CODEWITHSUNDEEP
mqttaclmosquitto
Valouzze
Valouzze

Reputation: 11

Mosquitto - How to authorize only one device in the network?

I am a beginner on mosquitto (Alpine Linux machine) After several searches I did not find the answer I would like to authorize MQTT messages only from one device in the network I tried changing "aclfile.example" to "acl.acl"

user "equipment IP"
topic test

But this did not restrict the connection to only this equipment (The server can still receive messages from others)

Ideas?

Upvotes: 1

Views: 1468

Answers (2)

hardillb
hardillb

Reputation: 59791

There are several things that probably need covering here:

  1. Mosquitto ACLs deal in users and topics, not IP addresses.
  2. By default (at least until v2.0.0 shipped this week) mosquitto allows clients to connect without specifying a username/password. You can disable this by adding allow_annonymous false to the config file
  3. Just renaming the example ACL file will not cause it to be loaded, you need to explicitly point to it in the config file with the acl_file directive.
  4. You will also need to specify a password file with the password_file if you want to ensure that a specific username can only be used by authorised clients.

If you really want to limit access to a single local machine then you may do better looking to user the firewall to only accept external connections from that IP address using the firewall. e.g. iptables on Linux.

Upvotes: 1

JD Allen
JD Allen

Reputation: 944

There are a couple of ways to do this. The easiest would be to define one user, and disable anonymous access. Your mosquitto.conf file would look like this:

port 1883
allow_anonymous false
password_file /etc/mosquitto/pwfile

You might have other options in your config file for things like logging and persistence, but these lines would only let clients that had the user/password connect. You then set your one username/password up in the pwfile file. Here's a great blog post about how to do that: http://steves-internet-guide.com/mqtt-username-password-example/

Keep in mind that your client node now has to also provide the username/password on the CONNECT packet, or be denied access.

Another way would be to issue an SSL cert to your client, and only allow that cert in. Again, Steve has a great blog post about how to set that up: http://www.steves-internet-guide.com/creating-and-using-client-certificates-with-mqtt-and-mosquitto/

Upvotes: 0

Related Questions