Secure your MQTT server with authentication and encryption
1–10 of 30 posts
Re: Secure your MQTT server with authentication and encryption
#2I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto.
My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
Re: Secure your MQTT server with authentication and encryption
#3This is a good tutorial to get the server side of things secured. I didn't know you could use Traefik to proxy the MQTT connections as well which looks quite useful.
The biggest issue I have is with the client side and its various support of TLS and getting a trusted CA certificate distributed. This is the harder part of the equation in my opinion, support is getting better with firmwares like Tasmota but getting some third party IoT device to work over TLS is still a challenge.
Re: Secure your MQTT server with authentication and encryption
#4I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto. My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
Author here:
That's exactly what this post does only with Traefik instead of haproxy. The TLS of Mosquitto is just too much of a maintenance burden.
A cross post from what I replied at a Reddit topic:
> Mosquitto does have TLS support by itself, but the manual only deals with self-signed certificates. Self-signed certificates do involve a maintenance burden I don't want to deal with. All my applications/devices which expose a HTTP frontend (or other TCP stream) are encrypted via Let's Enncrypt certificates. They are automatically trusted by a lot of platforms (pc's, phones and other devices).
> I was using acme.sh before and the post-install hook can refresh every service, but it just wasn't working properly on every occasion. You also have to reload all your applications for loading the new certs (that is, Home Assistant, Unifi, Pi-hole, mosquitto, my smart meter readings platform and so on). Just reloading everything for a cert renew felt cumbersome, and Traefik dealing with TLS termination decouples the TLS part from the application itself.
> Since I used Traefik already, it was really straightforward to put Mosquitto behind Traefik too. Of course every situation is different, this post is mainly geared towards users which do not authenticate or encrypt Mosquitto at all.
Re: Secure your MQTT server with authentication and encryption
#5I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto. My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
Author here: That's exactly what this post does only with Traefik instead of haproxy. The TLS of Mosquitto is just too much of a maintenance burden. A cross post from what I replied at a Reddit topic: > Mosquitto does have TLS support by itself, but the manual only deals with self-signed certificates. Self-signed certificates do involve a maintenance burden I don't want to deal with. All my applications/devices which…
I'll have to give Traefik a peek. I've used haproxy for a long time, and it's my go-to tool for my TLS termination and proxy needs, but it's always good to have more tools.
Re: Secure your MQTT server with authentication and encryption
#6I'm a bit confused. You got a local MQTT server, and a local Traefik proxy, all behind your local firewall. How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik?
The last time I tried to use LetsEncrypt for a local server, several years ago, this could not be done. Has this changed?
Re: Secure your MQTT server with authentication and encryption
#7I'm a bit confused. You got a local MQTT server, and a local Traefik proxy, all behind your local firewall. How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik? The last time I tried to use LetsEncrypt for a local server, several years ago, this could not be done. Has this changed?
> How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik?
DNS registration. You can get letsencrypt validation through a DNS token for validation. You can generally script that using the API provided by your DNS provider.
Re: Secure your MQTT server with authentication and encryption
#8I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto. My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
You are much better off with a gateway than a proxy.
Re: Secure your MQTT server with authentication and encryption
#9I use almost the same thing with an Internet accessible MQTT server that acts as relay of Zoom Webhook events, except it is using nginx as the proxy. I have local MQTT server that connects to the public MQTT server and then local clients that show zoom status via LEDs are connected to my local server.
There is also no mention in article of what is being used for internal DNS resolution. I could assume pi-hole, but something to resolve DNS on home network is required is this operation.
Re: Secure your MQTT server with authentication and encryption
#10I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto. My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
You are much better off with a gateway than a proxy.
Can you explain further?