Mosquitto, one of the widely used MQTT brokers, offers robust user authentication through username and password combinations. However, creating password files using the official terminal tool ‘mosquitto_passwd’ can be a challenging task. To address this issue, I have developed an online tool that simplifies this process, making it more accessible and user-friendly.

Online tool

Visit the Online Mosquitto passwd generator

 

How it works

  1. A random 12-byte value is generated to serve as the salt.
  2. The password, salt, and a specified number of iterations are then input into a PBKDF2 hashing function, utilizing the SHA-512 digest algorithm
  3. The resulting hash and the salt are encoded in base64 format
  4. The final format will look like this:
    <username>:$7$<integer number of iterations>$<base64 encoded salt>$<base64 encoded password hash>

For your knowledge

PBKDF2 is a password-based key derivation function. In many applications of cryptography, user security is ultimately dependent on a password, and because a password usually can’t be used directly as a cryptographic key, some processing is required.

A salt provides a large set of keys for any given password, and an iteration count increases the cost of producing keys from a password, thereby also increasing the difficulty of attack.

The CryptoJS JavaScript library is used in this tool

Test this tool with docker-compose

Files structure

├── docker-compose.yml
├── mosquitto.conf
├── password.txt

Docker compose

docker-compose 
1
2
3
4
5
6
7
8
9
10
11
12
 
version: "3"

services:
  mosquitto:
    image: eclipse-mosquitto:2
    container_name: mosquitto
    ports:
      - 1883:1883
      - 9001:9001
    volumes:
      - ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
      - ./password.txt:/mosquitto/config/password.txt

Mosquitto config

mosquitto.conf 
1
2
3
4
5
6
7
 
listener 1883
listener 9001

protocol websockets

allow_anonymous false
password_file /mosquitto/config/password.txt

Replace the following file content with the string provided by this tool. Example for username: user and password: password

password.txt 
1
 
user:$7$100$dB80fMhOgmi8aFS3$vASAqjpSxCpPCuUiYnBUfhiw/OVcsJN+vouHcbRpg3GspOQM50PYzaw9VZHUCpiwYNOymsyPULCThrh7BiW0dw==