the app? Any show-stoppers that aren't immediately apparent?
The point about most questions like this is that people who already know the answer consider them "easy". People who don't know the answer consider them hard, and will have to expend a lot of time finding out. Time that's wasted if you could simply have eliminated 90% of the options by asking. That's why you ask. At least if you'd rather get some useful work done instead of being the umpteeth person researching the same wheel.
It's a compliment to Slashdot that people ask such questions, and they do that because they even tend to get useful answers. It shows that Slashdot has value apart from serving as a forum for inane bickering.
Parent
Re:Go easy on the "should" will you? (Score:5, Insightful)
Parent
Pidgin (Score:5, Informative)
Use the encryption capabilities in Pidgin.
http://pidgin.im/ [pidgin.im]
Re: (Score:3, Insightful)
I love Pidgin, but that doesn't fit the "does not support outside protocols" criteria.
Re: (Score:3, Informative)
Pidgin protocols are supported through plugins.
Removing the respective plugin removes support for that protocol.
There are other measures which can be taken to ensure it stays protocol broken, but it really depends on how far the requester is willing to go.
Re: (Score:3, Insightful)
You don't even need to do this. All the protocols are dynamically loaded (AFAIK, this is the case on Windows as well).
Just remove the files for the unsupported protocols & block all jabber communications with the outside through the firewall (gmail for instance uses jabber).
BTW, suggesting he hack the source instead of providing him with a client that meets his criteria is only useful if there are no free Windows clients that meet his needs. Since there are, at best you are telling him to use closed-s
Re: (Score:3, Interesting)
Unfortunately, while I personally like the XMPP protocol and think it would normally be an excellent solution, I think you have uncovered the biggest flaw. Preventing the clients from talking to the outside world is going to be nearly impossible unless you keep them on a network that doesn't route to the outside world.
For instance, GTalk uses SSL over port 443 so if you want any type of secure web transactions with the outside world then your also going to be allowing secure chatting. Even if you go through
Re: (Score:3, Informative)
While Pidgin may be a reasonable multi-protocol client as a Jabber client I would suggest Gajim [gajim.org], which also does PGP and esession encryption (Pidgin cannot do either, AFAIK).
Disclaimer (possible conflict of interest): I contributed the :3 smilie to the Gajim icon set.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
SILC (Score:5, Informative)
That's what we used to use in a company I worked for and it worked quite nice.
Re:SILC (Score:5, Informative)
- it encrypts all communication
- it is no multi-protocol thing, i.e. you cannot connect to other services.
I can't remember whether you can run connections to several silc servers at the same time, but if so, that's at least better than having to restrict a program that can connect everywhere. Even though I haven't heard much of silc lately, the software is still actively developed. The last release is from March 19, 2009.
Parent
Jabber. (Score:4, Informative)
You're looking for a jabber server and client.
I work for a credit card company, and we use ejabberd on the server end of things.
You probably have some jabber only client options, but those will still be able to connect to other jabber servers like Google Chat.
Live with it, because any IM server worth using is going to have _some_ public servers.
I'll leave the logging up to you, ejabberd can do it, but our company decided that the security issues involved with storing the logs were much worse then not having the logs.
(Having stored, unencrypted, card data for any length of time is something that, on the very optimistic (good luck with the auditor) side requires a great deal of security. And just encrypting the drive it's sitting on doesn't really do away with more then half of that. Health data should be as much of a nightmare, but maybe not.)
Re:Jabber. (Score:4, Insightful)
Actually, the whole point is that they CAN NOT. Hippa mandates that they do not do that. It would be possible for somebody to copy/paste into the wrong window. For that, it would certainly lead to a firing, and possible jailing. I have consider doing a talk for kopete with an enforced port (via code). It sounds like that is exactly what is needed, though a secured jabberd would cut it.
Parent
Openfire (Score:5, Informative)
http://www.igniterealtime.org/projects/openfire/index.jsp [igniterealtime.org]
Works very well. Meets all your reqirements. Client supports Mac, Win and Linux but is a resource hog. It's jabber though so you can use many clients.
Re: (Score:3, Informative)
http://www.igniterealtime.org/projects/openfire/index.jsp [igniterealtime.org]
Works very well. Meets all your reqirements. Client supports Mac, Win and Linux but is a resource hog. It's jabber though so you can use many clients.
I second OpenFire. We have been (mostly) happily using it for a couple of years now. Trivially easy to setup, can back onto all the major DBs (or has one builtin) and has reasonable - if a bit clumsy and limited - capabilities to integrate with Active Directory.
We use soapbox (Score:4, Insightful)
It's jabber based. Free as in beer for both the client and server.
Lets us save logs of all chat sessions between employees, lets employees also save chat if they want to. Lets us do some filtering, overall a pretty good client/server.
http://www.coversant.net/ [coversant.net]
Oh, and I HAVE gotten Digsby to connect to the server, as well as trillian.
You're doing it wrong (Score:5, Insightful)
It sounds like your network, which contains confidential medical records, is connected to the internet.
So I have just one question: Dear God, why?
Re:You're doing it wrong (Score:5, Informative)
Parent
Jabber + Miranda IM (Score:4, Interesting)
The short and simple answer, that should fully meet your needs, is to install jabberd2, configure it as needed (should have a logging module/plugin somewhere), and then to use Miranda IM [miranda-im.org] with only the XMPP components as the client. Miranda is very easy to customize; if you don't want a protocol you simply don't include the relevant DLL.
Note: the links on that page are dead, namely the ones to the MSI installer package that I built. If you have a need for it, feel free to drop me an e-mail (the
We use Exodus and Zimbra (Score:4, Insightful)
Exodus is fairly simple to setup and administer. Zimbra provides much more than just Instant Messaging; we use it mainly for Zimlets and Collaboration; but the IM feature of Zimbra with auto-logging is very useful and sophisticated as well.
OPENFIRE - FOSS Jabber (XMPP) server (Score:3, Insightful)
Citadel groupware server has all of the above (Score:5, Informative)
And it's free software
We ran this. (Score:5, Informative)
Blocking outside services is a waste of time (Score:3, Insightful)
Set up a policy if you really have to but wanting to block services is just a waste of time and doesn't add anything to your security unless you have totally incompetent personnel or fully locked down computers. Otherwise they'll start using web clients or simply work around firewall blocks or the like - which at the end might cause more security issues than the usage of the service in the first place.
It's much better to invest this time to educate your people and teach them why it's a bad idea to use MSN.
Lots of companies set up ridiculous firewall rules and think that they are safe - not knowing that the overkill is causing exactly the opposite of what they want to achieve. People don't like to be locked down if they don't understand why.
I had a similar problem to solve in the (small) company that I work for. We ended up with Openfire and Pidgin. This is not safe from the outside but better than what our big mother company did. They force everyone onto Sametime and have their system locked down like no tomorrow - which ends up in people using a multitude of services and wasting a lot of time to work their ways around the firewall to be able to use MSN, Facebook, Jabber & Co.
While I know what I have to deal with and act accordingly, teach the people that they please stay away from insecure services on their work PC the mother company trusts in their rules and unintentionally provokes insecurity.
Security never works against the people, only with the people.
Spark + eJabberd (Score:3, Interesting)
Initially we had an internal (old junker box) linux server which was only accessible from the internal network and everyone had Jabber IDs of user@customer.local. We recently switched to user@customer.tld so people could access it from their iPhones and Windows Mobile phones using the Palringo client.
ejabberd on linux has nice LDAP integration with Active Directory on Windows. You could also use the OpenFire server which is made by the same people that make Spark. It has a free version and a commercial version IIRC.
+1 for Jabber (Score:4, Informative)
If you want free, open, secure and cross-platform, then it's definitely XMPP/Jabber. No surprise there - open protocol, plenty of servers and clients to choose from - it really is good. From your description, you'll almost certainly want that.
However, For all-Microsoft shops with AD and Exchange, a pretty decent option is Office Communicator (+ the corresponding Server). It doesn't really have many advantages as an IM, but it does integrate with Outlook, Exchange and SharePoint (from shared address book, to minor bits such as auto-setting your status to "Busy - in a meeting" when you have a meeting scheduled on your Outlook calendar, and storing conversation logs in Outlook mailboxes, which indexes them for search). It's also pretty good for conferences. Still, main feature there is that integration - on its own, it's hardly worth the bother. And, of course, it's not free (in any definition of the word), and the protocol, while SIP-based, is not without proprietary quirks.
Re: (Score:3, Insightful)
FOSS? Where did he say FOSS? He never said FOSS. He said 'free'. Most likely free as in beer. What company _isn't_ looking for free software? My guess would be they just don't consider this essential and don't want to waste a shitload of money on it.
Re:FOSS? One Word: Bullshit. (Score:5, Informative)
Nice job reading. I quote from the Ask Slashdot itself:
He didn't say it HAD to be FOSS, but if possible, he would like it.
Parent
Re:wtf (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Bonjour is great, but what you've suggested doesn't meet his needs at all. One of the stated requirements is that there MUST be centralized logging of all conversations, and what you've proposed is direct client-to-client chats with no centralized server.
Re: (Score:3, Insightful)
And will not comply with the OP's logging requirements...
Re: (Score:3, Interesting)
What is nice about Openfire is that it allows you to centralize the management and security a lot, which gives you a lot of control in information-sensitive situations like this. It has integration with an existing LDAP/AD server if you want to keep your authentication policy centralized on your LDAP server if you have one. Likew