business chat

How to secure your chats with Matrix

Privacy and security can be difficult to achieve, especially for your entire organization. It involves many factors and can be difficult to manage from the top. While you may not want to, or don’t have the ability to manage every aspect of your organization’s members there are some things you can do. One of the most important and sensitive factors would be how your organization’s members communicate about internal matters. While talking face to face is one of the more common ways, this is not always possible. More people than ever work remote. Especially in the IT industry. There is an obvious need for remote communication methods.

Instant messaging is probably one of the more popular ways to communicate. There’s many platforms like Skype, Slack, and WhatsApp that simplify this. While some of them may boast encryption from client to server or even end-to-end encryption, you’re still transferring trust to a 3rd party and their code. If this worries you, it may be best to run your own instant messaging server. Commonly, organizations and individuals who are concerned about this have setup XMPP servers (formerly known as Jabber). While this arguably isn’t a bad solution, XMPP can be tricky to work with compared to other more modern solutions.

One of the most notable competitors to the XMPP protocol would have to be Matrix Synapse. Matrix, like XMPP can be a decentralized (federated) but you can tweak it to your organization’s needs. For example, you can disable public registration, use LDAP for authentication and disable federation. Just like XMPP, there are many implementations of the Matrix protocol.

Matrix Tutorial

In this tutorial we will be going over how to setup your own Matrix Synapse server on GigeNET Cloud. This will show you the basics of how to run your own Matrix server. If you don’t have a GigeNET Cloud account, head over here and check out our plans. Synapse is the server created by Matrix developers and can be found here.

First, we’ll need to create a GigeNET Cloud machine. Once you’re logged in, it’ll look like this.

How to secure your chats with MatrixClick on “Create Cloud Lite”

How to secure your chats with MatrixSet a proper hostname for your new machine, select the desired location, zone and OS. For this tutorial we’ll be using Debian 9 (Stretch). You’ll then need to pick a plan that fits your needs. Matrix Synapse recommends at least 1GB of memory. We’ll go with GCL Core 2. After you’ve set everything to what you want press “Create VM”.

How to secure your chats with MatrixNow your cloud VM has begun spinning up on one of our hypervisors. It may take a bit, but you can ping the VM’s public IP until you see that it’s up. This page will show all of the details you’ll need to know to login.

How to secure your chats with MatrixOnce the VM is up, you can SSH in with your favorite SSH client. I use Linux, so I’ll be using openssh-client. We’ll want to perform a full upgrade of all packages on Debian, so you’ll need to run this.

root@matrix-test:~# apt update && apt dist-upgrade

Once that has finished, reboot your VM.

root@matrix-test:~# reboot

Once you’re back in after the reboot. Let’s take a look at the available Matrix serversThere’s quite a few, but as mentioned, we’ll be using Synapse. Click Synapse.

How to secure your chats with MatrixIf you’re interested in learning more about Matrix Synapse I highly recommend that you check out their GitHub repository.

How to secure your chats with MatrixBefore you grab their repo key you’ll need to install apt-transport-https. This is required to use HTTPS with the apt package manager.

root@matrix-test:~# apt install apt-transport-https

When that finishes you can then grab their repo key, import it and add the repository into your sources file with the following commands.

root@matrix-test:~# wget -qO - https://matrix.org/packages/debian/repo-key.asc | apt-key add -

root@matrix-test:~# echo deb https://matrix.org/packages/debian/ stretch main | tee -a /etc/apt/sources.list.d/matrix-synapse.list

root@matrix-test:~# apt update

If everything checks out you’re now ready to install Matrix Synapse! We’ll also install a few extras.

  • Certbot (to get a free Let’s Encrypt certificate) 
  • Haveged (to speed up entropy collection)  

root@matrix-test:~# apt install matrix-synapse certbot haveged

You’ll get an ncurses interface during the installation asking for a few configuration parameters. Make sure to set your FQDN here.

How to secure your chats with MatrixIt’s up to you whether you want to send anonymous statistics. I chose not to.

How to secure your chats with MatrixIf you have your own certificate you can simply copy over the certificate and private key in the same way. Now let’s get our Let’s Encrypt certificate!

A few more things to note.

  • You’ll need to ensure your domain or subdomain points to your new server via a DNS A record or AAAA record if you want to use IPv6.
  • You’ll need to enter an email address to receive certificate expiry notices.
  • You’ll need to agree to the Let’s Encrypt terms and conditions.

root@matrix-test:~# certbot certonly --standalone -d matrix-test.gigenet.com

How to secure your chats with Matrix

Once we have our certificate and private key we need to copy them over to /etc/matrix-synapse like so (change directory to your FQDN).

cp /etc/letsencrypt/live/matrix-test.gigenet.com/fullchain.pem /etc/matrix-synapse/fullchain.pem

cp /etc/letsencrypt/live/matrix-test.gigenet.com/privkey.pem /etc/matrix-synapse/privkey.pem

Next, we’ll need to generate a registration secret. Anyone who has this secret will be able to register an account. So you want to keep it safe.

root@matrix-test:~# cat /dev/random | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1

Output should be a random string of 64 characters like: TDfdIXPBWDOqaVsR5erVJLKdqPqIAsrvfvEtgHfY8oZ06F5NMYnhdbHhVbneDiTF

Now we need to edit the config. You can use nano or your favorite text editor.

root@matrix-test:~# nano /etc/matrix-synapse/homeserver.yaml

Search for the parameter when you’re in nano with CRTL + W and enter registration_shared_secret

Ensure that the line looks like this:

registration_shared_secret: “TDfdIXPBWDOqaVsR5erVJLKdqPqIAsrvfvEtgHfY8oZ06F5NMYnhdbHhVbneDiTF”

We’ll also need to enable TLS support for the web client and add the paths for our certificate and private key.

Make sure the following line web_client looks like this.

web_client: True

Now we’ll add our certificate and private key to the config. The lines should look something like this.

tls_certificate_path: “/etc/matrix-synapse/fullchain.pem”

tls_private_key_path: “/etc/matrix-synapse/privkey.pem”

Save and exit your text editor after you’ve followed the steps above. We can now enable matrix-synapse to start on boot, and start the service!

systemctl enable matrix-synapse

systemctl start matrix-synapse

If everything checks out the service should have started successfully. If not you can check its status to see why it failed with.

systemctl status matrix-synapse

Now we’re ready to setup our first user. This command will allow you to register a user and make it the administrator. You can also use this command to register normal users. By default, Matrix Synapse is not configured to allow public registration.

register_new_matrix_user -c /etc/matrix-synapse/homeserver.yaml https://localhost:8448

How to secure your chats with Matrix

We’ve got our first user, now we’re going to have to pick a Matrix chat client. You can see a list of clients here but in this tutorial we’ll be using Riot on a Windows VM. It has very good support and is cross-platform. Chats can also be end-to-end encrypted with Riot! Go here to download it. 

How to secure your chats with MatrixOnce you have it installed for your platform of choice and launch it. You’ll be greeted with a similar window as the one below. Click “Login”.

How to secure your chats with Matrix

You’ll then need to enter your server’s details along with the credentials you set for your administrator account.

How to secure your chats with Matrix

After you’ve signed in you’ll be greeted with a similar interface. Let’s create our first room by pressing the + button on the bottom left of the window.

How to secure your chats with MatrixWe’ll just name it “Admin Room” for this test.

How to secure your chats with Matrix

Now we’ve got our own room that we can invite other users to!

How to secure your chats with MatrixNeed to know how to do more with Riot? They have a great FAQ with a few video tutorials on how to perform some basic tasks. 

While administering a Matrix server might be a bit of a learning curve it’s worth it if you value having control of your own data. If you want to dive more in-depth on how to setup other Matrix Synapse features I highly recommend that you head over to their GitHub page

Sound like a bit too much? Let our team of experts manage your systems.