Mosquitto

https://mosquitto.org/documentation/
Admin
Mosquitto is an open-source message broker that implements MQTT protocol versions 5.0, 3.1.1, and...
Tokens:22,657
Snippets:212
Trust Score:9.8
Update:5 days ago
Show doc for...
Tokens:
Raw
### Example mosquitto_ctrl options file

Source: https://mosquitto.org/documentation/dynamic-security

An example of an options file content, where each line corresponds to a command-line argument.

```text
--cafile /path/to/my/CA.crt
--cert /path/to/my/client.crt
--key /path/to/my/client.key
-u admin
-h mosquitto.example.com
```

--------------------------------

### Example mosquitto_ctrl connection command

Source: https://mosquitto.org/documentation/dynamic-security

A practical example of connecting to a local broker as an admin user.

```bash
mosquitto_ctrl -u admin -h localhost dynsec <command> ...
```

--------------------------------

### Example output of listClients

Source: https://mosquitto.org/documentation/dynamic-security

Shows the output format of the listClients command, which is a list of client usernames.

```text
client1
client2

```

--------------------------------

### Example configuration file with single listener

Source: https://mosquitto.org/documentation/migrating-to-2-0

A basic configuration file snippet defining a listener on port 1883.

```text
listener 1883
# ...
```

--------------------------------

### Example: Using plugin_load and plugin_use for per-listener plugins

Source: https://mosquitto.org/documentation/listeners/per-listener-settings

Shows how to load a plugin globally with plugin_load and apply it to specific listeners with plugin_use. The listener on port 1884 does not use the plugin and allows anonymous connections, which is insecure.

```mosquitto
plugin_load dynsec /usr/lib/mosquitto_dynamic_security.so
plugin_opt_config_file /mosquitto/data/dynamic-security.json

listener 1883
plugin_use dynsec

listener 1884
listener_allow_anonymous true

listener 1885
plugin_use dynsec

```

--------------------------------

### Get client information

Source: https://mosquitto.org/documentation/dynamic-security

Retrieves information about a specific client.

```bash
mosquitto_ctrl <options> dynsec getClient <username>

```

--------------------------------

### Windows configuration for mosquitto_persist_sqlite.dll

Source: https://mosquitto.org/documentation/persistence/sqlite

Example configuration for Windows systems. Sets the persistence location, loads the plugin DLL, and specifies an ACL file. The plugin_opt_acl_file option is required.

```plaintext
persistence_location <path to save mosquitto.sqlite3>
global_plugin C:\Program Files\Mosquitto\mosquitto_persist_sqlite.dll
plugin_opt_acl_file <my acl file path>

```

--------------------------------

### Example: Add an ACL to a role with publishClientSend

Source: https://mosquitto.org/documentation/dynamic-security

Example of adding an ACL with acltype publishClientSend, topic filter client/topic, allow, and priority 5.

```bash
mosquitto_ctrl <options> dynsec addRoleACL <rolename> publishClientSend client/topic allow 5

```

--------------------------------

### Manage Mosquitto service with systemd

Source: https://mosquitto.org/documentation/using-the-snap

Commands to start or stop the Mosquitto broker service using systemd.

```bash
systemctl start snap.mosquitto.mosquitto
systemctl stop snap.mosquitto.mosquitto
```

--------------------------------

### Other platform configuration for mosquitto_persist_sqlite.so

Source: https://mosquitto.org/documentation/persistence/sqlite

Example configuration for non-Windows systems. Sets the persistence location, loads the plugin shared object, and specifies an ACL file. The plugin_opt_acl_file option is required.

```plaintext
persistence_location <path to save mosquitto.sqlite3>
global_plugin /path/to/mosquitto_persist_sqlite.so
plugin_opt_acl_file <my acl file path>

```

--------------------------------

### Pattern example for sensor data

Source: https://mosquitto.org/documentation/plugins/acl-file

Example pattern ACL granting write access to sensor data topics per user.

```text
pattern write sensor/%u/data

```

--------------------------------

### Manage Mosquitto service with snap

Source: https://mosquitto.org/documentation/using-the-snap

Commands to start or stop the Mosquitto broker service using the snap command.

```bash
snap start mosquitto
snap stop mosquitto
```

--------------------------------

### Mosquitto Unencrypted Listener Configuration

Source: https://mosquitto.org/documentation/listeners/haproxy

Example of a Mosquitto broker listener configuration for unencrypted connections.

```text
listener 1884
# Further listener settings
```

--------------------------------

### Mosquitto Encrypted Listener Configuration

Source: https://mosquitto.org/documentation/listeners/haproxy

Example of a Mosquitto broker listener configuration for encrypted connections using certificate and key files.

```text
listener 1884
certfile <path/to/server.crt>
keyfile <path/to/server.key>
# Further listener settings
```

--------------------------------

### HAProxy Frontend and Backend for Direct Pass-through

Source: https://mosquitto.org/documentation/listeners/haproxy

Configuration for a basic HAProxy setup that passes connections directly to the Mosquitto broker without modification.

```haproxy
frontend mqtt_frontend
         bind *:1883
         default_backend mqtt_backend

backend mqtt_backend
        server server1 127.0.0.1:1884 check on-marked-down shutdown-sessions
```

--------------------------------

### Get default ACL access with mosquitto_ctrl dynsec getDefaultACLAccess

Source: https://mosquitto.org/documentation/dynamic-security

Examines the current default access for a given ACL type. The example queries the 'unsubscribe' default.

```bash
mosquitto_ctrl <options> dynsec getDefaultACLAccess unsubscribe

```

--------------------------------

### Example: Remove an ACL from a role with publishClientSend

Source: https://mosquitto.org/documentation/dynamic-security

Example of removing an ACL with acltype publishClientSend and topic filter client/topic.

```bash
mosquitto_ctrl <options> dynsec removeRoleACL <rolename> publishClientSend client/topic

```

--------------------------------

### mosquitto_ctrl dynsec getRole

Source: https://mosquitto.org/documentation/dynamic-security

Gets information on a role.

```APIDOC
## mosquitto_ctrl dynsec getRole

### Description
Gets information on a role.

### Command
mosquitto_ctrl <options> dynsec getRole <rolename>

### Parameters
- **rolename** (string) - Required - The name of the role to get information about.

### Example
```
mosquitto_ctrl <options> dynsec getRole myrole
```
```

--------------------------------

### mosquitto_ctrl dynsec getGroup

Source: https://mosquitto.org/documentation/dynamic-security

Gets information on a group.

```APIDOC
## mosquitto_ctrl dynsec getGroup

### Description
Gets information on a group.

### Command
mosquitto_ctrl <options> dynsec getGroup <groupname>

### Parameters
- **groupname** (string) - Required - The name of the group to get information about.

### Example
```
mosquitto_ctrl <options> dynsec getGroup mygroup
```
```

--------------------------------

### Get information on a role with mosquitto_ctrl dynsec getRole

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to retrieve information about a specific role.

```bash
mosquitto_ctrl <options> dynsec getRole <rolename>

```

--------------------------------

### Get information on a group with mosquitto_ctrl dynsec getGroup

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to retrieve information about a specific group.

```bash
mosquitto_ctrl <options> dynsec getGroup <groupname>

```

--------------------------------

### Set default ACL access with mosquitto_ctrl dynsec setDefaultACLAccess

Source: https://mosquitto.org/documentation/dynamic-security

Commands to change the default ACL type behaviours for publishClientSend, publishClientReceive, subscribe, and unsubscribe. The example sets all to deny. Use the same command with 'allow' to permit.

```bash
mosquitto_ctrl <options> dynsec setDefaultACLAccess publishClientSend deny
mosquitto_ctrl <options> dynsec setDefaultACLAccess publishClientReceive deny
mosquitto_ctrl <options> dynsec setDefaultACLAccess subscribe deny
mosquitto_ctrl <options> dynsec setDefaultACLAccess unsubscribe deny

```

--------------------------------

### User ACL line format

Source: https://mosquitto.org/documentation/plugins/acl-file

Starts a user-specific ACL section. The username matches the CONNECT packet username, not the client ID.

```text
user <username>

```

--------------------------------

### Subscribe to MQTT topics with mosquitto_sub

Source: https://mosquitto.org/documentation/using-the-snap

Use this command to subscribe to the 'snap/example' topic on the local broker.

```bash
mosquitto_sub -h localhost -t 'snap/example' -v
```

--------------------------------

### Publish MQTT messages with mosquitto_pub

Source: https://mosquitto.org/documentation/using-the-snap

Use this command to publish a message to the 'snap/example' topic.

```bash
mosquitto_pub -h localhost -t 'snap/example' -m 'Hello from mosquitto_pub'
```

--------------------------------

### Initialize dynamic security config with mosquitto_ctrl

Source: https://mosquitto.org/documentation/dynamic-security

Generate an initial configuration file using the mosquitto_ctrl utility. Replace 'admin-user' with your chosen username; you will be prompted for a password. The created user is assigned the 'admin' role with specific access controls.

```bash
mosquitto_ctrl dynsec init path/to/dynamic-security.json admin-user

```

--------------------------------

### Create a client with a client id

Source: https://mosquitto.org/documentation/dynamic-security

Creates a new client with the given username and associates a client id with it.

```bash
mosquitto_ctrl <options> dynsec createClient <username> -i <client id>

```

--------------------------------

### mosquitto_ctrl dynsec getAnonymousGroup

Source: https://mosquitto.org/documentation/dynamic-security

Gets the group that anonymous devices are assigned to.

```APIDOC
## mosquitto_ctrl dynsec getAnonymousGroup

### Description
Gets the group that anonymous devices are assigned to.

### Command
mosquitto_ctrl <options> dynsec getAnonymousGroup

### Example
```
mosquitto_ctrl <options> dynsec getAnonymousGroup
```
```

--------------------------------

### List all clients

Source: https://mosquitto.org/documentation/dynamic-security

Lists all client usernames. The output is a list of client usernames, one per line.

```bash
mosquitto_ctrl <options> dynsec listClients

```

--------------------------------

### List all roles with mosquitto_ctrl dynsec listRoles

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to list all roles in the Dynamic Security plugin.

```bash
mosquitto_ctrl <options> dynsec listRoles

```

--------------------------------

### Enable a client

Source: https://mosquitto.org/documentation/dynamic-security

Enables the specified client, allowing clients to use these credentials to log in again.

```bash
mosquitto_ctrl <options> dynsec enableClient <username>

```

--------------------------------

### Configuration file with multiple listeners

Source: https://mosquitto.org/documentation/migrating-to-2-0

Updated configuration file format to include multiple listeners, replacing the deprecated command-line port override behavior.

```text
listener 1883
# ...
listener 1884
# ...
```

--------------------------------

### Set plugin_opt_password_init_file to trigger init file usage

Source: https://mosquitto.org/documentation/dynamic-security

Configure the plugin to use an initialization file containing the admin password. The file should contain a single line used as the password for the 'admin' user. After the initial broker run, the init file can be deleted.

```plaintext
plugin_opt_password_init_file path/to/init-file

```

--------------------------------

### List all groups with mosquitto_ctrl dynsec listGroups

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to list all groups in the Dynamic Security plugin.

```bash
mosquitto_ctrl <options> dynsec listGroups

```

--------------------------------

### Set or get the anonymous group with mosquitto_ctrl dynsec setAnonymousGroup and getAnonymousGroup

Source: https://mosquitto.org/documentation/dynamic-security

These commands set or retrieve the group that anonymous devices are assigned to.

```bash
mosquitto_ctrl <options> dynsec setAnonymousGroup <groupname>
mosquitto_ctrl <options> dynsec getAnonymousGroup

```

--------------------------------

### Create a client without a client id

Source: https://mosquitto.org/documentation/dynamic-security

Creates a new client with the given username. You will be prompted for the new client's password and then the admin user password.

```bash
mosquitto_ctrl <options> dynsec createClient <username>

```

--------------------------------

### Set a client password

Source: https://mosquitto.org/documentation/dynamic-security

Sets the password for a client. Two forms are shown: one prompts for the password, the other provides it directly.

```bash
mosquitto_ctrl <options> dynsec setClientPassword <username>
mosquitto_ctrl <options> dynsec setClientPassword <username> <password>

```

--------------------------------

### Create a new role with mosquitto_ctrl dynsec createRole

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to create a new role in the Dynamic Security plugin.

```bash
mosquitto_ctrl <options> dynsec createRole <rolename>

```

--------------------------------

### mosquitto_ctrl general options

Source: https://mosquitto.org/documentation/dynamic-security

General command-line options for mosquitto_ctrl to configure connection settings such as proxy, TLS-PSK, QoS, TLS version, authentication, Unix socket, and MQTT protocol version.

```APIDOC
## mosquitto_ctrl general options

### Description
These options configure the connection between mosquitto_ctrl and the MQTT broker.

### Options
- `--proxy proxy-url` : Specify a SOCKS5 proxy to connect through. "None" and "username" authentication types are supported. The socks-url must be of the form `socks5h://[username[:password]@]host[:port]`. The protocol prefix socks5h means that hostnames are resolved by the proxy. The symbols %25, %3A and %40 are URL decoded into %, : and @ respectively, if present in the username or password. If username is not given, then no authentication is attempted. If the port is not given, then the default of 1080 is used.
- `--psk key` : Provide the hexadecimal (no leading 0x) pre-shared-key matching the one used on the broker to use TLS-PSK encryption support. `--psk-identity` must also be provided to enable TLS-PSK.
- `--psk-identity identify` : The client identity to use with TLS-PSK support. This may be used instead of a username if the broker is configured to do so.
- `-q qos` : Specify the quality of service to use for messages, from 0, 1 and 2. Defaults to 1.
- `--quiet` : If this argument is given, no runtime errors will be printed. This excludes any error messages given in case of invalid user input (e.g. using `-p` without a port).
- `--tls-version version` : Choose which TLS protocol version to use when communicating with the broker. Valid options are tlsv1.3 and tlsv1.2. The default value is tlsv1.2. Must match the protocol version used by the broker.
- `-u username` : Provide a username to be used for authenticating with the broker. See also the `-P` argument.
- `--unix path` : Connect to a broker through a local unix domain socket instead of a TCP socket. This is a replacement for `-h` and `-L`. For example: `mosquitto_ctrl --unix /tmp/mosquitto.sock ...`.
- `-V protocol-version` : Specify which version of the MQTT protocol should be used when connecting to the remote broker. Can be `5`, `311`, `31`, or the more verbose `mqttv5`, `mqttv311`, or `mqttv31`. Defaults to `311`.

### Usage
`mosquitto_ctrl [options] <command> [args]`
```

--------------------------------

### Windows configuration for mosquitto_password_file.dll

Source: https://mosquitto.org/documentation/plugins/password-file

Use this configuration on Windows to load the password file plugin. The plugin path is 'C:\Program Files\Mosquitto\mosquitto_password_file.dll' and the password file path is specified with 'plugin_opt_password_file'.

```text
global_plugin C:\Program Files\Mosquitto\mosquitto_password_file.dll
plugin_opt_password_file <my password file path>

```

--------------------------------

### Configure password_file per listener

Source: https://mosquitto.org/documentation/authentication-methods

When using per_listener_settings true, place the password_file option after the listener it applies to.

```text
listener 1883
password_file /etc/mosquitto/password_file
```

--------------------------------

### Other platforms configuration for mosquitto_password_file.so

Source: https://mosquitto.org/documentation/plugins/password-file

Use this configuration on non-Windows platforms to load the password file plugin. The plugin path is '/path/to/mosquitto_password_file.so' and the password file path is specified with 'plugin_opt_password_file'.

```text
global_plugin /path/to/mosquitto_password_file.so
plugin_opt_password_file <my password file path>

```

--------------------------------

### Configure Sparkplug Aware plugin on Windows

Source: https://mosquitto.org/documentation/plugins/sparkplug-aware

Use the global_plugin directive to load the Sparkplug Aware DLL on Windows systems.

```text
global_plugin C:\Program Files\Mosquitto\mosquitto_sparkplug_aware.dll
```

--------------------------------

### Create a new group with mosquitto_ctrl dynsec createGroup

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to create a new group in the Dynamic Security plugin. Replace <options> with mosquitto_ctrl options and <groupname> with the desired group name.

```bash
mosquitto_ctrl <options> dynsec createGroup <groupname>

```

--------------------------------

### Linux/BSD broker configuration for Dynamic Security plugin

Source: https://mosquitto.org/documentation/dynamic-security

Add these lines to the Mosquitto configuration file to load the Dynamic Security plugin and specify its configuration file. The plugin library path varies by distribution and hardware.

```plaintext
plugin path/to/mosquitto_dynamic_security.so
plugin_opt_config_file path/to/dynamic-security.json

```

--------------------------------

### Windows plugin configuration

Source: https://mosquitto.org/documentation/plugins/acl-file

Loads the ACL file plugin on Windows and specifies the ACL file path.

```text
global_plugin C:\Program Files\Mosquitto\mosquitto_acl_file.dll
plugin_opt_acl_file <my acl file path>

```

--------------------------------

### mosquitto_ctrl dynsec listRoles

Source: https://mosquitto.org/documentation/dynamic-security

Lists all roles.

```APIDOC
## mosquitto_ctrl dynsec listRoles

### Description
Lists all roles.

### Command
mosquitto_ctrl <options> dynsec listRoles

### Example
```
mosquitto_ctrl <options> dynsec listRoles
```
```

--------------------------------

### Add or remove a client from a group with mosquitto_ctrl dynsec addGroupClient and removeGroupClient

Source: https://mosquitto.org/documentation/dynamic-security

These commands add or remove a client from a group. The priority parameter sets the group's priority within the client's list of groups.

```bash
mosquitto_ctrl <options> dynsec addGroupClient <groupname> <username> <priority>
mosquitto_ctrl <options> dynsec removeGroupClient <groupname> <username>

```

--------------------------------

### mosquitto_ctrl dynsec createRole

Source: https://mosquitto.org/documentation/dynamic-security

Creates a new role.

```APIDOC
## mosquitto_ctrl dynsec createRole

### Description
Creates a new role.

### Command
mosquitto_ctrl <options> dynsec createRole <rolename>

### Parameters
- **rolename** (string) - Required - The name of the role to create.

### Example
```
mosquitto_ctrl <options> dynsec createRole myrole
```
```

--------------------------------

### Create a password file with mosquitto_passwd

Source: https://mosquitto.org/documentation/authentication-methods

Use the -c flag to create a new password file. You will be prompted for the password. The -c flag overwrites an existing file.

```bash
mosquitto_passwd -c <password file> <username>
```

--------------------------------

### dynsec enableClient

Source: https://mosquitto.org/documentation/dynamic-security

Enables a client. Clients will be able to use these credentials to log in again.

```APIDOC
## dynsec enableClient

### Description
Enables a previously disabled client. Clients will be able to use these credentials to log in again.

### Command
`mosquitto_ctrl <options> dynsec enableClient <username>`

### Parameters
- `username` (string) - Required - The username of the client to enable.

### Example
```
mosquitto_ctrl <options> dynsec enableClient <username>
```
```

--------------------------------

### Configure Sparkplug Aware plugin on non-Windows systems

Source: https://mosquitto.org/documentation/plugins/sparkplug-aware

Use the global_plugin directive to load the Sparkplug Aware shared object file on Linux or other Unix-like systems.

```text
global_plugin /path/to/mosquitto_sparkplug_aware.so
```

--------------------------------

### Configure plugin for Mosquitto 2.0 and up

Source: https://mosquitto.org/documentation/authentication-methods

Use the plugin option for plugins written for Mosquitto 2.0 and later.

```text
listener 1883
plugin <path to plugin>
```

--------------------------------

### Configure listener for remote access

Source: https://mosquitto.org/documentation/migrating-to-2-0

Use this configuration to allow connections from remote machines when a configuration file is required.

```text
listener 1883
# Note that this will not allow anonymous access by default.
```

--------------------------------

### dynsec listClients

Source: https://mosquitto.org/documentation/dynamic-security

Lists all clients. The output is a list of client usernames.

```APIDOC
## dynsec listClients

### Description
Lists all clients. The output is a list of client usernames.

### Command
`mosquitto_ctrl <options> dynsec listClients`

### Example
```
mosquitto_ctrl <options> dynsec listClients
```

### Response Example
```
client1
client2
```
```

--------------------------------

### Configure password_file option

Source: https://mosquitto.org/documentation/authentication-methods

Add the password_file option to the Mosquitto configuration file to enable password authentication.

```text
password_file <path to the configuration file>
```

--------------------------------

### mosquitto_ctrl dynsec listGroups

Source: https://mosquitto.org/documentation/dynamic-security

Lists all groups.

```APIDOC
## mosquitto_ctrl dynsec listGroups

### Description
Lists all groups.

### Command
mosquitto_ctrl <options> dynsec listGroups

### Example
```
mosquitto_ctrl <options> dynsec listGroups
```
```

--------------------------------

### Windows broker configuration for Dynamic Security plugin

Source: https://mosquitto.org/documentation/dynamic-security

Windows equivalent of the broker configuration, using the .dll plugin library and backslashes in paths.

```plaintext
plugin path\to\mosquitto_dynamic_security.dll
plugin_opt_config_file path\to\dynamic-security.json

```

--------------------------------

### General mosquitto_ctrl command structure

Source: https://mosquitto.org/documentation/dynamic-security

The basic syntax for executing dynamic security commands, requiring connection options before the dynsec keyword.

```bash
mosquitto_ctrl <connection options> dynsec <command> ...
```

--------------------------------

### mosquitto_ctrl dynsec addGroupClient

Source: https://mosquitto.org/documentation/dynamic-security

Adds a client to a group with a specified priority.

```APIDOC
## mosquitto_ctrl dynsec addGroupClient

### Description
Adds a client to a group with a specified priority. The priority determines the group's precedence within the client's list of groups.

### Command
mosquitto_ctrl <options> dynsec addGroupClient <groupname> <username> <priority>

### Parameters
- **groupname** (string) - Required - The name of the group to add the client to.
- **username** (string) - Required - The username of the client to add.
- **priority** (integer) - Required - The priority of the group within the client's list of groups.

### Example
```
mosquitto_ctrl <options> dynsec addGroupClient mygroup alice 10
```
```

--------------------------------

### dynsec createClient

Source: https://mosquitto.org/documentation/dynamic-security

Creates a new client in the Dynamic Security plugin. Optionally associates a client ID with the client.

```APIDOC
## dynsec createClient

### Description
Creates a new client. If no client ID is provided, the client is created without one. The user will be prompted for the new client's password and then for the admin user password.

### Command
`mosquitto_ctrl <options> dynsec createClient <username> [-i <client id>]`

### Parameters
- `username` (string) - Required - The username for the new client.
- `-i <client id>` (string) - Optional - The client ID to associate with the client.

### Examples
```
mosquitto_ctrl <options> dynsec createClient <username>
mosquitto_ctrl <options> dynsec createClient <username> -i <client id>
```
```

--------------------------------

### Other platforms plugin configuration

Source: https://mosquitto.org/documentation/plugins/acl-file

Loads the ACL file plugin on non-Windows systems and specifies the ACL file path.

```text
global_plugin /path/to/mosquitto_acl_file.so
plugin_opt_acl_file <my acl file path>

```

--------------------------------

### Add or remove a client role

Source: https://mosquitto.org/documentation/dynamic-security

Adds a role to a client with a priority, or removes a role from a client.

```bash
mosquitto_ctrl <options> dynsec addClientRole <username> <rolename> <priority>
mosquitto_ctrl <options> dynsec removeClientRole <username> <rolename>

```

--------------------------------

### mosquitto_ctrl dynsec addRoleACL

Source: https://mosquitto.org/documentation/dynamic-security

Adds an ACL to a role.

```APIDOC
## mosquitto_ctrl dynsec addRoleACL

### Description
Adds an ACL to a role. The ACL type can be one of publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, and unsubscribePattern.

### Command
mosquitto_ctrl <options> dynsec addRoleACL <rolename> <acltype> <topic filter> allow|deny <priority>

### Parameters
- **rolename** (string) - Required - The name of the role to add the ACL to.
- **acltype** (string) - Required - The type of ACL. Valid values: publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, unsubscribePattern.
- **topic filter** (string) - Required - The topic filter for the ACL.
- **allow|deny** (string) - Required - Whether to allow or deny access.
- **priority** (integer) - Required - The priority of the ACL.

### Example
```
mosquitto_ctrl <options> dynsec addRoleACL myrole publishClientSend client/topic allow 5
```
```

--------------------------------

### Add or update a user with password on command line

Source: https://mosquitto.org/documentation/authentication-methods

This one-liner adds or updates a user with the password provided directly. Warning: the password is visible on the command line and in command history.

```bash
mosquitto_passwd <password file> <username> <password>
```

--------------------------------

### Delete a group with mosquitto_ctrl dynsec deleteGroup

Source: https://mosquitto.org/documentation/dynamic-security

Use this command to delete an existing group. Replace <options> and <groupname> accordingly.

```bash
mosquitto_ctrl <options> dynsec deleteGroup <groupname>

```

--------------------------------

### Configure allow_anonymous for unauthenticated access

Source: https://mosquitto.org/documentation/authentication-methods

Set allow_anonymous true to permit clients to connect without authentication.

```text
listener 1883
allow_anonymous true
```

--------------------------------

### Add an ACL to a role with mosquitto_ctrl dynsec addRoleACL

Source: https://mosquitto.org/documentation/dynamic-security

Adds an ACL to a role. The acltype must be one of publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, or unsubscribePattern. The priority parameter sets the ACL priority.

```bash
mosquitto_ctrl <options> dynsec addRoleACL <rolename> <acltype> <topic filter> allow|deny <priority>

```

--------------------------------

### dynsec getClient

Source: https://mosquitto.org/documentation/dynamic-security

Retrieves information about a client.

```APIDOC
## dynsec getClient

### Description
Retrieves information about a client.

### Command
`mosquitto_ctrl <options> dynsec getClient <username>`

### Parameters
- `username` (string) - Required - The username of the client.

### Example
```
mosquitto_ctrl <options> dynsec getClient <username>
```
```

--------------------------------

### Pattern for bridge connection messages

Source: https://mosquitto.org/documentation/plugins/acl-file

Allows connection messages for bridges using pattern write with %c substitution.

```text
pattern write $SYS/broker/connection/%c/state

```

--------------------------------

### mosquitto_ctrl dynsec createGroup

Source: https://mosquitto.org/documentation/dynamic-security

Creates a new dynamic security group with the specified group name.

```APIDOC
## mosquitto_ctrl dynsec createGroup

### Description
Creates a new dynamic security group with the specified group name.

### Command
mosquitto_ctrl <options> dynsec createGroup <groupname>

### Parameters
- **groupname** (string) - Required - The name of the group to create.

### Example
```
mosquitto_ctrl <options> dynsec createGroup mygroup
```
```
Tokens:
Raw