In this lecture, I'm going to talk about how to customize the configuration of your mosquito burka,
and in particular, I'll show you how to include your username and password authentication to add a
level of security to your.
And could it BROCA To know what is possible to do in terms of configuration with your mosquito breuker.
Have a look at the mosquito, the CANF men page, which of course is available under mosquito authority
for men for manual labor.
So here you'll find all the possible configuration directives, including those for authentication that
we can use in this lecture.
There's lots of general options.
You can customize your broker so that encryption is also used.
And basically what I suggest that you do here is to take a little bit of time to become familiar with
the possibilities that are available to you here in the context of this project.
I will only be adding to the authentication layer for a little bit of additional protection to our application,
but I'm not going to be spending any time doing any other types of customization.
So out of all these configuration directives will be using a couple.
For example, there is the password file directive, which is right here.
This is one of the available directives.
So when it comes to setting up your broker to require clients to authenticate with it, you need to
have either a password file that contains an encrypted password or you can also set this up via the
command line.
I'm going to go with the file option because that allows me to add multiple usernames at the same time
and encrypt their passwords as well.
So let's go ahead and do that.
I'm going to use the top.
Panel in my terminal and navigate to ATC first mosquito, which is where the mosquito configuration
file is, you've got actually two locations where you can set your configuration.
The first one is right here in the root of the mosquito folder.
But preferably you want to leave this one alone.
And this is the stock standard that comes with a fresh mosquito installation.
And then there is the DOT, the directory.
And in that you'll find.
Another configuration file can actually add yours if in your case is probably going to be empty.
So the D directorate will be empty, but any file that you add inside this directory with the DOD conf
extension will be loaded and passed by the broker when it starts.
So I just called mine must not confirm if this violence is that does not exist for you.
Just create it or create any file with the dot com extension.
So this is where configuration happens.
So let's go ahead and set up our must get a Broca to require the client to authenticate.
To do that, I'm going to go into the must get a dot config file and do a little bit of editing.
So I'm going to use the Nonno utility for this because I have not installs to them, which is my preference,
but I'm not doing much text editing work on my note Red Raspberry Pi, so I just stick with none of
this.
So then open up.
No, no.
And need to be suited for this elevator privileges, because most of the confi belongs to Rita, as
you can see here, right?
So sedar no must go to the conf.
And then inside here, what I'll do is first set the port for my broker and I'm not using encryption.
So the standard port for an encrypted communications with a muscular broker is one eight three.
And then I'm going to set the password file.
This is a pointer or add a full path to the password file.
So the directive is password and the scroll file, as you can see here in the documentation, and that
is followed by the path.
So to prevent me from making typing mistakes, I'm just going to copy the path like this so that ATC
mosquito passwords.
The text in another directive that I'm going to use is the directive that instructs the broker to only
accept connections from authenticated clients so it will not allow anonymous clients to connect.
So there is a directive for this code.
Allow Anonymous.
And it's this one here, and it can accept either true or false configuration for this one, so I'm
going to copy it across and make it false so that anonymous clients cannot connect.
They have to be authenticated.
So now I've got my construction.
I'm going to save it in a moment, but I still need to create and then encrypt the passwords dot text
file.
So let's go ahead and exit.
I say yes to right the changes to the file and then move one level back where I will create a new file
and it'll be owned by Route's.
I'm going to go sudo no no passwords don't texte.
And in this file I'm going to type in the usernames and passwords for my clients.
As many as you want.
There's no limit here.
I'm going to copy something that I prepared earlier.
So here you've got the username and you've got two dots and then the password in clear text.
We are about to encrypt this key.
A text, of course, that is not in the clear anymore.
But this is where you start from.
So have as many usernames with matching passwords as you want.
And then when you're finished, save the file.
Before you say that, make sure that you do have a backup because you won't be able to decrypt the passwords
once you set them.
You will not be able to go back to the passwords file to look at the passwords themselves because there
will be encrypted.
So make sure that you've got a copy and I've got my copy here as well.
So control X and yes, to exit Nonoo and save the changes to the file.
The next thing we need to do is to encrypt the new password file.
And the broker comes with a utility called Mosquito and Password for this job.
So let's run it.
So let's go for mosquito underscored password P..
Password and with the uSwitch will pass the password, then the name of the file that contains the passwords,
which is this enter.
Oh, OK.
Of course I need to be suited for this job because of passwords.
The text file is owned by route.
All right, then.
Let's have a look at what we have.
So the password static's to file is no encrypted.
Let's have a quick look at it.
Using the cap command, all right, and then there's the user name and there is my encrypted password
for that user, my other user name and the encrypted password and so on to make the changes in the configuration
file effective as a couple of ways to do that.
I found that the service command works.
So you'll just say pseudo.
Service Moscato restored.
And that's it.
So now we've got mosquito configured so that clients need to be authenticated before they can subscribe
or publish anything to the broke up.
Let's go to the next picture now.
We'll show you how to create clients to the broker that authenticate themselves.