open source · ejabberd module · 04
mod_signup_keyword
The password at the speakeasy door, for your XMPP server.
It’s an ejabberd mod that lets you do in-band registration with a secret pre-shared key. It’s like the shared password to get into a speakeasy at the door. You can give it to your friends, they share it with their friends, and you end up with more friends (ideally). Yes, it’s less secure than existing one-time-use tokens, but it is meant to make it easier for your friends to get your friends on XMPP.
01 Built on ejabberd
One pre-shared keyword
Whisper it in their ear, mention it over a beer. Message it on Signal, or blink it in Morse code with your eyes. You just share it with someone to let them sign up on your server.
Standard IBR, untouched
It does not re-invent IBR, it leverages existing mechanisms. Any client that can draw a data form already works, Mach included — nothing to add on their end.
Reuses ejabberd auth
It does not re-invent account setup, it just handles what mod_register would handle. Your existing SCRAM hashing and Mnesia or SQL storage carry on as they were.
The keyword stays quiet
Nobody can guess it by timing how fast the server says no, and it never lands in your logs. A failed attempt records the IP and the username they wanted, nothing else.
02 What it is
ejabberd either allows open IBR where you fight spam with CAPTCHA, or one-at-a-time invite tokens. So this sits in the middle. You can always rotate it, and it does have built-in rate limiting in any case.
03 How it works
- 01
Compile
Build the .beam against your ejabberd tree with erlc. You will get one warning about behaviour gen_mod being undefined — ignore it, it sorts itself out at load time once ejabberd is on the code path.
- 02
Configure
Add it to ejabberd.yml with your keyword, a welcome message, any usernames you want to keep for yourself, and a per-IP rate limit. Do not load mod_register at the same time — they both want the register namespace and they will fight over it.
- 03
Restart
Restart ejabberd — systemctl most places, stopsrc and startsrc on AIX. The module then advertises register and answers the registration IQ itself.
- 04
Verify
Run the bundled test script against your host to check the form really does offer the keyword field. Then go hand the keyword to people.
04 What’s in it
Per-IP rate limiting
Someone hammering your server gets throttled — ten minutes by default. ejabberd’s own registration_timeout does not apply here, because this module stands in for mod_register.
Reserved usernames
Nobody gets to be admin, root, support or info, even with the right keyword. Change the list in the config if you like.
Welcome message
Say hello to everyone who signs up. Leave it blank if you would rather not.
Sensible errors
Wrong keyword, name taken, bad JID, weak password, too many tries — each one comes back as the XMPP error it ought to be.
Keyword never logged
A failed attempt records the IP and the username they tried. The keyword itself stays on the box and out of git.
No dependencies
Erlang and ejabberd, nothing else. One .beam file dropped in your ebin directory.
05 Get it
It’s open source under GPL-2.0-or-later — the same licence as ejabberd, because it is a derivative work. The source, a config reference and an end-to-end test script are all on GitHub.
View on GitHubTested with Mach, which spots the keyword field and draws it as an invite-code box without being told to.