One often-overlooked aspect of IoT is communication security. Proof of this is that many recent DDoS (Distributed Denial of Service) attacks were carried out using internet-connected smart devices.
In a previous article we saw how to configure Mosquitto to receive messages published by clients and forward them to all subscribers. Today we will look at how to configure application-level security for our MQTT broker.
In this article I will cover the standard method Mosquitto provides.
Many plugins are available online to extend its functionality and implement advanced security mechanisms, such as user management in various backends or authentication via JSON Web Tokens.
The first step in securing our broker is to implement authentication for connecting clients, so that only authorised clients can send/receive messages.
Before changing the MQTT settings, stop the service with the following command:
sudo systemctl stop mosquitto
Now edit the mosquitto.conf file using the nano text editor.
sudo nano /etc/mosquitto/mosquitto.conf
Next, disable anonymous access by setting the relevant parameter to false and add a reference to the file containing the access passwords (if these lines are not present, add them).
allow_anonymous falsepassword_file /etc/mosquitto/passwords
Then close the file and save it (control/command+x, yes, enter).
Next, you need to create a file containing the password for the account used to access the service.
We will use “mqtt_user” as the username; of course, choose whichever username suits you best.
Run the following commands:
cd /etc/mosquitto
sudo mosquitto_passwd -c passwords mqtt_user
After pressing ENTER, you will be asked to enter the password to assign to the user “mqtt_user”; then press Enter.
Finally, if you don’t need to create any more users, you can restart the Mosquitto service with the following command:
sudo systemctl start mosquitto
Enjoy!
Enjoy!
