Search code examples
sslmqttopenstackpublish-subscribemosquitto

publish to Mosquitto in an OpenStack server

Please help me to know how to publish to Mosquitto sitting in a server that requires a key file to ssh to it.

I'm trying to publish a message to my Mosquitto on Ubuntu 16.04 server from a computer in a different network.

I've narrowed down the problem to the connect configuration settings of the server.

To ssh to it I need to pass the key file like: ssh -i mykeyfile.pem user@ipaddress

The problem is that I can't access Mosquitto from a computer in a different network because I don't know how to specify the key file. I've checked the ports and they are open.

This is how Im trying to publish:

mosquitto_pub -h ip_address -p 1883 -t test -m "hello world"

With the same configuration, I tried on a different server that doesn't require the key file to ssh to it. I managed to publish a message. That's how I concluded that the issue was the key file.

The configuration of Mosquitto is the default one. The content of mosquitto.conf is:

# Place your local configuration in /etc/mosquitto/conf.d/
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

log_dest file /var/log/mosquitto/mosquitto.log

include_dir /etc/mosquitto/conf.d

The error I get when trying to publish is:

Error: Connection timed out

EDIT

The firewall was disabled so the result of sudo ufw status was disactivated. I enabled it and set some rules. The current status is:

Status: active

To                         Action      From
--                         ------      ----
8083                       ALLOW       Anywhere
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
1883                       ALLOW       Anywhere
8083 (v6)                  ALLOW       Anywhere (v6)
22 (v6)                    ALLOW       Anywhere (v6)
80 (v6)                    ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
1883 (v6)                  ALLOW       Anywhere (v6)

The next output is from iptables sudo iptables -L -v -n:

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8083
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:8083
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:22
  699 40412 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1883
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1883
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1883
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1883

But still can't publish messages.

The computer where Mosquitto sits has Apache2 server working

I hope this makes sense. Thanks.

Solution

  • Here is how I solved my question.

    Context:

    • Mosquitto is in a server,
    • the servers is in a VM
    • the VM is on OpenStack.

    After making loads of (perhaps unnecessary) changes to iptables, ufw, firewall, and mosquitto's config files I checked OpenStack (I know... how come I didn't mention this before! Well, I was so confused that it wasn't my first thought). So then I realized that the security group for my VM didn't have a rule for port 1883 (not allowing nor rejecting). I added it.

    Eureka, I can publish messages from an outside computer.

    This is how my security group looks like (last two lines added):

    enter image description here

    My takeaway is that there is not only one door but like an onion with many layers to go through!

    Hopefully this will help others.