Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [mosquitto-dev] Question regarding acl management and clientid
If you are looking at the code for the FROST-Server, patch it to provide a username/password, it's going to only be one or 2 more lines than adding a configured client id. 

On 01/12/2022 08:34, Michael Dawid wrote:

Hi Norbert,
thanks for your reply. I understand, that i can pin the clientId to a specific username/password combo. My question is, can i use only the clientId to authenticate a client towards the broker?
We are currently trying to setup a FROST-Server <https://github.com/FraunhoferIOSB/FROST-Server>, with mosquitto. This server uses the mosquitto broker in the background as a "message bus" to inform all clients, that new items (observations etc.) are available. We would like to open the mqtt broker to the public, but we'd like to restrict it so that not all topics are openly available. Now, the FROST-Server seems not to have any configuration implemented, that allows to set a username / password for authenticating towards the mqtt broker. It requires the broker to accept anonymous connections. I'm currently analysing the source code if a configurable clientId could be implemented. I saw, that the mosquitto broker has the option to use a clientid_prefixes. This can work for now, but the comments stated, that this option is deprecated. Furthermore, when making the broker public, you would only have to guess the clientId prefix and get full access.
I have also seen, that there is the per_listener_settings option. Could i use that, to have the broker listen on port 1883 for anonymous access, and any other port that uses the dynsec-opion? 

Any thoughts on that?

Thanks and BR;
Michael
30. November 2022 18:20, "Norbert Heußer" <norbert.heusser@xxxxxxxxxx <mailto:norbert.heusser@xxxxxxxxxx?to=%22Norbert%20Heu%C3%9Fer%22%20<norbert.heusser@xxxxxxxxxx>>> schrieb: 

    Hi Dawid,
    welcome to the Mosquitto mailing list.
    In general you have two different mechanisms in the mosquitto broker
    to configure access control:
    1. The traditional way using a password file and a ACL file
    2. The dynamic_security, which will store the users, roles, etc in
    it’s own config file in a JSON format.
    For the later one you need to add the dynamic_security plugin to the
    broker config. But the dynamic security plugin has the big advantage
    to allow modifying the configuration anytime without the need of a
    broker restart.
    In both cases the permissions are finally assigned to the
    username/password combination. If you are using the the dynsec
    plugin with the mosquitto_ctrl don’t get confused with the term
    “Client”. IN the dynsec context this refers to a username/password
    identifying the user. So normally you may have multiple mosquito
    clients using the same username/password combination to connect to
    the broker. As long as each of these connection has a different
    clientid (or user auto generated clientid).
    Additionally the dynsec plugin does allow you to pin a
    username/password combination to a fixed client id. Either by using
    the -c option in the user creation or later on with a setClientId
    call. Once a user is pinned to a fixed clientid it should no longer
    be possible to use this username/password credentials with any other
    clientid than the pinned one.
    If you want to restrict access to your broker to a fixed set of
    clientid you would need to create a single user for each clientid
    and pin one user to one clientid.
    Best,
    Norbert

    On 30. Nov 2022, at 16:55, Michael Daeid <mda.forum@xxxxxxxxxxxxx
    <mailto:mda.forum@xxxxxxxxxxxxx>> wrote:
    Hi,

    this is my first mail in such a mailing list. Apologies for any
    (formal) mistakes i make.

    I'd like to know if it's possible to grant or restrict a
    mqtt-client the access to the mosquitto broker based on the clientId.

    I have played around with the `mosquitto_ctrl` plugin and was able
    to create clients and roles. I even managed to create a client
    with a clientId using the -c switch.

    Now, i'd like to know, if i can setup a client with mosquitto_ctrl
    with a full access role, whose connection is accepted by only "the
    right" clientId?

    Thanks in Advance,
    BR,
    Michael Dawid
    _______________________________________________
    mosquitto-dev mailing list
    mosquitto-dev@xxxxxxxxxxx <mailto:mosquitto-dev@xxxxxxxxxxx>
    To unsubscribe from this list, visit
    https://www.eclipse.org/mailman/listinfo/mosquitto-dev
    <https://www.eclipse.org/mailman/listinfo/mosquitto-dev>

    --
    *Norbert Heußer*
    Senior Developer | Cedalo GmbH
    Email: norbert.heusser@xxxxxxxxxx <mailto:philip.ackermann@xxxxxxxxxx>
    Tel: +49 173 936 43 63
    Cedalo GmbH
    The company behind Eclipse Mosquitto and Eclipse Streamsheets
    https://cedalo.com/ <https://cedalo.com/>

    Geschäftsführer: Philipp Struss, Philip Ackermann, Dr. Stefan Lölkes
    Registergericht: Amtsgericht Freiburg, HRB 725414

    ---------------------------------------------------------------------------------------------
    Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte
    Informationen. Wenn Sie nicht der richtige Adressat sind oder diese
    E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den
    Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren
    sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet.



--
Handy: 0176 201 289 18
E-Mail: Michael@xxxxxxxxxxxxx <mailto:Michael@xxxxxxxxxxxxx>



_______________________________________________
mosquitto-dev mailing list
mosquitto-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/mosquitto-dev


--
https://www.hardill.me.uk/wordpress
https://github.com/hardillb
https://about.me/hardillb
https://flickr.com/photos/hardillb/
https://keybase.io/hardillb

Back to the top