Mosquito update 4.1 - ACL messages in logs

a3a · March 13, 2019, 5:52pm

I switched to the Community MQTT & HiveMQ add on and it seems to be more reliable again. I have a couple of clients that refused to stay connected to the official 4.1 release now. After removing and reconfiguring to the community add-on, all my old stuff started working immediately again.

Pavel_Donat · March 15, 2019, 6:49pm

I added users to HA, removed MQTT config from config.yaml, works OK.
Then I enabled acl as described above and log flood disapeared, but with each connection log show client user name and password in clear text, which “security expert” programed it???

Blockquote
1552674144: |-- mosquitto_auth_unpwd_check(hasscore) 1552674144: |-- ** checking backend http 1552674144: |-- url=http://127.0.0.1:8080/login 1552674144: |-- data=username=…name…&password=…pwd…&topic=&acc=-1&clientid= [INFO] found hasscore on Home Assistant 1552674146: |-- getuser(hasscore) AUTHENTICATED=1 by http
Blockquote

Klagio · March 15, 2019, 7:17pm

HI, you sure is that? Somewhere else I red its

topic readwrite #

also you know how to allow access without username?

Also how to put if you have 2 usernames

user bobby
topic readwrite # 

user paul
topic readwrite #

?

Pavel_Donat · March 15, 2019, 7:28pm

user bobby
topic #

This format works for me.

DavidFW1960 · March 17, 2019, 4:53am

It’s not a breaking change and didn’t break anything for my system… Perhaps instead of ranting you can post the broker config here?

bmcgair · March 17, 2019, 4:58am

Oh it’s definitely very broken. No more communication between mosquitto broker and my hubitat bridge.

I just rolled back as described here:

As far as ranting goes, I’ve been working in this industry for 30 years and its more than time that more people are held liable and/or called out for crap code and sloppy rollouts. As seems to be the case with the 737 Max, bad software is now killing people.

deddc23efb · March 18, 2019, 3:59pm

I agree with you on the breaking/modified. The HA dev team plays fast and loose with backwards compatibility and testing.

It wouldn’t matter so much if these were minor things, but people’s houses are directly affected by these kinds of things.

deddc23efb · March 18, 2019, 4:01pm

– deleted since context was missing.

tom_l · April 4, 2019, 11:32pm

I’m still confused.

HA seems to be working with the Mosquitto 4.1 aadon except after every HA version update I have to restart HA once more.

I would like to try adding the ACL files but am not sure what I need. I do not want unrestricted access.

I have one user, “mqtt_user”, that all my devices use. It’s a home assistant user. So I guess I add this to the file:

user mqtt_user
topic #

Do I also need to add an entry for home assistant to access the broker?

DavidFW1960 · April 4, 2019, 11:50pm

ACL wouldn’t work for me until I added homeassistant user as well. I have no idea why. You also need to set active: true in the broker. You should then see the errors and warnings go away.

tom_l · April 5, 2019, 12:00am

So to be 100% clear, I do this:

Edit the broker config to be this and save:

  "customize": {
    "active": true,
    "folder": "mosquitto"

create /share/mosquitto/acl.conf and add the line

acl_file /share/mosquitto/accesscontrollist

create /share/mosquitto/accesscontrollist and add

user mqtt_user
topic #
user homeassistant
topic #

restart broker

DavidFW1960 · April 5, 2019, 12:13am

That did it for me yes.

tom_l · April 5, 2019, 12:28am

I’ve completed it and everything still seems to be working. The test will be next HA version update.

DavidFW1960 · April 5, 2019, 12:32am

I’m on 0.91.0 now and it’s working well… A few custom components needed to be updated but otherwise no issues. (all the ones I was using updated already) The early betas were so bad I had to roll back but the release version is awesome. I also had to reconfigure my Yeelights as they are now their own platform but it is pretty stable here.

tom_l · April 5, 2019, 12:36am

I’m on 0.91.0 as well. The last two updates (including that one) caused mqtt broker spaz-outs for me (fixed with more HA restarts). I believe this started to occur after updating the broker to v4.1 so I’m hoping this fixes it when the 0.92 update comes around.

DavidFW1960 · April 5, 2019, 12:47am

I saw @cogneato had the same issue but I have never seen that.

tom_l · April 5, 2019, 2:04am

Well that didn’t last long. Just lost connection to all my mqtt devices.

Seems to be authenticating correctly, system log:

19-04-05 02:00:32 INFO (MainThread) [hassio.auth] Auth request from core_mosquitto for mqtt_user
19-04-05 02:00:33 INFO (MainThread) [hassio.auth] Success login from mqtt_user
19-04-05 02:00:34 INFO (MainThread) [hassio.auth] Auth request from core_mosquitto for mqtt_user
19-04-05 02:00:35 INFO (MainThread) [hassio.auth] Success login from mqtt_user
19-04-05 02:00:35 INFO (MainThread) [hassio.auth] Auth request from core_mosquitto for mqtt_user
19-04-05 02:00:37 INFO (MainThread) [hassio.auth] Success login from mqtt_user
19-04-05 02:00:37 INFO (MainThread) [hassio.auth] Auth request from core_mosquitto for mqtt_user

But there are socket errors in the broker log:

1554429736: |-- getuser(mqtt_user) AUTHENTICATED=1 by http
1554429736: Client sonoff_dining_heater_north already connected, closing old connection.
1554429736: Socket error on client sonoff_dining_heater_north, disconnecting.
1554429736: |-- mosquitto_auth_unpwd_check(mqtt_user)
1554429736: |-- ** checking backend http
1554429736: |-- url=http://127.0.0.1:8080/login
1554429736: |-- data=username=mqtt_user&password=readcted&topic=&acc=-1&clientid=
1554429736: New client connected from 10.1.1.188 as sonoff_dining_heater_north (c1, k15, u'mqtt_user').
[INFO] found mqtt_user on Home Assistant
1554429737: Client sonoff_dishwasher already connected, closing old connection.
1554429737: Socket error on client sonoff_dishwasher, disconnecting.
1554429737: New client connected from 10.1.1.192 as sonoff_dishwasher (c1, k15, u'mqtt_user').
1554429737: |-- getuser(mqtt_user) AUTHENTICATED=1 by http
1554429737: |-- mosquitto_auth_unpwd_check(mqtt_user)
1554429737: |-- ** checking backend http
1554429737: |-- url=http://127.0.0.1:8080/login
1554429737: |-- data=username=mqtt_user&password=redacted&topic=&acc=-1&clientid=
[INFO] found mqtt_user on Home Assistant
1554429740: |-- getuser(mqtt_user) AUTHENTICATED=1 by http
1554429740: Client sonoff_lounge_dehumidifier already connected, closing old connection.
1554429740: Socket error on client sonoff_lounge_dehumidifier, disconnecting.
1554429740: New client connected from 10.1.1.185 as sonoff_lounge_dehumidifier (c1, k15, u'mqtt_user').
1554429740: |-- mosquitto_auth_unpwd_check(mqtt_user)
1554429740: |-- ** checking backend http
1554429740: |-- url=http://127.0.0.1:8080/login
1554429740: |-- data=username=mqtt_user&password=redacted&topic=&acc=-1&clientid=
[INFO] found mqtt_user on Home Assistant
1554429742: |-- getuser(mqtt_user) AUTHENTICATED=1 by http
1554429742: |-- mosquitto_auth_unpwd_check(mqtt_user)
1554429742: Client sonoff_washing_machine already connected, closing old connection.
1554429742: Socket error on client sonoff_washing_machine, disconnecting.
1554429742: New client connected from 10.1.1.193 as sonoff_washing_machine (c1, k15, u'mqtt_user').
1554429742: |-- ** checking backend http
1554429742: |-- url=http://127.0.0.1:8080/login
1554429742: |-- data=username=mqtt_user&password=redacted&topic=&acc=-1&clientid=

Restarting the broker did not help.

Restarting HA seems to have restored the service for now…

DavidFW1960 · April 5, 2019, 2:10am

is that a home assistant user or have you defined a local user in the broker?

tom_l · April 5, 2019, 2:11am

mqtt_user is a HA user.

DavidFW1960 · April 5, 2019, 2:15am

are you using discovery or manual config? can you share your config