Mosquitto is an open-source message broker implementing the MQTT (Message Queuing Telemetry Transport) protocol — a lightweight TCP/IP messaging platform built for IoT devices with minimal resources, such as low bandwidth or short battery life. It relies on a publish-subscribe (pub/sub) topology, where publishers send messages to the broker and subscribers receive them through a channel. This guide installs Mosquitto on Ubuntu 24.04, manages it as a systemd service, tests pub/sub messaging with the Mosquitto CLI clients, and secures the broker with password authentication. By the end, you’ll have a password-protected Mosquitto MQTT broker ready for IoT messaging.
Prerequisites: an Ubuntu 24.04 server, a non-root user with sudo privileges, and an updated system.
Install Mosquitto MQTT Broker
Mosquitto is available in the default Ubuntu 24.04 package repositories.
1. Install the Mosquitto package:
$ sudo apt install -y mosquitto
Enter fullscreen mode Exit fullscreen mode
2. Verify the installed version:
$ mosquitto -v
Enter fullscreen mode Exit fullscreen mode
Output:
1730087147: mosquitto version 2.0.18 starting
1730087147: Using default config.
1730087147: Starting in local only mode. Connections will only be possible from clients running on this machine.
1730087147: Create a configuration file which defines a listener to allow remote access.
Enter fullscreen mode Exit fullscreen mode
Manage the Mosquitto System Service
Mosquitto runs as a system service under mosquitto.
1. View the service status:
$ sudo systemctl status mosquitto
Enter fullscreen mode Exit fullscreen mode
Output:
● mosquitto.service - Mosquitto MQTT Broker
Loaded: loaded (/usr/lib/systemd/system/mosquitto.service; enabled; preset: enabl>
Active: active (running) since Fri 2024-10-25 06:51:37 UTC; 12min ago
Docs: man:mosquitto.conf(5)
man:mosquitto(8)
...
Enter fullscreen mode Exit fullscreen mode
2. Stop the service:
$ sudo systemctl stop mosquitto
Enter fullscreen mode Exit fullscreen mode
3. Start the service:
$ sudo systemctl start mosquitto
Enter fullscreen mode Exit fullscreen mode
4. Restart the service:
$ sudo systemctl restart mosquitto
Enter fullscreen mode Exit fullscreen mode
Install and Test the Mosquitto Clients
Publishers and subscribers connect to a Mosquitto server and exchange messages using the Mosquitto command-line interface.
1. Install the mosquitto-clients package:
$ sudo apt install -y mosquitto-clients
Enter fullscreen mode Exit fullscreen mode
2. Subscribe to a topic as a background process:
$ mosquitto_sub -t "home/sensor/temperature" &
Enter fullscreen mode Exit fullscreen mode
Output:
23.5
Enter fullscreen mode Exit fullscreen mode
3. Publish a message to the topic:
$ mosquitto_pub -t "home/sensor/temperature" -m "30.5" -q 1 -r
Enter fullscreen mode Exit fullscreen mode
Output:
30.5
30.5
Enter fullscreen mode Exit fullscreen mode
4. Publish another message:
$ mosquitto_pub -t "home/sensor/temperature" -m "45.2" -q 1 -r
Enter fullscreen mode Exit fullscreen mode
Output:
45.2
45.2
Enter fullscreen mode Exit fullscreen mode
5. View active background jobs and note the mosquitto_sub job ID:
$ jobs
Enter fullscreen mode Exit fullscreen mode
Output:
[1] Running mosquitto_sub -t "home/lights/sitting_room" &
Enter fullscreen mode Exit fullscreen mode
6. Stop the job by specifying its ID:
$ kill %1
Enter fullscreen mode Exit fullscreen mode
Output:
[1] Done mosquitto_sub -t "home/lights/sitting_room" &
Enter fullscreen mode Exit fullscreen mode
Secure the Mosquitto Server
By default, Mosquitto allows clients to connect without any authentication. Enable password-based authentication so clients must connect with a username and password.
1. Create a new configuration file:
$ sudo nano /etc/mosquitto/conf.d/default.conf
Enter fullscreen mode Exit fullscreen mode
2. Add the following to disable anonymous connections and point Mosquitto at the credentials file:
allow_anonymous false
password_file /etc/mosquitto/passwd
Enter fullscreen mode Exit fullscreen mode
Save and close the file.
3. Open the password file:
$ sudo nano /etc/mosquitto/passwd
Enter fullscreen mode Exit fullscreen mode
4. Add user credentials (replace EXAMPLE_PASSWORD and STRONG_PASSWORD with your own values):
john_doe:EXAMPLE_PASSWORD
mary_smith:STRONG_PASSWORD
Enter fullscreen mode Exit fullscreen mode
Save and close the file.
5. Encrypt the plaintext passwords:
$ sudo mosquitto_passwd -U /etc/mosquitto/passwd
Enter fullscreen mode Exit fullscreen mode
6. Verify the passwords are encrypted:
$ sudo cat /etc/mosquitto/passwd
Enter fullscreen mode Exit fullscreen mode
Output:
john_doe:$6$TSzNycsj...5Qyvgd4g==
mary_smith:$6$DtlKf1lG.../rLHIL0Q==
Enter fullscreen mode Exit fullscreen mode
7. Restart Mosquitto to apply the changes:
$ sudo systemctl restart mosquitto
Enter fullscreen mode Exit fullscreen mode
8. Subscribe using a valid username and password:
$ mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "/home/sensor/temperature"
Enter fullscreen mode Exit fullscreen mode
9. Publish a message using valid credentials:
$ mosquitto_pub -u john_doe -P EXAMPLE_PASSWORD -t "home/sensor/temperature" -m "22.5" -q 1 -r
Enter fullscreen mode Exit fullscreen mode
Output:
22.5
Enter fullscreen mode Exit fullscreen mode
10. View active background jobs and note the job ID:
$ jobs
Enter fullscreen mode Exit fullscreen mode
Output:
[1] Running mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "home/lights/sitting_room" &
Enter fullscreen mode Exit fullscreen mode
11. Stop the job by specifying its ID:
$ kill %1
Enter fullscreen mode Exit fullscreen mode
Output:
[1] Done mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "home/lights/sitting_room" &
Enter fullscreen mode Exit fullscreen mode
12. Confirm authentication is enforced by trying incorrect credentials:
$ mosquitto_pub -u john_doe -P VERY_WRONG_PASSWORD -t "home/sensor/temperature" -m "22.5" -q 1 -r
Enter fullscreen mode Exit fullscreen mode
Output:
Connection error: Connection Refused: not authorised.
Error: The connection was refused.
Enter fullscreen mode Exit fullscreen mode
The connection fails because Mosquitto can’t authorize the user.
Next Steps
- Integrate Mosquitto with a programming language like Python, PHP, Ruby, or Go to build IoT applications
- Add TLS encryption to secure MQTT traffic in transit
- Configure per-topic ACLs to restrict which clients can publish or subscribe to specific topics
- Monitor broker health and traffic using Mosquitto’s
$SYStopics
For the full guide with additional tips, visit the original article on Vultr Docs.