Host Engineering Forum
General Category => General Discussion => Topic started by: trsimmons7 on February 29, 2020, 03:29:19 PM
-
OK - So I've had three BRX using MQTT communicating each through its own cell modem to my MQTT broker. No problems! Everything works as expected. Now its time to complicate things a bit. I went to my broker, created a password file, modified the mosquitto.conf, stopped and restarted the service (its on a windows machine and that is required to reload the conf file) and tested the username/password combination locally using MQTTExplorer. The broker turned down the anonymous login as it should and when i used the username/password for the local account - it worked.
Now - I take a username/password for one of the BRX and update the mqtt client settings.
Checked 'Enable Account Authentication' , entered a username and password, downloaded program.
No Luck! It doesn't work..... The Do-More error monitor says - 'TCP Connection failed or was unexpectedly closed. in MQTTPUB at $Main@28'. I have powered down both the BRX and the cell modem.
Where to start at troubleshooting this error?
thanks
travis
PS - the documentation for the DMD re the MQTT device setup covering SSL/TLS just kind of stops -- (missing or bad snippet) -- it says. Has this been updated?
-
This is most likely on the mqtt broker side. Use command mosquitto_passwd to generate an encrypted passwd file, then restart the broker.
Plain text passwords don't work if TLS is compiled into the mosquitto broker.
-
This is most likely on the mqtt broker side. Use command mosquitto_passwd to generate an encrypted passwd file, then restart the broker.
Plain text passwords don't work if TLS is compiled into the mosquitto broker.
I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.
-
I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.
Select MQTTS from the protocol selection list in the MQTT Client Settings dialog.
-
I'll be back on that project in a couple of weeks and will try it out then!
thanks
t.
-
I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.
Select MQTTS from the protocol selection list in the MQTT Client Settings dialog.
Ok - I'm back on this --
I can setup a successful MQTT connection on the BRX with port 1883 and no username/password.
I created an encrypted password file.
I restarted the broker and tested the password with MQTT Explorer - everything works.
I enabled username and password in the BRX. I have NOT enabled tls at this time.
It doesn't work. --- Socket error on client <unknown>, disconnecting.
Where to from here?
thanks
t.
-
It doesn't work. --- Socket error on client <unknown>, disconnecting.
Where to from here?
I would start with something simple. See if you can access the Mosquitto test server at test.mosquitto.org.
-
It doesn't work. --- Socket error on client <unknown>, disconnecting.
Where to from here?
I would start with something simple. See if you can access the Mosquitto test server at test.mosquitto.org.
How do I do this with a username and password? -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.
-
How do I do this with a username and password? -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.
You probably can't. I thought you were testing MQTTS.
I'm not sure what you tell you. The socket level error sounds like a TCP level error, not an MQTT error. Not sure why the username and password would have any influence on that.
-
How do I do this with a username and password? -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.
You probably can't. I thought you were testing MQTTS.
I'm not sure what you tell you. The socket level error sounds like a TCP level error, not an MQTT error. Not sure why the username and password would have any influence on that.
OK - we'll skip the username/password at this time. How do I implement TLS - I don't see how to add my self generated certificate to the BRX.
thanks
t.
-
How do I implement TLS - I don't see how to add my self generated certificate to the BRX.
MQTTS *is* TLS. You don't need a client side certificate.
We do have plans to implement client side certificates and offer that as an option, but that won't be available until next year.
-
How do I implement TLS - I don't see how to add my self generated certificate to the BRX.
MQTTS *is* TLS. You don't need a client side certificate.
We do have plans to implement client side certificates and offer that as an option, but that won't be available until next year.
You kinda lost me there (no surprise). ::)
I am using Mosquitto from Eclipse.
I refer to this page for the certificate requirements.
https://mosquitto.org/man/mosquitto-tls-7.html
-
You kinda lost me there (no surprise). ::)
I am using Mosquitto from Eclipse.
I refer to this page for the certificate requirements.
https://mosquitto.org/man/mosquitto-tls-7.html
That is describing how to use OpenSSL to generate certificates. When Mosquitto is configured for MQTTS on port 8883, the broker will need a certificate. We do not yet support client side certificates (that's coming), but you don't need a client side certificate to use MQTTS.
If you want to test 8883, just change to MQTTS and test with test.mosquitto.org. If that works, but your local broker doesn't, that a pretty good indication that the local broker isn't configured correctly yet.
-
You kinda lost me there (no surprise). ::)
I am using Mosquitto from Eclipse.
I refer to this page for the certificate requirements.
https://mosquitto.org/man/mosquitto-tls-7.html
That is describing how to use OpenSSL to generate certificates. When Mosquitto is configured for MQTTS on port 8883, the broker will need a certificate. We do not yet support client side certificates (that's coming), but you don't need a client side certificate to use MQTTS.
If you want to test 8883, just change to MQTTS and test with test.mosquitto.org. If that works, but your local broker doesn't, that a pretty good indication that the local broker isn't configured correctly yet.
So it seems like i can't use a self signed certificate? I mean the BRX is checking against a Certificate authority when the connection is opened?
-
For email, we embed the full certificate chain. For HTTPS and MQTTS we are essentially skipping the server certificate validation for now. Not sure how Mosquitto feels about self-signing. There are public free CAs out there though.
-
For email, we embed the full certificate chain. For HTTPS and MQTTS we are essentially skipping the server certificate validation for now. Not sure how Mosquitto feels about self-signing. There are public free CAs out there though.
Well.... no progress on this -
I've tried two brokers and two clients. Any combination of no username/no password, username/password, TLS or no TLS works for the two broker configurations and two clients.
BUT the BRX doesn't work for anything other than no username/ no password.
I need to solve this problem. The error logs aren't helping me.
The attachments are for username/password only.
I'm digging through some wireshark logs now to find a clue......
-
I just set up mosquitto to use a password file. Entered one username/password combination with mosquitto_passwd.exe and changed the mosquitto.conf to point to my file. It works fine for me. I do get the "Socket error on client <unknown>, disconnecting." when the user name or password is incorrect.
Is your password really long? I think the released code is limited to 19 characters. We have new stuff coming that greatly increases that.
-
I just set up mosquitto to use a password file. Entered one username/password combination with mosquitto_passwd.exe and changed the mosquitto.conf to point to my file. It works fine for me. I do get the "Socket error on client <unknown>, disconnecting." when the user name or password is incorrect.
Is your password really long? I think the released code is limited to 19 characters. We have new stuff coming that greatly increases that.
Nope - just 9 characters!
Yeah - i can use Mqtt Explorer or mqttbox as a client with username and password and it connects. I just can't see the problem.
-
Use Wireshark. Set the filter to tcp.port == 1883 to make it easier to find what you need. Isolate the MQTT Connect Command packet. The last bytes of the packet are the user name and password. Make sure that matches what you think they should be. I'm happy to look at the packet if you'd like.
-
Use Wireshark. Set the filter to tcp.port == 1883 to make it easier to find what you need. Isolate the MQTT Connect Command packet. The last bytes of the packet are the user name and password. Make sure that matches what you think they should be. I'm happy to look at the packet if you'd like.
Well there's your problem! Hell i don't know..... ::) ???
I attached a wireshark screen shot - one shows the correct username/password but the username and password flags are not set. This does not work.
I cleared the PLC memory - reloaded the program and it worked. See the other screenshot - correct username and password but the username and password flags are set.
I can't explain it. And I can break it again - trying to decide exactly how - not sure if its checking the tls box or the Enable Account box or a combination that does it.
-
That certainly doesn't sound right. Should be an easy bug to fix though.
-
Looks like if the will is turned on, it loses the password and user name flags. Easy fix.
-
Looks like if the will is turned on, it loses the password and user name flags. Easy fix.
I thought i was going crazy.
I'll keep an eye out for the update.
thanks
t.
-
I thought i was going crazy.
I'll keep an eye out for the update.
Well...in fairness...this doesn't prove that you aren't. ;)
Thanks for your help (and patience) on this. I owe you a beverage of your choice or some Host swag.
Update should be out next week.
-
I thought i was going crazy.
I'll keep an eye out for the update.
Well...in fairness...this doesn't prove that you aren't. ;)
Thanks for your help (and patience) on this. I owe you a beverage of your choice or some Host swag.
Update should be out next week.
Excellent!
Enjoy your weekend. - I'm fixing my beverage now......
thanks
t.