Mosquitto unauthenticated access for localhost?

[Glyn Hudson]

Is is possible to setup Mosquitto to allow unauthenticated anonymous access for localhost but require authentication from remote connections? 

[Steve Trease]

Hi. I'm trying to figure out the same thing. Did you figure out a solution?

I think I want two listeners: 1883 with unauthenticated access on localhost and one on 8883 with user/name password required.

Something like:

password_file /etc/mosquitto/mosquitto_passwd

listener 1883 127.0.0.1

allow_anonymous true

listener 8883 xxx.xxx.xxx.xx

allow_anonymous false

However it does not seem possible to specify the allow_anonymous directive on a listener by listener basis.

I'm surprised I can't can't find this configuration documented anywhere - I'd have thought it would be a fairly common requirement.

Cheers,

Steve

[Glyn Hudson]

Hi Steve,

No, I didn't find a solution. Please let me know if this solution works for you.

- sent from my mobile device

--
To learn more about MQTT please visit http://mqtt.org
---
You received this message because you are subscribed to a topic in the Google Groups "MQTT" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/mqtt/bDdSmQgNe74/unsubscribe.
To unsubscribe from this group and all its topics, send an email to mqtt+uns...@googlegroups.com.
To post to this group, send email to mq...@googlegroups.com.
Visit this group at https://groups.google.com/group/mqtt.
For more options, visit https://groups.google.com/d/optout.

[Steve Trease]

Glyn,

I did find a solution, but it isn't really that pretty or elegant, but it does work.

I've ended up running two mosquitto daemons with a bridge between them to sync the messages.

One for unauthenticated traffic bound to 1883 on 127.0.0.1 and another for authenticated traffic on my external IP address bound to 8883. 

Hopefully that makes sense.

Regards,

Steve

[Glyn Hudson]

Hi Steve,

Great, thanks for letting me know. 

On 6 January 2016 at 16:44, Steve Trease <steve...@gmail.com> wrote:

Glyn,

I did find a solution, but it isn't really that pretty or elegant.

I've ended up running two mosquitto daemons.

One for unauthenticated traffic bound to 127.0.0.1 on 1883 and another for authenticated traffic on my external IP address bound to 8883. 

Regards,

Steve

--

Glyn Hudson

http://megni.co.uk
http://adventuresplusnorthwales.blogspot.com

[Karl Palsson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Not sure why you were both struggling so much with this. Here's
an example config file I've been using for a couple of years
now..


karlp@mq1:~$ sudo cat /etc/mosquitto/mosquitto.conf
max_queued_messages 100000

# Make sure to age out dead clients, otherwise they accumulate forever
# this is a mosquitto specific feature
persistent_client_expiration 2m

# default listener only on localhost, as default is insecure
bind_address 127.0.0.1

port 1883

# TLS listener (with TLS-PSK)
listener 8883

psk_hint just_some_hint_that_nobody_sees
use_identity_as_username true
persistence true
persistence_location /var/lib/mosquitto/

psk_file /etc/mosquitto/my_keys_file
acl_file /etc/mosquitto/my_private_acl_file

karlp@mq1:~$


The "use_identity_as_username" is related to how my acls and psk
setup works, and isn't really relevant to just having a localhost
restricted listener.

Cheers,
Karl P

- --
Sent using Mailpile, Free Software from www.mailpile.is

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJWjj5hAAoJEBmotQ/U1cr2llYP/1GP05rBRqVUnn0Ua48O2Ync
/U+SRhCgIlssh3WUP5c/CiYI7gbQ7DTM/7ZW4yi15YZO/7Qba0ZK5Ygg7XT0XnnF
VH9DTq4bMZpgaKzjFuml5GNAzgqTBN7JyUPEQ5486uFGnEi3LF+ubpM51njLkJgD
DJ5qggMSnXGBCz9OkQOcxtgTVDGUSvau4SpYWMrA91499bpUpLXlo/c23jyZmNEr
mLRvKBITmwsZ0JCKotEXUD0Hbd9+T+GER61O4We6l4K+OobpX/NP5dx7xqsymBko
n5nHQazmDb0Pa6ggBr+iRmiX7ADT9sJv9slvcJfN/ey4NHHTICzBe2pXv3rBBZQw
m9g5dt9YbQBU3hYUh4mKlb3OyN4kxQ6esMW+pAAY+8Em1u9BOAyO46Qxg17KoEWf
2U4/bOUlgCndsWMmSbNIAnt+OoqYcsT2zRUG+dG828h7BL+VRGYDiDsgOhnCL7t9
71O4jq/z+eg9D1oVyZJOkQX5rDVYiRrfczeM+in6slTAAErmLRyBknIVTMvNMoDU
25kN5g+h6/LxbdeAbnnxA4FWDB0UYE+2VH+SlfBH5kbNpUGedOKdA5dLYFahJMGE
evacK5ADYDei2kd8GSnXt3bt+gEA7D+1prQr+qC+66cN94cSQdUZTJwzOPtc29qt
0d2FOMfd/z3R3rT5XY4x
=Z2SE
-----END PGP SIGNATURE-----

[Carlos Iván Conde Martín]

Hi!

It's been more than a couple of years. 

Does recent mosquitto versions permit to attach different authentications to different listeners?

Thanks,

Iván

[Jan Sosulski]

Hi,

you can use the per_listener_settings flag in the mosquitto config. Minimal working example of what you would like to accomplish:

per_listener_settings true

listener 1883 localhost
allow_anonymous true

listener 8883
allow_anonymous false

Cheers
Jan