### Example mosquitto_ctrl options file Source: https://mosquitto.org/documentation/dynamic-security An example of an options file content, where each line corresponds to a command-line argument. ```text --cafile /path/to/my/CA.crt --cert /path/to/my/client.crt --key /path/to/my/client.key -u admin -h mosquitto.example.com ``` -------------------------------- ### Example mosquitto_ctrl connection command Source: https://mosquitto.org/documentation/dynamic-security A practical example of connecting to a local broker as an admin user. ```bash mosquitto_ctrl -u admin -h localhost dynsec ... ``` -------------------------------- ### Example output of listClients Source: https://mosquitto.org/documentation/dynamic-security Shows the output format of the listClients command, which is a list of client usernames. ```text client1 client2 ``` -------------------------------- ### Example configuration file with single listener Source: https://mosquitto.org/documentation/migrating-to-2-0 A basic configuration file snippet defining a listener on port 1883. ```text listener 1883 # ... ``` -------------------------------- ### Example: Using plugin_load and plugin_use for per-listener plugins Source: https://mosquitto.org/documentation/listeners/per-listener-settings Shows how to load a plugin globally with plugin_load and apply it to specific listeners with plugin_use. The listener on port 1884 does not use the plugin and allows anonymous connections, which is insecure. ```mosquitto plugin_load dynsec /usr/lib/mosquitto_dynamic_security.so plugin_opt_config_file /mosquitto/data/dynamic-security.json listener 1883 plugin_use dynsec listener 1884 listener_allow_anonymous true listener 1885 plugin_use dynsec ``` -------------------------------- ### Get client information Source: https://mosquitto.org/documentation/dynamic-security Retrieves information about a specific client. ```bash mosquitto_ctrl dynsec getClient ``` -------------------------------- ### Windows configuration for mosquitto_persist_sqlite.dll Source: https://mosquitto.org/documentation/persistence/sqlite Example configuration for Windows systems. Sets the persistence location, loads the plugin DLL, and specifies an ACL file. The plugin_opt_acl_file option is required. ```plaintext persistence_location global_plugin C:\Program Files\Mosquitto\mosquitto_persist_sqlite.dll plugin_opt_acl_file ``` -------------------------------- ### Example: Add an ACL to a role with publishClientSend Source: https://mosquitto.org/documentation/dynamic-security Example of adding an ACL with acltype publishClientSend, topic filter client/topic, allow, and priority 5. ```bash mosquitto_ctrl dynsec addRoleACL publishClientSend client/topic allow 5 ``` -------------------------------- ### Manage Mosquitto service with systemd Source: https://mosquitto.org/documentation/using-the-snap Commands to start or stop the Mosquitto broker service using systemd. ```bash systemctl start snap.mosquitto.mosquitto systemctl stop snap.mosquitto.mosquitto ``` -------------------------------- ### Other platform configuration for mosquitto_persist_sqlite.so Source: https://mosquitto.org/documentation/persistence/sqlite Example configuration for non-Windows systems. Sets the persistence location, loads the plugin shared object, and specifies an ACL file. The plugin_opt_acl_file option is required. ```plaintext persistence_location global_plugin /path/to/mosquitto_persist_sqlite.so plugin_opt_acl_file ``` -------------------------------- ### Pattern example for sensor data Source: https://mosquitto.org/documentation/plugins/acl-file Example pattern ACL granting write access to sensor data topics per user. ```text pattern write sensor/%u/data ``` -------------------------------- ### Manage Mosquitto service with snap Source: https://mosquitto.org/documentation/using-the-snap Commands to start or stop the Mosquitto broker service using the snap command. ```bash snap start mosquitto snap stop mosquitto ``` -------------------------------- ### Mosquitto Unencrypted Listener Configuration Source: https://mosquitto.org/documentation/listeners/haproxy Example of a Mosquitto broker listener configuration for unencrypted connections. ```text listener 1884 # Further listener settings ``` -------------------------------- ### Mosquitto Encrypted Listener Configuration Source: https://mosquitto.org/documentation/listeners/haproxy Example of a Mosquitto broker listener configuration for encrypted connections using certificate and key files. ```text listener 1884 certfile keyfile # Further listener settings ``` -------------------------------- ### HAProxy Frontend and Backend for Direct Pass-through Source: https://mosquitto.org/documentation/listeners/haproxy Configuration for a basic HAProxy setup that passes connections directly to the Mosquitto broker without modification. ```haproxy frontend mqtt_frontend bind *:1883 default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1884 check on-marked-down shutdown-sessions ``` -------------------------------- ### Get default ACL access with mosquitto_ctrl dynsec getDefaultACLAccess Source: https://mosquitto.org/documentation/dynamic-security Examines the current default access for a given ACL type. The example queries the 'unsubscribe' default. ```bash mosquitto_ctrl dynsec getDefaultACLAccess unsubscribe ``` -------------------------------- ### Example: Remove an ACL from a role with publishClientSend Source: https://mosquitto.org/documentation/dynamic-security Example of removing an ACL with acltype publishClientSend and topic filter client/topic. ```bash mosquitto_ctrl dynsec removeRoleACL publishClientSend client/topic ``` -------------------------------- ### mosquitto_ctrl dynsec getRole Source: https://mosquitto.org/documentation/dynamic-security Gets information on a role. ```APIDOC ## mosquitto_ctrl dynsec getRole ### Description Gets information on a role. ### Command mosquitto_ctrl dynsec getRole ### Parameters - **rolename** (string) - Required - The name of the role to get information about. ### Example ``` mosquitto_ctrl dynsec getRole myrole ``` ``` -------------------------------- ### mosquitto_ctrl dynsec getGroup Source: https://mosquitto.org/documentation/dynamic-security Gets information on a group. ```APIDOC ## mosquitto_ctrl dynsec getGroup ### Description Gets information on a group. ### Command mosquitto_ctrl dynsec getGroup ### Parameters - **groupname** (string) - Required - The name of the group to get information about. ### Example ``` mosquitto_ctrl dynsec getGroup mygroup ``` ``` -------------------------------- ### Get information on a role with mosquitto_ctrl dynsec getRole Source: https://mosquitto.org/documentation/dynamic-security Use this command to retrieve information about a specific role. ```bash mosquitto_ctrl dynsec getRole ``` -------------------------------- ### Get information on a group with mosquitto_ctrl dynsec getGroup Source: https://mosquitto.org/documentation/dynamic-security Use this command to retrieve information about a specific group. ```bash mosquitto_ctrl dynsec getGroup ``` -------------------------------- ### mosquitto_ctrl dynsec getAnonymousGroup Source: https://mosquitto.org/documentation/dynamic-security Gets the group that anonymous devices are assigned to. ```APIDOC ## mosquitto_ctrl dynsec getAnonymousGroup ### Description Gets the group that anonymous devices are assigned to. ### Command mosquitto_ctrl dynsec getAnonymousGroup ### Example ``` mosquitto_ctrl dynsec getAnonymousGroup ``` ``` -------------------------------- ### Set default ACL access with mosquitto_ctrl dynsec setDefaultACLAccess Source: https://mosquitto.org/documentation/dynamic-security Commands to change the default ACL type behaviours for publishClientSend, publishClientReceive, subscribe, and unsubscribe. The example sets all to deny. Use the same command with 'allow' to permit. ```bash mosquitto_ctrl dynsec setDefaultACLAccess publishClientSend deny mosquitto_ctrl dynsec setDefaultACLAccess publishClientReceive deny mosquitto_ctrl dynsec setDefaultACLAccess subscribe deny mosquitto_ctrl dynsec setDefaultACLAccess unsubscribe deny ``` -------------------------------- ### User ACL line format Source: https://mosquitto.org/documentation/plugins/acl-file Starts a user-specific ACL section. The username matches the CONNECT packet username, not the client ID. ```text user ``` -------------------------------- ### Set or get the anonymous group with mosquitto_ctrl dynsec setAnonymousGroup and getAnonymousGroup Source: https://mosquitto.org/documentation/dynamic-security These commands set or retrieve the group that anonymous devices are assigned to. ```bash mosquitto_ctrl dynsec setAnonymousGroup mosquitto_ctrl dynsec getAnonymousGroup ``` -------------------------------- ### Subscribe to MQTT topics with mosquitto_sub Source: https://mosquitto.org/documentation/using-the-snap Use this command to subscribe to the 'snap/example' topic on the local broker. ```bash mosquitto_sub -h localhost -t 'snap/example' -v ``` -------------------------------- ### Publish MQTT messages with mosquitto_pub Source: https://mosquitto.org/documentation/using-the-snap Use this command to publish a message to the 'snap/example' topic. ```bash mosquitto_pub -h localhost -t 'snap/example' -m 'Hello from mosquitto_pub' ``` -------------------------------- ### Initialize dynamic security config with mosquitto_ctrl Source: https://mosquitto.org/documentation/dynamic-security Generate an initial configuration file using the mosquitto_ctrl utility. Replace 'admin-user' with your chosen username; you will be prompted for a password. The created user is assigned the 'admin' role with specific access controls. ```bash mosquitto_ctrl dynsec init path/to/dynamic-security.json admin-user ``` -------------------------------- ### Create a client with a client id Source: https://mosquitto.org/documentation/dynamic-security Creates a new client with the given username and associates a client id with it. ```bash mosquitto_ctrl dynsec createClient -i ``` -------------------------------- ### List all clients Source: https://mosquitto.org/documentation/dynamic-security Lists all client usernames. The output is a list of client usernames, one per line. ```bash mosquitto_ctrl dynsec listClients ``` -------------------------------- ### List all roles with mosquitto_ctrl dynsec listRoles Source: https://mosquitto.org/documentation/dynamic-security Use this command to list all roles in the Dynamic Security plugin. ```bash mosquitto_ctrl dynsec listRoles ``` -------------------------------- ### Enable a client Source: https://mosquitto.org/documentation/dynamic-security Enables the specified client, allowing clients to use these credentials to log in again. ```bash mosquitto_ctrl dynsec enableClient ``` -------------------------------- ### Configuration file with multiple listeners Source: https://mosquitto.org/documentation/migrating-to-2-0 Updated configuration file format to include multiple listeners, replacing the deprecated command-line port override behavior. ```text listener 1883 # ... listener 1884 # ... ``` -------------------------------- ### Set plugin_opt_password_init_file to trigger init file usage Source: https://mosquitto.org/documentation/dynamic-security Configure the plugin to use an initialization file containing the admin password. The file should contain a single line used as the password for the 'admin' user. After the initial broker run, the init file can be deleted. ```plaintext plugin_opt_password_init_file path/to/init-file ``` -------------------------------- ### List all groups with mosquitto_ctrl dynsec listGroups Source: https://mosquitto.org/documentation/dynamic-security Use this command to list all groups in the Dynamic Security plugin. ```bash mosquitto_ctrl dynsec listGroups ``` -------------------------------- ### Create a client without a client id Source: https://mosquitto.org/documentation/dynamic-security Creates a new client with the given username. You will be prompted for the new client's password and then the admin user password. ```bash mosquitto_ctrl dynsec createClient ``` -------------------------------- ### Set a client password Source: https://mosquitto.org/documentation/dynamic-security Sets the password for a client. Two forms are shown: one prompts for the password, the other provides it directly. ```bash mosquitto_ctrl dynsec setClientPassword mosquitto_ctrl dynsec setClientPassword ``` -------------------------------- ### Create a new role with mosquitto_ctrl dynsec createRole Source: https://mosquitto.org/documentation/dynamic-security Use this command to create a new role in the Dynamic Security plugin. ```bash mosquitto_ctrl dynsec createRole ``` -------------------------------- ### mosquitto_ctrl general options Source: https://mosquitto.org/documentation/dynamic-security General command-line options for mosquitto_ctrl to configure connection settings such as proxy, TLS-PSK, QoS, TLS version, authentication, Unix socket, and MQTT protocol version. ```APIDOC ## mosquitto_ctrl general options ### Description These options configure the connection between mosquitto_ctrl and the MQTT broker. ### Options - `--proxy proxy-url` : Specify a SOCKS5 proxy to connect through. "None" and "username" authentication types are supported. The socks-url must be of the form `socks5h://[username[:password]@]host[:port]`. The protocol prefix socks5h means that hostnames are resolved by the proxy. The symbols %25, %3A and %40 are URL decoded into %, : and @ respectively, if present in the username or password. If username is not given, then no authentication is attempted. If the port is not given, then the default of 1080 is used. - `--psk key` : Provide the hexadecimal (no leading 0x) pre-shared-key matching the one used on the broker to use TLS-PSK encryption support. `--psk-identity` must also be provided to enable TLS-PSK. - `--psk-identity identify` : The client identity to use with TLS-PSK support. This may be used instead of a username if the broker is configured to do so. - `-q qos` : Specify the quality of service to use for messages, from 0, 1 and 2. Defaults to 1. - `--quiet` : If this argument is given, no runtime errors will be printed. This excludes any error messages given in case of invalid user input (e.g. using `-p` without a port). - `--tls-version version` : Choose which TLS protocol version to use when communicating with the broker. Valid options are tlsv1.3 and tlsv1.2. The default value is tlsv1.2. Must match the protocol version used by the broker. - `-u username` : Provide a username to be used for authenticating with the broker. See also the `-P` argument. - `--unix path` : Connect to a broker through a local unix domain socket instead of a TCP socket. This is a replacement for `-h` and `-L`. For example: `mosquitto_ctrl --unix /tmp/mosquitto.sock ...`. - `-V protocol-version` : Specify which version of the MQTT protocol should be used when connecting to the remote broker. Can be `5`, `311`, `31`, or the more verbose `mqttv5`, `mqttv311`, or `mqttv31`. Defaults to `311`. ### Usage `mosquitto_ctrl [options] [args]` ``` -------------------------------- ### Windows configuration for mosquitto_password_file.dll Source: https://mosquitto.org/documentation/plugins/password-file Use this configuration on Windows to load the password file plugin. The plugin path is 'C:\Program Files\Mosquitto\mosquitto_password_file.dll' and the password file path is specified with 'plugin_opt_password_file'. ```text global_plugin C:\Program Files\Mosquitto\mosquitto_password_file.dll plugin_opt_password_file ``` -------------------------------- ### Configure password_file per listener Source: https://mosquitto.org/documentation/authentication-methods When using per_listener_settings true, place the password_file option after the listener it applies to. ```text listener 1883 password_file /etc/mosquitto/password_file ``` -------------------------------- ### Other platforms configuration for mosquitto_password_file.so Source: https://mosquitto.org/documentation/plugins/password-file Use this configuration on non-Windows platforms to load the password file plugin. The plugin path is '/path/to/mosquitto_password_file.so' and the password file path is specified with 'plugin_opt_password_file'. ```text global_plugin /path/to/mosquitto_password_file.so plugin_opt_password_file ``` -------------------------------- ### Configure Sparkplug Aware plugin on Windows Source: https://mosquitto.org/documentation/plugins/sparkplug-aware Use the global_plugin directive to load the Sparkplug Aware DLL on Windows systems. ```text global_plugin C:\Program Files\Mosquitto\mosquitto_sparkplug_aware.dll ``` -------------------------------- ### Create a new group with mosquitto_ctrl dynsec createGroup Source: https://mosquitto.org/documentation/dynamic-security Use this command to create a new group in the Dynamic Security plugin. Replace with mosquitto_ctrl options and with the desired group name. ```bash mosquitto_ctrl dynsec createGroup ``` -------------------------------- ### Linux/BSD broker configuration for Dynamic Security plugin Source: https://mosquitto.org/documentation/dynamic-security Add these lines to the Mosquitto configuration file to load the Dynamic Security plugin and specify its configuration file. The plugin library path varies by distribution and hardware. ```plaintext plugin path/to/mosquitto_dynamic_security.so plugin_opt_config_file path/to/dynamic-security.json ``` -------------------------------- ### Windows plugin configuration Source: https://mosquitto.org/documentation/plugins/acl-file Loads the ACL file plugin on Windows and specifies the ACL file path. ```text global_plugin C:\Program Files\Mosquitto\mosquitto_acl_file.dll plugin_opt_acl_file ``` -------------------------------- ### mosquitto_ctrl dynsec listRoles Source: https://mosquitto.org/documentation/dynamic-security Lists all roles. ```APIDOC ## mosquitto_ctrl dynsec listRoles ### Description Lists all roles. ### Command mosquitto_ctrl dynsec listRoles ### Example ``` mosquitto_ctrl dynsec listRoles ``` ``` -------------------------------- ### Add or remove a client from a group with mosquitto_ctrl dynsec addGroupClient and removeGroupClient Source: https://mosquitto.org/documentation/dynamic-security These commands add or remove a client from a group. The priority parameter sets the group's priority within the client's list of groups. ```bash mosquitto_ctrl dynsec addGroupClient mosquitto_ctrl dynsec removeGroupClient ``` -------------------------------- ### mosquitto_ctrl dynsec createRole Source: https://mosquitto.org/documentation/dynamic-security Creates a new role. ```APIDOC ## mosquitto_ctrl dynsec createRole ### Description Creates a new role. ### Command mosquitto_ctrl dynsec createRole ### Parameters - **rolename** (string) - Required - The name of the role to create. ### Example ``` mosquitto_ctrl dynsec createRole myrole ``` ``` -------------------------------- ### Create a password file with mosquitto_passwd Source: https://mosquitto.org/documentation/authentication-methods Use the -c flag to create a new password file. You will be prompted for the password. The -c flag overwrites an existing file. ```bash mosquitto_passwd -c ``` -------------------------------- ### dynsec enableClient Source: https://mosquitto.org/documentation/dynamic-security Enables a client. Clients will be able to use these credentials to log in again. ```APIDOC ## dynsec enableClient ### Description Enables a previously disabled client. Clients will be able to use these credentials to log in again. ### Command `mosquitto_ctrl dynsec enableClient ` ### Parameters - `username` (string) - Required - The username of the client to enable. ### Example ``` mosquitto_ctrl dynsec enableClient ``` ``` -------------------------------- ### Configure Sparkplug Aware plugin on non-Windows systems Source: https://mosquitto.org/documentation/plugins/sparkplug-aware Use the global_plugin directive to load the Sparkplug Aware shared object file on Linux or other Unix-like systems. ```text global_plugin /path/to/mosquitto_sparkplug_aware.so ``` -------------------------------- ### Configure plugin for Mosquitto 2.0 and up Source: https://mosquitto.org/documentation/authentication-methods Use the plugin option for plugins written for Mosquitto 2.0 and later. ```text listener 1883 plugin ``` -------------------------------- ### Configure listener for remote access Source: https://mosquitto.org/documentation/migrating-to-2-0 Use this configuration to allow connections from remote machines when a configuration file is required. ```text listener 1883 # Note that this will not allow anonymous access by default. ``` -------------------------------- ### dynsec listClients Source: https://mosquitto.org/documentation/dynamic-security Lists all clients. The output is a list of client usernames. ```APIDOC ## dynsec listClients ### Description Lists all clients. The output is a list of client usernames. ### Command `mosquitto_ctrl dynsec listClients` ### Example ``` mosquitto_ctrl dynsec listClients ``` ### Response Example ``` client1 client2 ``` ``` -------------------------------- ### Configure password_file option Source: https://mosquitto.org/documentation/authentication-methods Add the password_file option to the Mosquitto configuration file to enable password authentication. ```text password_file ``` -------------------------------- ### mosquitto_ctrl dynsec listGroups Source: https://mosquitto.org/documentation/dynamic-security Lists all groups. ```APIDOC ## mosquitto_ctrl dynsec listGroups ### Description Lists all groups. ### Command mosquitto_ctrl dynsec listGroups ### Example ``` mosquitto_ctrl dynsec listGroups ``` ``` -------------------------------- ### Windows broker configuration for Dynamic Security plugin Source: https://mosquitto.org/documentation/dynamic-security Windows equivalent of the broker configuration, using the .dll plugin library and backslashes in paths. ```plaintext plugin path\to\mosquitto_dynamic_security.dll plugin_opt_config_file path\to\dynamic-security.json ``` -------------------------------- ### General mosquitto_ctrl command structure Source: https://mosquitto.org/documentation/dynamic-security The basic syntax for executing dynamic security commands, requiring connection options before the dynsec keyword. ```bash mosquitto_ctrl dynsec ... ``` -------------------------------- ### mosquitto_ctrl dynsec addGroupClient Source: https://mosquitto.org/documentation/dynamic-security Adds a client to a group with a specified priority. ```APIDOC ## mosquitto_ctrl dynsec addGroupClient ### Description Adds a client to a group with a specified priority. The priority determines the group's precedence within the client's list of groups. ### Command mosquitto_ctrl dynsec addGroupClient ### Parameters - **groupname** (string) - Required - The name of the group to add the client to. - **username** (string) - Required - The username of the client to add. - **priority** (integer) - Required - The priority of the group within the client's list of groups. ### Example ``` mosquitto_ctrl dynsec addGroupClient mygroup alice 10 ``` ``` -------------------------------- ### dynsec createClient Source: https://mosquitto.org/documentation/dynamic-security Creates a new client in the Dynamic Security plugin. Optionally associates a client ID with the client. ```APIDOC ## dynsec createClient ### Description Creates a new client. If no client ID is provided, the client is created without one. The user will be prompted for the new client's password and then for the admin user password. ### Command `mosquitto_ctrl dynsec createClient [-i ]` ### Parameters - `username` (string) - Required - The username for the new client. - `-i ` (string) - Optional - The client ID to associate with the client. ### Examples ``` mosquitto_ctrl dynsec createClient mosquitto_ctrl dynsec createClient -i ``` ``` -------------------------------- ### Other platforms plugin configuration Source: https://mosquitto.org/documentation/plugins/acl-file Loads the ACL file plugin on non-Windows systems and specifies the ACL file path. ```text global_plugin /path/to/mosquitto_acl_file.so plugin_opt_acl_file ``` -------------------------------- ### Add or remove a client role Source: https://mosquitto.org/documentation/dynamic-security Adds a role to a client with a priority, or removes a role from a client. ```bash mosquitto_ctrl dynsec addClientRole mosquitto_ctrl dynsec removeClientRole ``` -------------------------------- ### mosquitto_ctrl dynsec addRoleACL Source: https://mosquitto.org/documentation/dynamic-security Adds an ACL to a role. ```APIDOC ## mosquitto_ctrl dynsec addRoleACL ### Description Adds an ACL to a role. The ACL type can be one of publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, and unsubscribePattern. ### Command mosquitto_ctrl dynsec addRoleACL allow|deny ### Parameters - **rolename** (string) - Required - The name of the role to add the ACL to. - **acltype** (string) - Required - The type of ACL. Valid values: publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, unsubscribePattern. - **topic filter** (string) - Required - The topic filter for the ACL. - **allow|deny** (string) - Required - Whether to allow or deny access. - **priority** (integer) - Required - The priority of the ACL. ### Example ``` mosquitto_ctrl dynsec addRoleACL myrole publishClientSend client/topic allow 5 ``` ``` -------------------------------- ### Add or update a user with password on command line Source: https://mosquitto.org/documentation/authentication-methods This one-liner adds or updates a user with the password provided directly. Warning: the password is visible on the command line and in command history. ```bash mosquitto_passwd ``` -------------------------------- ### Delete a group with mosquitto_ctrl dynsec deleteGroup Source: https://mosquitto.org/documentation/dynamic-security Use this command to delete an existing group. Replace and accordingly. ```bash mosquitto_ctrl dynsec deleteGroup ``` -------------------------------- ### Configure allow_anonymous for unauthenticated access Source: https://mosquitto.org/documentation/authentication-methods Set allow_anonymous true to permit clients to connect without authentication. ```text listener 1883 allow_anonymous true ``` -------------------------------- ### Add an ACL to a role with mosquitto_ctrl dynsec addRoleACL Source: https://mosquitto.org/documentation/dynamic-security Adds an ACL to a role. The acltype must be one of publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, or unsubscribePattern. The priority parameter sets the ACL priority. ```bash mosquitto_ctrl dynsec addRoleACL allow|deny ``` -------------------------------- ### dynsec getClient Source: https://mosquitto.org/documentation/dynamic-security Retrieves information about a client. ```APIDOC ## dynsec getClient ### Description Retrieves information about a client. ### Command `mosquitto_ctrl dynsec getClient ` ### Parameters - `username` (string) - Required - The username of the client. ### Example ``` mosquitto_ctrl dynsec getClient ``` ``` -------------------------------- ### Pattern for bridge connection messages Source: https://mosquitto.org/documentation/plugins/acl-file Allows connection messages for bridges using pattern write with %c substitution. ```text pattern write $SYS/broker/connection/%c/state ``` -------------------------------- ### mosquitto_ctrl dynsec createGroup Source: https://mosquitto.org/documentation/dynamic-security Creates a new dynamic security group with the specified group name. ```APIDOC ## mosquitto_ctrl dynsec createGroup ### Description Creates a new dynamic security group with the specified group name. ### Command mosquitto_ctrl dynsec createGroup ### Parameters - **groupname** (string) - Required - The name of the group to create. ### Example ``` mosquitto_ctrl dynsec createGroup mygroup ``` ``` -------------------------------- ### Reload password file with SIGHUP Source: https://mosquitto.org/documentation/authentication-methods Send a SIGHUP signal to the Mosquitto process to reload the password file after changes. ```bash kill -HUP ``` -------------------------------- ### Delete a role with mosquitto_ctrl dynsec deleteRole Source: https://mosquitto.org/documentation/dynamic-security Use this command to delete an existing role. ```bash mosquitto_ctrl dynsec deleteRole ``` -------------------------------- ### HAProxy Global Configuration Source: https://mosquitto.org/documentation/listeners/haproxy A standard global configuration section for HAProxy, including user, group, and SSL settings. ```haproxy global log /dev/log local0 log /dev/log local1 notice user haproxy group haproxy daemon # Default SSL material locations ca-base /etc/ssl/certs crt-base /etc/ssl/private # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets ``` -------------------------------- ### Pattern ACL line format Source: https://mosquitto.org/documentation/plugins/acl-file Defines ACLs based on pattern substitution. Supports %c for client ID and %u for username. Applies to all users. ```text pattern [read|write|readwrite] ``` -------------------------------- ### Add or remove a role from a group with mosquitto_ctrl dynsec addGroupRole and removeGroupRole Source: https://mosquitto.org/documentation/dynamic-security These commands add or remove a role from a group. The priority parameter sets the role's priority within the group. ```bash mosquitto_ctrl dynsec addGroupRole mosquitto_ctrl dynsec removeGroupRole ``` -------------------------------- ### Add or update a user in a password file Source: https://mosquitto.org/documentation/authentication-methods Without the -c flag, this command adds a new user or updates the password for an existing user in the password file. ```bash mosquitto_passwd ``` -------------------------------- ### Configure auth_plugin for Mosquitto 1.6.x and below Source: https://mosquitto.org/documentation/authentication-methods Use the auth_plugin option for plugins written for Mosquitto 1.6.x and earlier. These plugins are also supported in version 2.0. ```text listener 1883 auth_plugin ``` -------------------------------- ### mosquitto_ctrl dynsec addGroupRole Source: https://mosquitto.org/documentation/dynamic-security Adds a role to a group with a specified priority. ```APIDOC ## mosquitto_ctrl dynsec addGroupRole ### Description Adds a role to a group with a specified priority. ### Command mosquitto_ctrl dynsec addGroupRole ### Parameters - **groupname** (string) - Required - The name of the group to add the role to. - **rolename** (string) - Required - The name of the role to add. - **priority** (integer) - Required - The priority of the role within the group. ### Example ``` mosquitto_ctrl dynsec addGroupRole mygroup myrole 5 ``` ``` -------------------------------- ### dynsec getDefaultACLAccess Source: https://mosquitto.org/documentation/dynamic-security Retrieves the current default ACL access setting for a given ACL type. ```APIDOC ## dynsec getDefaultACLAccess ### Description Examines the current default access for a specified ACL type. ### Command `mosquitto_ctrl dynsec getDefaultACLAccess ` ### Parameters - `aclType` (string) - Required - The ACL type to query. Valid values: `publishClientSend`, `publishClientReceive`, `subscribe`, `unsubscribe`. ### Example ``` mosquitto_ctrl dynsec getDefaultACLAccess unsubscribe ``` ``` -------------------------------- ### dynsec addClientRole Source: https://mosquitto.org/documentation/dynamic-security Adds a role to a client with a specified priority. ```APIDOC ## dynsec addClientRole ### Description Adds a role to a client with a specified priority. ### Command `mosquitto_ctrl dynsec addClientRole ` ### Parameters - `username` (string) - Required - The username of the client. - `rolename` (string) - Required - The name of the role to add. - `priority` (integer) - Required - The priority for the role. ### Example ``` mosquitto_ctrl dynsec addClientRole ``` ``` -------------------------------- ### Topic ACL line format Source: https://mosquitto.org/documentation/plugins/acl-file Defines topic access with optional access type (read, write, readwrite, deny). If omitted, access is read/write. Supports + and # wildcards. ```text topic [read|write|readwrite|deny] ``` -------------------------------- ### Direct pass through with PROXY protocol v1 Source: https://mosquitto.org/documentation/listeners/haproxy Enables PROXY protocol v1 on HAProxy and the Mosquitto broker. Direct pass through is not possible with encrypted connections. ```haproxy frontend mqtt_frontend bind *:1883 default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1884 check on-marked-down shutdown-sessions send-proxy ``` ```text listener 1883 enable_proxy_protocol 1 # Further listener settings ``` -------------------------------- ### dynsec setClientPassword Source: https://mosquitto.org/documentation/dynamic-security Sets the password for a client. If no password is provided, the user is prompted for it. ```APIDOC ## dynsec setClientPassword ### Description Sets the password for a client. If no password is provided, the user is prompted for it. ### Command `mosquitto_ctrl dynsec setClientPassword []` ### Parameters - `username` (string) - Required - The username of the client. - `password` (string) - Optional - The new password. If omitted, the user is prompted. ### Examples ``` mosquitto_ctrl dynsec setClientPassword mosquitto_ctrl dynsec setClientPassword ``` ``` -------------------------------- ### TLS termination with mutual TLS Source: https://mosquitto.org/documentation/listeners/haproxy Configures HAProxy for mutual TLS by requiring client certificate verification. Requires a CA certificate file. ```haproxy frontend mqtts_frontend bind *:8883 ssl crt /etc/haproxy/certs/ verify required ca-file /etc/haproxy/client-ca.crt default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1883 check on-marked-down shutdown-sessions ``` ```text listener 1883 # Further listener settings ``` -------------------------------- ### Delete a client Source: https://mosquitto.org/documentation/dynamic-security Deletes the specified client. Clients connected with these credentials will be disconnected from the broker. ```bash mosquitto_ctrl dynsec deleteClient ``` -------------------------------- ### HAProxy Defaults Configuration Source: https://mosquitto.org/documentation/listeners/haproxy The default section for HAProxy, setting TCP mode and connection timeouts. ```haproxy defaults mode tcp timeout connect 5000 timeout client 60000 timeout server 60000 ``` -------------------------------- ### mosquitto_ctrl dynsec deleteRole Source: https://mosquitto.org/documentation/dynamic-security Deletes a role. ```APIDOC ## mosquitto_ctrl dynsec deleteRole ### Description Deletes a role. ### Command mosquitto_ctrl dynsec deleteRole ### Parameters - **rolename** (string) - Required - The name of the role to delete. ### Example ``` mosquitto_ctrl dynsec deleteRole myrole ``` ``` -------------------------------- ### TLS termination with server certificate and PROXY protocol v2 Source: https://mosquitto.org/documentation/listeners/haproxy Uses send-proxy-v2-ssl to include TLS information in the PROXY header. The broker uses proxy_protocol_v2_require_tls to accept only TLS connections. ```haproxy frontend mqtts_frontend bind *:8883 ssl crt /etc/haproxy/certs/ default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1883 check on-marked-down shutdown-sessions send-proxy-v2-ssl ``` ```text listener 1883 enable_proxy_protocol 2 proxy_protocol_v2_require_tls true ``` -------------------------------- ### Direct pass through with PROXY protocol v2 Source: https://mosquitto.org/documentation/listeners/haproxy Enables PROXY protocol v2 on HAProxy and the Mosquitto broker. Direct pass through is not possible with encrypted connections. ```haproxy frontend mqtt_frontend bind *:1883 default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1884 check on-marked-down shutdown-sessions send-proxy-v2 ``` ```text listener 1883 enable_proxy_protocol 2 # Further listener settings ``` -------------------------------- ### Mutual TLS with username and PROXY protocol v2 Source: https://mosquitto.org/documentation/listeners/haproxy Uses send-proxy-v2-ssl-cn to pass the client certificate common name. The broker uses use_identity_as_username to map the identity to a username. ```haproxy frontend mqtts_frontend bind *:8883 ssl crt /etc/haproxy/certs/ verify required ca-file /etc/haproxy/client-ca.crt default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1883 check on-marked-down shutdown-sessions send-proxy-v2-ssl-cn ``` ```text listener 1883 enable_proxy_protocol 2 proxy_protocol_v2_require_tls true require_certificate true use_identity_as_username true ``` -------------------------------- ### mosquitto_ctrl dynsec setAnonymousGroup Source: https://mosquitto.org/documentation/dynamic-security Sets the group that anonymous devices are assigned to. ```APIDOC ## mosquitto_ctrl dynsec setAnonymousGroup ### Description Sets the group that anonymous devices are assigned to. ### Command mosquitto_ctrl dynsec setAnonymousGroup ### Parameters - **groupname** (string) - Required - The name of the group to assign anonymous devices to. ### Example ``` mosquitto_ctrl dynsec setAnonymousGroup anonymous_group ``` ``` -------------------------------- ### dynsec setDefaultACLAccess Source: https://mosquitto.org/documentation/dynamic-security Sets the default ACL access behavior for a given ACL type (publishClientSend, publishClientReceive, subscribe, unsubscribe). ```APIDOC ## dynsec setDefaultACLAccess ### Description Sets the default ACL access behavior for a given ACL type. The initial configuration sets publishClientSend to deny, publishClientReceive to allow, subscribe to deny, and unsubscribe to allow. ### Command `mosquitto_ctrl dynsec setDefaultACLAccess ` ### Parameters - `aclType` (string) - Required - The ACL type to modify. Valid values: `publishClientSend`, `publishClientReceive`, `subscribe`, `unsubscribe`. - `access` (string) - Required - The access level to set. Valid values: `allow` or `deny`. ### Example ``` mosquitto_ctrl dynsec setDefaultACLAccess publishClientSend deny mosquitto_ctrl dynsec setDefaultACLAccess publishClientReceive deny mosquitto_ctrl dynsec setDefaultACLAccess subscribe deny mosquitto_ctrl dynsec setDefaultACLAccess unsubscribe deny ``` ``` -------------------------------- ### Disable a client Source: https://mosquitto.org/documentation/dynamic-security Disables the specified client. Clients connected with these credentials will be disconnected from the broker. ```bash mosquitto_ctrl dynsec disableClient ``` -------------------------------- ### TLS termination with server certificate only Source: https://mosquitto.org/documentation/listeners/haproxy Configures HAProxy for TLS termination without PROXY protocol. Requires placing the server certificate and private key in /etc/haproxy/certs/. ```haproxy frontend mqtts_frontend bind 0.0.0.0:8883 ssl crt /etc/haproxy/certs/ backend mqtt_backend server server1 127.0.0.1:1883 check on-marked-down shutdown-sessions ``` ```text listener 1883 # Further listener settings ``` -------------------------------- ### Expected output from mosquitto_sub Source: https://mosquitto.org/documentation/using-the-snap The output displayed by the subscriber when a message is received. ```text snap/example Hello from mosquitto_pub ``` -------------------------------- ### Remove a user from a password file Source: https://mosquitto.org/documentation/authentication-methods Use the -D flag to delete a user from the password file. ```bash mosquitto_passwd -D ``` -------------------------------- ### mosquitto_ctrl dynsec deleteGroup Source: https://mosquitto.org/documentation/dynamic-security Deletes an existing dynamic security group by its name. ```APIDOC ## mosquitto_ctrl dynsec deleteGroup ### Description Deletes an existing dynamic security group by its name. ### Command mosquitto_ctrl dynsec deleteGroup ### Parameters - **groupname** (string) - Required - The name of the group to delete. ### Example ``` mosquitto_ctrl dynsec deleteGroup mygroup ``` ``` -------------------------------- ### mosquitto_ctrl dynsec removeRoleACL Source: https://mosquitto.org/documentation/dynamic-security Removes an ACL from a role using the topic filter as the key. ```APIDOC ## mosquitto_ctrl dynsec removeRoleACL ### Description Removes an ACL from a role using the topic filter as the key. ### Command mosquitto_ctrl dynsec removeRoleACL ### Parameters - **rolename** (string) - Required - The name of the role to remove the ACL from. - **acltype** (string) - Required - The type of ACL. Valid values: publishClientSend, publishClientReceive, subscribeLiteral, subscribePattern, unsubscribeLiteral, unsubscribePattern. - **topic filter** (string) - Required - The topic filter of the ACL to remove. ### Example ``` mosquitto_ctrl dynsec removeRoleACL myrole publishClientSend client/topic ``` ``` -------------------------------- ### mosquitto_ctrl dynsec removeGroupClient Source: https://mosquitto.org/documentation/dynamic-security Removes a client from a group. ```APIDOC ## mosquitto_ctrl dynsec removeGroupClient ### Description Removes a client from a group. ### Command mosquitto_ctrl dynsec removeGroupClient ### Parameters - **groupname** (string) - Required - The name of the group to remove the client from. - **username** (string) - Required - The username of the client to remove. ### Example ``` mosquitto_ctrl dynsec removeGroupClient mygroup alice ``` ``` -------------------------------- ### dynsec deleteClient Source: https://mosquitto.org/documentation/dynamic-security Deletes a client. Clients connected with these credentials will be disconnected from the broker. ```APIDOC ## dynsec deleteClient ### Description Deletes a client from the Dynamic Security plugin. Clients connected with these credentials will be disconnected from the broker. ### Command `mosquitto_ctrl dynsec deleteClient ` ### Parameters - `username` (string) - Required - The username of the client to delete. ### Example ``` mosquitto_ctrl dynsec deleteClient ``` ``` -------------------------------- ### Remove an ACL from a role with mosquitto_ctrl dynsec removeRoleACL Source: https://mosquitto.org/documentation/dynamic-security Removes an ACL from a role using the topic filter as the key. ```bash mosquitto_ctrl dynsec removeRoleACL ``` -------------------------------- ### dynsec disableClient Source: https://mosquitto.org/documentation/dynamic-security Disables a client. Clients connected with these credentials will be disconnected from the broker. ```APIDOC ## dynsec disableClient ### Description Disables a client. Clients connected with these credentials will be disconnected from the broker. ### Command `mosquitto_ctrl dynsec disableClient ` ### Parameters - `username` (string) - Required - The username of the client to disable. ### Example ``` mosquitto_ctrl dynsec disableClient ``` ``` -------------------------------- ### Mutual TLS termination with PROXY protocol v2 Source: https://mosquitto.org/documentation/listeners/haproxy Configures mutual TLS with PROXY protocol v2. The broker uses require_certificate to validate the certificate result from the PROXY header. ```haproxy frontend mqtts_frontend bind *:8883 ssl crt /etc/haproxy/certs/ verify required ca-file /etc/haproxy/client-ca.crt default_backend mqtt_backend backend mqtt_backend server server1 127.0.0.1:1883 check on-marked-down shutdown-sessions send-proxy-v2-ssl ``` ```text listener 1883 enable_proxy_protocol 2 proxy_protocol_v2_require_tls true require_certificate true ``` -------------------------------- ### dynsec removeClientRole Source: https://mosquitto.org/documentation/dynamic-security Removes a role from a client. ```APIDOC ## dynsec removeClientRole ### Description Removes a role from a client. ### Command `mosquitto_ctrl dynsec removeClientRole ` ### Parameters - `username` (string) - Required - The username of the client. - `rolename` (string) - Required - The name of the role to remove. ### Example ``` mosquitto_ctrl dynsec removeClientRole ``` ``` -------------------------------- ### mosquitto_ctrl dynsec removeGroupRole Source: https://mosquitto.org/documentation/dynamic-security Removes a role from a group. ```APIDOC ## mosquitto_ctrl dynsec removeGroupRole ### Description Removes a role from a group. ### Command mosquitto_ctrl dynsec removeGroupRole ### Parameters - **groupname** (string) - Required - The name of the group to remove the role from. - **rolename** (string) - Required - The name of the role to remove. ### Example ``` mosquitto_ctrl dynsec removeGroupRole mygroup myrole ``` ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.