Openfire XMPP

Connecting to your instance

Connect over SSH on port 22 as the default login user for the operating system variant you launched.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh <login-user>@<instance-public-ip>

Prerequisites

You need an AWS account and an EC2 key pair in the target region.

m5.large (2 vCPU / 8 GiB RAM) is the recommended starting size. Choose a larger size for more concurrent users and rooms.

Configure the instance security group to allow 22/tcp from your management network and 80/tcp and 443/tcp for the admin console. Also allow 5222/tcp and 5223/tcp for XMPP clients and 5269/tcp for server-to-server federation. The admin console uses a per-instance self-signed certificate, so browsers show a certificate warning until you install a trusted certificate (see Maintenance).

Step 1 - Launch from AWS Marketplace

Find the Openfire listing by SecureAnyCloud in AWS Marketplace. Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration and Continue to Launch.

Pick the m5.large instance type, your key pair, and a security group that opens ports 22, 80, 443, 5222, 5223 and 5269. Then launch the instance. You can also launch the AMI directly from the EC2 console.

Step 2 - Launch from the AWS CLI

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openfire}]'

Make sure the referenced security group opens ports 22, 80, 443, 5222, 5223 and 5269.

Step 3 - Confirm the services are running

systemctl is-active openfire.service nginx.service ss -tln | grep -E '5222|5223|5269|9090'

Both services report active. Openfire listens on ports 5222 and 5223 for XMPP clients and on port 5269 for federation. The admin console listens only on the loopback address 127.0.0.1:9090 (and on 9091 for its own secure port), and nginx fronts it on ports 80 and 443.

Step 4 - Retrieve your admin password

The Openfire admin password is generated uniquely on the first boot of your instance and written to a root-only file. Read the file with sudo:

sudo cat /root/openfire-credentials.txt

The file contains OPENFIRE_USERNAME (admin), OPENFIRE_PASSWORD and the admin console URL. It is mode 0600 and owned by root, so only an administrator can read it. Store the password somewhere safe.

The embedded database that holds your users and rooms lives on the dedicated data volume mounted at /var/lib/openfire.

Step 5 - Confirm the health endpoints

nginx serves an unauthenticated health endpoint for load balancers and probes. It also fronts the admin console login page over both HTTP and TLS:

curl -s -o /dev/null -w 'healthz HTTP %{http_code}\n' http://localhost/healthz
curl -ks -o /dev/null -w 'healthz TLS HTTP %{http_code}\n' https://localhost/healthz
curl -ks -o /dev/null -w 'login TLS HTTP %{http_code}\n' https://localhost/login.jsp

/healthz returns HTTP 200 and never requires authentication, so it is safe to use as an Application Load Balancer health probe. The admin console login page returns HTTP 200 over TLS, which confirms that the setup wizard was pre-completed and the server is ready for sign-in.

Step 6 - Verify authentication from the command line

The admin console uses a CSRF-protected login form. The check below fetches the login page to obtain the CSRF cookie. It then signs in with the correct per-instance password, which returns an HTTP 302 redirect to the dashboard. For contrast, it also tries a wrong password, which is rejected and re-renders the login page as HTTP 200.

Because the command embeds your unique password, run it interactively rather than from a script. Substitute the value of OPENFIRE_PASSWORD from Step 4 for <OPENFIRE_PASSWORD>:

login() {
J=$(mktemp); curl -s -c "$J" -o /dev/null http://localhost/login.jsp
C=$(awk '$6=="csrf"{print $7}' "$J")
curl -s -b "$J" -o /dev/null -w "%{http_code}\n" \
  --data-urlencode "username=admin" --data-urlencode "password=$1" \
  --data-urlencode "csrf=$C" --data-urlencode "login=true" \
  --data-urlencode "url=/index.jsp" http://localhost/login.jsp rm -f "$J" } echo "correct password -> HTTP $(login '<OPENFIRE_PASSWORD>')" echo "wrong password -> HTTP $(login 'wrong')"

The correct per-instance password prints HTTP 302 (signed in and redirected to the dashboard). A wrong password prints HTTP 200 (rejected, and the login page is shown again).

Step 7 - Sign in to the admin console

Browse to https://<instance-public-ip>/. The admin console uses a per-instance self-signed certificate, so your browser shows a certificate warning the first time. Accept the warning, or install a trusted certificate as described in Maintenance.

Because the setup wizard was pre-completed on first boot, you land directly on the Openfire admin console login page, never on the setup wizard. Enter admin as the username and the password from Step 4, then select Login.

Step 8 - Explore the server dashboard

After you sign in, the admin console opens on Server Information. This dashboard shows the server version, the XMPP domain, uptime, the Java runtime and the listening ports, including the loopback-only admin console.

Use the tabs across the top to manage users and groups, sessions, group chat, server settings and plugins.

Step 9 - Manage users and groups

Open the Users/Groups tab to list existing accounts and create new ones. Select Create New User and enter a username and password to create a JID such as alice@localhost. That user can then sign in from any XMPP client.

Use groups to build shared rosters, so that members automatically see one another.

Step 10 - Sessions and group chat

The Sessions tab lists the currently connected clients, so you can see who is online in real time. The Group Chat tab manages your Multi User Chat service and rooms.

Create persistent rooms, set their access and moderation, and monitor the active conversations on your server.

Step 11 - Connect an XMPP client

Point any XMPP client (for example Gajim, Conversations, Dino, Spark or Pidgin) at your server. Sign in with a JID you created, such as alice@localhost, and the password you set. Set the connection server or host to the instance's public IP address, and use port 5222 (STARTTLS) or 5223 (direct TLS).

To chat between servers, Openfire federates over port 5269 (server-to-server). Create group chat rooms from a client that supports Multi User Chat, or manage them from the admin console.

Step 12 - Confirm data lives on the dedicated volume

Openfire stores its data under /var/lib/openfire on the dedicated data volume. This data is the embedded database that holds your registered users, rooms, rosters and offline messages. Because it sits on its own volume, it survives OS changes and can be resized independently:

findmnt /var/lib/openfire

A separate EBS data volume backs the mount. It is captured into the image and re-provisioned on every instance.

Maintenance

• Password. The admin password is set on first boot. To change or reset it, sign in to the admin console and open Users/Groups -> admin -> Edit Properties.
• Serve a real domain. The default XMPP domain is localhost. For production, sign in to the admin console and open Server -> Server Manager -> System Properties (or Server Settings). Set your public domain, then configure DNS SRV records (_xmpp-client._tcp and _xmpp-server._tcp) for clients and federation.
• TLS and certificates. nginx fronts the admin console on port 443 with a per-instance self-signed certificate at /etc/nginx/ssl/, and Openfire generates a self-signed certificate for client STARTTLS. For production, point a DNS name at the instance and obtain a trusted certificate (for example with certbot and Let's Encrypt). Replace the nginx certificate, and import a certificate for XMPP clients under Server -> TLS/SSL Certificates in the admin console.
• Chat rooms (MUC). Multi User Chat is enabled. Create and administer rooms from the Group Chat tab or an XMPP client. Rooms and their archives are stored in the embedded database on the data volume.
• Federation. Server-to-server federation is enabled on port 5269. Open the port in your security group to chat with users on other XMPP servers.
• Plugins. Openfire has a rich plugin ecosystem (REST API, monitoring, push and more). Install and manage plugins from the Plugins tab in the admin console.
• Storage. All Openfire state lives under /var/lib/openfire on the data volume. Back up that volume with EBS snapshots to protect your users, rooms and history.
• Security patches. unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on AWS

Launch Openfire XMPP Server with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com