Secure your MQTT server with authentication and encryption • Hacker News Board

Re: Secure your MQTT server with authentication and encryption

#21

Post by SV_BubbleTime » Mon, Feb 01, 2021, 6:45 PM UTC

tialaramex wrote: post #19

SV_BubbleTime wrote: post #11

You lucky guys with IP stacks and TLS! I had to secure an IoT MQTT install where the packets themselves needed encryption which meant hamfisting in an encapsulated packet scheme (plain text header, end to end encrypted payloads). Kinda painful and I would not do that again!

It really seems like you could squeeze IP and thus (D)TLS in there instead, definitely something to eye up if ever you do have to do this again. For TLS you can use pre-shared key mode so there's no extra gubbins like certificates, but you get all the same guarantees about whether what you're doing is actually safe as the big guys.

Entire chip has 512K of rom, if I could have fit IP I would have considered it, but I was already really quite cramped for room! I’m sure there are some tight IP systems but I’m already mesh/proxy-ing stuff, it was easier to just encapsulate.

Re: Secure your MQTT server with authentication and encryption

#22

Post by yc-kraln » Mon, Feb 01, 2021, 7:43 PM UTC

SV_BubbleTime wrote: post #21

tialaramex wrote: post #19

Earlier quoted context omitted.

It really seems like you could squeeze IP and thus (D)TLS in there instead, definitely something to eye up if ever you do have to do this again. For TLS you can use pre-shared key mode so there's no extra gubbins like certificates, but you get all the same guarantees about whether what you're doing is actually safe as the big guys.

Entire chip has 512K of rom, if I could have fit IP I would have considered it, but I was already really quite cramped for room! I’m sure there are some tight IP systems but I’m already mesh/proxy-ing stuff, it was easier to just encapsulate.

I've done NB-IoT in 32K of ROM... 512K is a luxury :)

Re: Secure your MQTT server with authentication and encryption

#23

Post by BrandoElFollito » Mon, Feb 01, 2021, 8:24 PM UTC

the_arun wrote: post #13

Could we MQTT in regular applications as well? or just in IOT?

Absolutely yes.

MQTT is a specific implementation of a general approach to buses. This is wildly used for asynchronous communication between services.

I use MQTT (or other buses) when I have services that need to send some information without consideration for the services that need that information. The first ones are producers, the other ones - consumers.

This is a very powerful approach when you have good cases. IoTs are typical cases where they send data and something else makes use of them. Another example is code that calculates some information and emits its results.

Some of my code retrieve google calendar information and emits that - and it is consumed by a dashboard, some other code that makes decisions such as alarm clocks etc.

In general you use this for asynchronous messaging, especially in with one-to-many scenarios.

Re: Secure your MQTT server with authentication and encryption

#24

Post by BrandoElFollito » Mon, Feb 01, 2021, 8:25 PM UTC

patwolf wrote: post #16

the_arun wrote: post #13

Could we MQTT in regular applications as well? or just in IOT?

In my experience MQTT works well for telemetry and one-way messaging, but it's not good at doing request-response flow like you typically do in an application using HTTP. You can certainly come up with a mechanism for doing that, but you're having to re-invent a lot of what HTTP already solves.

HTTP is synchronous. MQTT is asynchronous.

HTTP is 1:1. MQTT can be 1:many.

What you use completely depends on your specific case.

Re: Secure your MQTT server with authentication and encryption

#25

Post by jononor » Mon, Feb 01, 2021, 8:30 PM UTC

the_arun wrote: post #13

Could we MQTT in regular applications as well? or just in IOT?

Sure. However if you are thinking for server/cloud usage, I would recommend considering AMQP instead (RabbitMQ etc). Especially if you want a "worker" type model with horizontal scalability for job processing, then the roundrobin.

Some of the functionality has been added to the MQTTv5 spec, but client support is not as good for that yet, and its not as battle tested as AMQP.

Re: Secure your MQTT server with authentication and encryption

#26

Post by theflyinghorse » Mon, Feb 01, 2021, 8:41 PM UTC

We were able to set up a certificate-per-device authorization for MQTT where we use CN field of the cert for mapping to what particular device is allowed to pub/sub to

Re: Secure your MQTT server with authentication and encryption

#27

Post by adamcstephens » Mon, Feb 01, 2021, 10:55 PM UTC

adev_ wrote: post #7

bxparks wrote: post #6

I'm a bit confused. You got a local MQTT server, and a local Traefik proxy, all behind your local firewall. How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik? The last time I tried to use LetsEncrypt for a local server, several years ago, this could not be done. Has this changed?

> How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik? DNS registration. You can get letsencrypt validation through a DNS token for validation. You can generally script that using the API provided by your DNS provider.

With Traefik it’s just setting up the config and any authentication. After that Traefik will manage the lifecycle of the cert.

Re: Secure your MQTT server with authentication and encryption

#28

Post by eeZah7Ux » Tue, Feb 02, 2021, 12:05 AM UTC

fullstop wrote: post #10

eeZah7Ux wrote: post #8

Earlier quoted context omitted.

You are much better off with a gateway than a proxy.

Can you explain further?

Very often in home and industrial automation you want to have a smart enough, local, gateway that can:

- speak multiple protocols as needed by the devices

- aggregate data, provide history of values from sensors & so on

- isolates the (limited) network stacks of local devices from the Internet - e.g. provides different timeouts and retransmission behavior

- terminates a VPN, often providing better security than exposing services directly on the Internet!

Re: Secure your MQTT server with authentication and encryption

#29

Post by rakoo » Tue, Feb 02, 2021, 12:23 AM UTC

the_arun wrote: post #13

Could we MQTT in regular applications as well? or just in IOT?

MQTT is just a tool for publish/subscribe; that pattern exists in way more domains than IOT. Facebook Messenger, for example, is implemented on top of it.

Re: Secure your MQTT server with authentication and encryption

#30

Post by m_eiman » Tue, Feb 02, 2021, 7:43 AM UTC

SV_BubbleTime wrote: post #21

tialaramex wrote: post #19

Earlier quoted context omitted.

It really seems like you could squeeze IP and thus (D)TLS in there instead, definitely something to eye up if ever you do have to do this again. For TLS you can use pre-shared key mode so there's no extra gubbins like certificates, but you get all the same guarantees about whether what you're doing is actually safe as the big guys.

Entire chip has 512K of rom, if I could have fit IP I would have considered it, but I was already really quite cramped for room! I’m sure there are some tight IP systems but I’m already mesh/proxy-ing stuff, it was easier to just encapsulate.

There are small IP stacks, I use this one and it’s been working well: http://savannah.nongnu.org/projects/lwip/

Might still be too big if your other code is large, of course, but I use it comfortably on a 512 kB device.