Hi
I normal Debian/Ubuntu bare metal Mosquitto should have
Config in /etc/mosquitto/mosquitto.conf
This file will normally only define the location of PID file and log file and then it contains an include to /etc/mosquitto/conf.d
And inside conf.d you will find a file called default.conf
And inside of this you will have a path to the password file which is very likely to be /etc/mosquitto/passwd
This file also contains the ports that Mosquitto listens to for mqtt and websockets
Now there are two usernames in play. The username that mosquitto runs under in the Linux world. This is by default mosquitto. This is just a user with limited priviledges so we avoid running the daemon as root. It has nothing to do with clients connecting
It is in the passwd file you have the user that mqtt clients incl Home Assistant needs to login with.
The passwd file is with encrypted password but you can see which users have been setup (name before the colon)
This password file is created with the command
mosquitto_passwd -c passwordfile user
You can add more users with
mosquitto_passwd -b passwordfile user password
The commands create the file in the current working directory but you can move it afterwards if you create it in a wrong directory.
You need to restart Mosquitto to pick up the username/password changes
For you with the trouble - it sounds more like your Mosquitto stopped running independently of the HA update.
One thing I have not played with is to have TLS encryption between Mosquitto and clients. This require certificates. They can expire!
I see no reason to use TLS between my Sonoffs and Mosquitto as I do not expose my Mosquitto to the wild internet and it complicates debuggins and the ESP8266 based clients really have no resources to do this. So I assume you do not have TLS enabled.
Kenneth