mosquitto PSK Encryption not working - mosquitto

I'm trying to build a PSK Encryption bridge connection with mosquitto following this tutorial. I'm using two docker containers. One as a bridge and another one as a server. Both of them on different computers. The connection works fine with no encryption. For the subscriptions to the topics I'm using node-red.
This is the configuration file for the server:
port 1883
persistence true
persistence_location /mosquitto/data/
#persistence_file mosquitto.db
#cleansession false
#clientid nodered
listener 8883
psk_hint broker-server
psk_file /mosquitto/certs/psk_file.txt
log_type all
log_dest file /mosquitto/log/mosquitto.log
connection_messages true
log_timestamp true
allow_anonymous true
#password_file /mosquitto/config/passwd
For the bridge connection I have to files.
mosquitto.conf:
#include_dir /etc/mosquitto/conf.d
# GENERAL CONFIGURATION BROKER
# ----------------------------------------------------------------
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_type all
log_dest file /etc/mosquitto/log/mosquitto.log
include_dir /etc/mosquitto/bridges
# ----------------------------------------------------------------
# SECURITY (comm. Nordic -> RPI): Password
#password_file /etc/mosquitto/passwd
allow_anonymous true
And bridge.conf:
# =================================================================
# Bridges to Node Red
# =================================================================
# IP address
#connection client-bridgeport
connection bridge-01
address 192.168.1.34:8883
bridge_identity bridgeport
bridge_psk 123456789987654321
# -----------------------------------------------------------------
# TOPICS
topic # out 1 ""
topic # in 1 ""
# ------------------------------------------------------------------
# Setting protocol version explicitly
#bridge_protocol_version mqttv311
#bridge_insecure false
# Bridge connection name and MQTT client Id,
# enabling the connection automatically when the broker starts.
cleansession false
remote_clientid broker-server
start_type automatic
#notifications false
log_type all
In the logfile of the server I can see the following error:
Socket error on client unknown, disconnecting.
And in the bridge connection I see the following error:
Bridge broker-server sending CONNECT Socket error on client
local.broker-server, disconnecting.
I don't know what I'm doing wrong. If I remove the encryption everything works fine.

It seems that the default docker container of mosquitto in docker hub has not included the psk encryption in the mosquitto build as is shown in this post.
I had to build my own image installing mosquitto as following:
RUN apt-get -y update && \
apt-get -y install mosquitto mosquitto-clients

Related

Unable to start mqtt image with password file

I have created a docker image of mqtt broker along with a config file. When I am trying to launch the image I am getting error saying: Error: Invalid password hash for user user.
Dockerfile:
FROM eclipse-mosquitto:1.4.12
RUN mkdir -p /mosquitto/data/
COPY mosquitto.conf /mosquitto/config/mosquitto.conf
COPY password.txt /mosquitto/config/password.txt
VOLUME /mosquitto/data/
EXPOSE 80
mosquitto config file:
## Logging
log_dest stdout
log_type error
log_type warning
log_type notice
log_type information
# per_listener_settings true
allow_anonymous false
password_file /mosquitto/config/password.txt
## MQTT Listener
listener 1883
protocol mqtt
## WebSockets Listener
listener 80
protocol websockets
## Persistence
persistence false
Password File:
Error:
I am trying to build an mqtt image with password file and websocket protocol

Mosquitto with persitence as MQTT Forwarding Broker

We want to use Mosquitto MQTT as Message Broker on a number of OpenWRT gateways to forward "local" anonymous MQTT publications to a central RabbitMQ/MQTT cluster with authorization.
Our Problem:
Mosquitto does not reliable forward queued messages when restarted (persistance does not work)
Running mosquitto version: 1.4.15
current config
This is the last tested config:
port 1883
persistence true
persistence_file /mosquitto.db
persistence_location /etc/mosquitto
autosave_interval 1
autosave_on_changes true
allow_anonymous true
connection iotcluster
address ip:1883
notifications false
keepalive_interval 300
restart_timeout 30
start_type automatic
clientid rabbitmqtt
username user
password password
topic mqtt out 2
try_private true
As long as all systems running and online - everything works as expected - any message published locally via:
mosquitto_pub -h localhost -p 1883 -t mqtt -m "Test-Bridge-Online"
will be forwarded and published to the RabbitMQTT.
connection lost
When we produce a connection lost (e.g. disconnect cable) and re-establish that connection, the messages received in the meantime won't be automatically forward from Mosquitto to RabbitMQTT
BUT - when sending a new publish message in addtion - Mosquitto will send out also the queued messages ???
Mosquitto restart
If we restart the Mosquitto during the connection lost, the queued messages are all lost - NO PERSISTINACE options worked so long.
Please help
We tried different options of autosave_interval, QoS 0/1/2 ond other option combination - but in anyway - on restart Mosquitto - all messages are lost - NO PERSISTANCE in any way
After running an update to mosquitto version 1.6.10 still no success.
I could isolate the main problem - the database did not save when seetings:
persistence true
persistence_file /mosquitto.db
persistence_location /etc/mosquitto
autosave_interval 1
autosave_on_changes true
Not sure why but could not manage to invoke a save of database by the above settings.
The database save on SIG-EXIT but not when pushing new message.
So I changed the settings to:
persistence true
persistence_file /mosquitto.db
persistence_location /etc/mosquitto
autosave_interval 300
autosave_on_changes false
and invoke a request to save the database after pushing the message:
# publish a new message
mosquitto_pub -h localhost -p 1883 -t mqtt -m "Test Offline 100" -q 1
# send signal to save database
killall -SIGUSR1 mosquitto
When using this - all kind of messages where queued in an state of the connection and get delivered.
That's the final configuration:
user mosquitto
port 1883
allow_anonymous true
queue_qos0_messages true
persistence true
persistence_file mosquitto.db
persistence_location /etc/mosquitto/
autosave_interval 300
autosave_on_changes false
connection ConName
address remote-ip:1883
bridge_protocol_version mqttv31
clientid ClientName
username user
password password
cleansession false
try_private false
retain_available false
start_type automatic
restart_timeout 60
keepalive_interval 120
notifications true
notifications_local_only true
notification_topic mqtt
topic mqtt out 1

Local MQTT broker not reading the .conf file while bridging to cloud MQTT broker

I am trying to connect my local mqtt broker to DIoTY cloud broker. I have taken reference from https://www.losant.com/blog/how-to-configure-mosquitto-bridge-to-losant and done all the configuration file changes as required. My /etc/mosquitto/mosquitto.conf looks like
# Place your local configuration in /etc/mosquitto/conf.d/
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_dest file /var/log/mosquitto/mosquitto.log
include_dir /etc/mosquitto/conf.d
I made my separate cloud.conf file in conf.d
# Config file for mosquitto
# See mosquitto.conf(5) for more information.
user mosquitto
max_queued_messages 200
message_size_limit 0
allow_zero_length_clientid true
allow_duplicate_messages false
listener 1883
autosave_interval 900
autosave_on_changes false
persistence true
persistence_file mosquitto.db
allow_anonymous true
connection dioty
address mqtt.dioty.co:1883
bridge_attempt_unsubscribe false
remote_username *******
remote_password *******
start_type automatic
bridge_protocol_version mqttv311
notifications false
try_private true
bridge_insecure false
cleansession false
topic # in 0
Mosquitto logs after starting broker are as follows
1608537228: mosquitto version 1.6.12 starting
1608537228: Config loaded from /etc/mosquitto/mosquitto.conf.
1608537228: Opening ipv4 listen socket on port 1883.
1608537228: Opening ipv6 listen socket on port 1883.
1608537228: mosquitto version 1.6.12 running
1608539039: Saving in-memory database to /var/lib/mosquitto/mosquitto.db.
What I think is my local mqtt is not reading .conf file. How can I fix this?
You are using Losant configuration to configure DIOTY broket which won't work as both are a different broker.
To save credentials in mosquitto config, first, you have to generate the password file using mosquitto_passwd
mosquitto_passwd -c /etc/mosquitto/passwd USER PASSWORD
then add password file location to mosquitto config also set allow_anonymouse=false
allow_anonymous false
password_file /etc/mosquitto/passwd
That's it now you just need to publish or subscribe using
mosquitto_pub -h localhost -t "test" -m "hello world
mosquitto_sub -h localhost -t test

Mosquitto "SSL is disabled"

I have setup Mosquitto MQTT with SSL on port 8883. However when I try and connect I get an error "Error: A TLS error occurred"
I looked up the mosquitto logs and I see "SSL is disabled" in the logs.
I don't think that's expected.
All the certificates are valid.
My config File (Note: mqtt.test.com is not the actual host):
autosave_interval 1800
# Persistence Settings
persistence true
persistence_file mosquitto.db
persistence_location /tmp/
connection_messages true
# Logging Settings
log_timestamp true
log_dest file /home/ubuntu/mqtt/mosquitto/mosquitto.log
log_type debug
# Port Settings
listener 1883
# Only needed if Websockets
listener 8033
protocol websockets
certfile /etc/letsencrypt/live/mqtt.test.com/cert.pem
cafile /etc/letsencrypt/live/mqtt.taggle.com/chain.pem
keyfile /etc/letsencrypt/live/mqtt.test.com/privkey.pem
listener 8883
certfile /etc/letsencrypt/live/mqtt.test.com/cert.pem
cafile /etc/letsencrypt/live/mqtt.test.com/chain.pem
keyfile /etc/letsencrypt/live/mqtt.test.com/privkey.pem
There is no need to build mosquitto from source to user the auth_plugin, you need access to the matching src bundle for the version of the broker you have installed.
When you built mosquitto you most likely didn't have the openssl dev packages installed to allow the build to link against openssl.
That or you built mosquitto with make WITH_TLS=no
Double check you followed all the instructions in the readme.md that comes with the src and that installed all the prerequisite packages

Mosquitto - No data in $SYS topics

My setup has mosquitto 1.4.12 using TLS and user/pass authentication, it is working without issues under Ubuntu 14.04 for quite some time.
Problem is that no data is being published to any $SYS broker status topics. I have reviewed the configuration and sys_interval is set to 10. Is anything else needed to have this working?
I've tried many clients (mosquitto_sub, paho-mqtt, mqtt.fx), so it looks like a wrong mosquitto config, not a client issue.
mosquitto.conf looks like this:
sys_interval 10
max_queued_messages 10000
max_inflight_messages 100
max_connections -1
connection_messages true
log_dest stderr
log_type error
log_type warning
log_type notice
log_type information
log_type all
log_timestamp true
password_file /etc/mosquitto/conf.d/jp.pw
acl_file /etc/mosquitto/conf.d/acl.conf
persistence true
persistence_location /var/lib/mosquitto/
persistence_file mosquitto.db
persistent_client_expiration 1m
autosave_interval 600
retained_persistence true
listener 8883
tls_version tlsv1.2
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/ca_certificates/cert.crt
keyfile /etc/mosquitto/ca_certificates/cert.key
require_certificate false
allow_anonymous false
acl.conf has this, may be unnecessary:
user test
topic #
The topic filter in the ACL applies the same rules as normal wildcard handling so just allowing access to # will not cover the `$SYS/#' topics.
You need to add a extra topic line to the ACL to include the $SYS topics:
user test
topic #
topic $SYS/#

Resources