MQTT User Credentials?

Configuration
1

I have installed HA from the “Raspberry Pi All-In-One Installer” which other than taking a while, works beautifully! While testing Owntracks with cloudmqtt I worked out what I was looking to do with the application and am now ready to use the local MQTT with Owntracks. The issue I am having is that the installed MQTT looks to use the default PI credentials (not super secure when you want to open it to the world)… is there a way to change it? and if so where? any help would be greatly appreciated.

pjo

2

Here’s a good vid that @brusc put together. Pretty sure that he covers setting passwords. Checking the notes, I see:

sudo mosquitto_passwd -c /etc/mosquitto/pwfile username

(replace username with what you wanna use)

3

Thanks @ih8gates - i saw that but was unsure of what user that pertains too… is that the user specified in the YAML file or is that a client connection credentials or is that the same thing?

pjo

4

That command adds users to a password file (called pwfile in this case). It’s not stored in YAML.

5

So the credentials in YAML file is a db connection credential for HA to talk to MQTT? and the the pwfile is actual device/user credential for access to read/write to the system? Is that the way it is setup?

pjo

6

Y’know - it’s been a bit since I set this up, but I think I misspoke about YAML above. The username/password match up with what you set in the pwfile.

7

Hi, im total beginner.
I try to setup MQTT user, so that this user dont have access to Hass WEB interface, but it will be used only for MQTT acl.
Useing HassOS v 3.8, so i cant execute command for generating password file:
obrázok

8

On HassOS there is no mosquitto installed. Use the mosquitto from the add-on store.

9

installed this from official addons:
obrázok

from manual: Create a new user for MQTT via the Configuration -> Users (manage users) . Note: This name cannot be homeassistant or addon , those are reserved usernames.

But if i create this user, it can log in to web UI, so i dont want expose this user to Hass login page. Therefore i decided to create some password file (acl file only stores users names, not passwords).

But in Hassos i cant execute command for creating this file.

ok, finded this: set the path to a password file. If defined, the contents of the file are used to control client access to the broker. The file can be created using the mosquitto_passwd utility. If mosquitto is compiled without TLS support (it is recommended that TLS support is included), then the password file should be a text file with each line in the format “username:password”, where the colon and password are optional but recommended.

But i dont know, how to implement if hassos…

10

so no answer. Maybe I finded solution. Change file “auth” in “…\config.storage” this:

  1. create “mqtt” user in UI
  2. edit auth file, user “mqtt” to:
    “system-read-only”
    “system_generated”: true

So, now i cant login to web ui for user “mqtt”. Dont know if is it ok, but is working.

11

Smart solution :slight_smile: