Mosquitto MQTT broker | Install Broker in AWS | Setting Up

What is Mosquitto ?

Eclipse Mosquitto is an open source (EPL/EDL licensed) message broker that implements the MQTT protocol versions 3.1 and 3.1.1. It is one of the most famous MQTT broker. Its very easy to install and easy to use. It is lightweight and is suitable for use on all devices from low power single board computers to full servers. The MQTT protocol provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for Internet of Things messaging such as with low power sensors or mobile devices such as phones, embedded computers or microcontrollers. The Mosquitto project also provides a C library for implementing MQTT clients, and the very popular mosquitto_pub and mosquitto_sub command line MQTT clients. Its can be installed on Unix machines. It can be secured via SSL and passwords, which we will describe below.

Mosquitto is part of the Eclipse Foundation and is an iot.eclipse.org project.

DOWNLOAD

Mosquitto is highly portable and available for a wide range of platforms. Go to the dedicated download page to find the source or binaries for your platform.

Mosquitto Public Test MQTT Broker

field	value
address	test.mosquitto.org
port	1883, 8883 (SSL), 8884 (SSL), 80 (WebSockets)
type	mosquitto
info	web page, Xively statistics, topics and HTTP bridge

 

---

How to install secure, robust Mosquitto MQTT broker on AWS Ubuntu |

How To Create Secure MQTT Broker

1. Install Mosquitto

Log into the AWS Ubuntu Instance.

$ sudo apt-get update

Install both the mosquitto broker and the publish / subscribe clients.

$ sudo apt-get install mosquitto mosquitto-clients

Example for subscribe:

$ mosquitto_sub -h localhost -t mychanel

Example for publish:

$ mosquitto_pub -h localhost -t mychanel "Hello World"

2. Enable Remote Access

To publish or subscribe using this broker from a remote machine, we need first open port 1883 in the security group setting. Using the AWS console, go to the security group and open port 1883 to everyone.

The default config file may permit connections from localhost only. The default conf file is can be opened

$ sudo vim /etc/mosquitto/conf.d/default.conf

The file should contain line following enable remote usage

listener 1883

Note that this port is currently unsecured, so if you don’t want to permit remote access:

listener 1883 localhost

Everytime you edit the conf file, you will have to restart the service for the settings to take effect.

$ sudo systemctl restart mosquitto

3. Robust MQTT

If MQTT broker crashed sometimes, disabling the real time communication. So we added a script that checked the state of the process and restarted Mosquitto in case it was down.

if [ "`ps -aux | grep /usr/sbin/mosquitto | wc -l`" == "1" ]

then

        echo "mosquitto wasnt running so attempting restart" >> /home/ubuntu/cron.log

        systemctl restart mosquitto

        exit 0

fi

echo "$SERVICE is currently running" >> /home/ubuntu/cron.log

exit 0
 

This can script can be saved in a file say ‘mosquitto_restart.sh’.

This file needs to be made an executable and then put in a cron job that runs every 5 minutes. The cron should be set as root.

$ chmod +x mosquitto_restart.sh

$ sudo  -i

$ crontab -e

Add the following statement

*/5 * * * * /home/ubuntu/mosquitto_restart.sh

Close cron tab. Now the script will execute every 5 minutes and restart mosquitto in case it is in active.

4. Setup SSL security

You May Also Like- How To Enable Free HTTPS on your website

We used letsencrypt certificates to secure our MQTT server. letsencrypt available free. The commands to install letencrypt certbot are as follows.

$ sudo add-apt-repository ppa:certbot/certbot

$ sudo apt-get update

$ sudo apt-get install certbot

The next step is to complete the HTTP challenge. To do that you need to assign a domain/subdomain e.g. mqtt.example.com to this IP address. You should also open the HTTP port 80 in the security group. The subdomain e.g. mqtt.example.com should already be added as record in DNS settings with your domain name provider.

$ sudo certbot certonly --standalone --standalone-supported-challenges http-01 -d mqtt.example.com

The above command run the HTTP challenge on its own. The option -standalone-supported-challenges http-01 specifies that it use the HTTP port 80 only, -d specifies the subdomain. You will be prompted to fill in your email address and agree to terms and conditions.

The certificates are permanent and need to renewed regularly. Such regular processes can set up using the cron as done in step 3. To setup cron run

$  sudo crontab -e

Add the above line to the cron tab. The post-hook statement will restart the broker if the certificates have been renewed.

45 4 * * * certbot renew --noninteractive --post-hook "systemctl restart mosquitto"

5. Configure Web Sockets

If your Angular / Javascript web application wants to communicate with MQTT, then web sockets needs to be enabled.  Open the configuration file

$ sudo vim /etc/mosquitto/conf.d/default.conf

Add the following lines to the file

listener 8083
protocol websockets
certfile /etc/letsencrypt/live/mqtt.example.com/cert.pem
cafile /etc/letsencrypt/live/mqtt.example.com/chain.pem
keyfile /etc/letsencrypt/live/mqtt.example.com/privkey.pem

Open up port 8083 in the security group for this instance, and restart the MQTT broker. You can now access the MQTT service on port 8083 using secure web sockets (WSS).

5. Enable Password Protection

I strongly recommend for Adding password protection to the MQTT.

$ sudo mosquitto_passwd -c /etc/mosquitto/passwd <user>

You will now be prompted to add a <password>

The password word is created and this needs to specified in the configuration file. So open the configuration file

$ sudo nano /etc/mosquitto/conf.d/default.conf

Add the following lines in the beginning of the file

allow_anonymous false

password_file /etc/mosquitto/passwd

Close the configuration file and restart the broker. You now need the specified user name and password to subscribe or publish on the MQTT broker.

$ mosquitto_sub -h localhost -t test -u "user" -P "password"

$ mosquitto_pub -h localhost -t "test" -m "hello world" -u "user" -P "password"

Complete Conf file for reference

A complete configuration file is given below for reference. It uses password protection, runs a MQTT on port 1883, MQTTS on port 1884, websockets on port 3033, and WSS on port 8083. Do not forget the open these ports in the security group.

 

allow_anonymous false

password_file /etc/mosquitto/passwd

listener 1883

listener 1884

certfile /etc/letsencrypt/live/mqtt.example.io/cert.pem

cafile /etc/letsencrypt/live/mqtt.example.io/chain.pem

keyfile /etc/letsencrypt/live/mqtt.example.io/privkey.pem      

listener 3033

protocol websockets

listener 8083 

protocol websockets

certfile /etc/letsencrypt/live/mqtt.example.io/cert.pem

cafile /etc/letsencrypt/live/mqtt.example.io/chain.pem

keyfile /etc/letsencrypt/live/mqtt.example.io/privkey.pem

---

Setting up Authentication in Mosquitto MQTT Broker

1. Install the latest Mosquitto distribution.

Run following commands,

wget http://repo.mosquitto.org/debian/mosquitto-repo.gpg.key
sudo apt-key add mosquitto-repo.gpg.key
cd /etc/apt/sources.list.d/
sudo wget http://repo.mosquitto.org/debian/mosquitto-wheezy.list
sudo apt-get update
sudo apt-get install mosquitto

2. If you have just installed the Mosquitto broker, make sure its stopped (to be in the safe side)

sudo stop mosquitto

3. Creating the new password file

Password file will contain your username and the encrypted password. Run the following command to create and add a user to this file.

sudo mosquitto_passwd -c /etc/mosquitto/passwd <user_name>

Then, you will be asked for your password twice, enter that too.

4. Now we have to give the location of the password file to the Mosquitto broker config file. So open the mosquitto.conf file using the following command,

sudo gedit /etc/mosquitto/mosquitto.conf

And add following two entries to the mosquitto.conf file,

password_file /etc/mosquitto/passwd
allow_anonymous false

• “allow_anonymous false” is used to prevent, clients without username and password to connecting to the broker.

5. Now start the broker with the following command,

mosquitto -c /etc/mosquitto/mosquitto.conf

6. If you need to verify the authentication, you can use following command, (you have to install mosquitto clients to do this)

mosquitto_sub -h localhost -p 1883 -t myTopic -u <user_name> -P <password>

---

I hope you like this article “Mosquitto MQTT broker.” if have you any Query, Please write in comment box.

You may like also:

• How To Create Secure MQTT Broker
• MQTT Servers/Brokers
• MQTT Products (that use MQTT)
• MQTT Public Brokers List
• IoT Data Protocols
• Setting up Authentication in Mosquitto MQTT Broker
• VerneMQ – Clustering MQTT for high availability and scalability
• How To Install VerneMQ on UbunTu, RHEL, Docker, Debian and Cent OS

Buy now : Raspberry PI 3 Model B+ Motherboard