Windows系统下使用mosquitto_dynamic_security的admin账号无法执行操作

之前用acl和password文件管理Mosquitto Broker，现在切换为dynamic_security插件管理用户与权限，采用per listener配置避免影响Broker，但执行dynsec命令时出现未授权错误。

执行步骤 #

• 初始化动态安全：

  "C:\Program Files\mosquitto\mosquitto_ctrl.exe" dynsec init "C:\Program Files\mosquitto\dynamic-security.json" admin
  

  终端会提示输入admin用户密码
• 执行客户端列表查询命令：

  "C:\Program Files\mosquitto\mosquitto_ctrl.exe" -u admin -P "password" dynsec listClients
  

• 也尝试过指定端口和主机：

  "C:\Program Files\mosquitto\mosquitto_ctrl.exe" -h localhost -p 1883 -u admin -P "password" dynsec listClients
  

错误信息 #

Warning: You are running mosquitto_ctrl without encryption.
This means all of the configuration changes you are making are visible on the network, including passwords.

Connection error: Not authorized

当前配置文件 #

per_listener_settings true

# Non-TLS listener
listener 1883
protocol mqtt
allow_anonymous false

# Dynamic Security plugin
plugin C:\Program Files\mosquitto\mosquitto_dynamic_security.dll
plugin_opt_config_file C:\Program Files\mosquitto\dynamic-security.json

# TLS listener
listener 8883
allow_anonymous false
cafile C:\Program Files\mosquitto\certs\ca.crt
certfile C:\Program Files\mosquitto\certs\server.crt
keyfile C:\Program Files\mosquitto\certs\server.key
password_file C:\Program Files\mosquitto\p1.txt
acl_file C:\Program Files\mosquitto\acl.acl

问题原因及解决方法 #

问题出在per_listener_settings true的配置逻辑上：开启该选项后，全局的插件配置不会自动应用到所有listener，必须将动态安全插件的配置放在对应需要启用的listener块内。

1. 修改配置文件，将插件相关配置移到1883端口的listener块中：

   per_listener_settings true
   
   # Non-TLS listener
   listener 1883
   protocol mqtt
   allow_anonymous false
   plugin C:\Program Files\mosquitto\mosquitto_dynamic_security.dll
   plugin_opt_config_file C:\Program Files\mosquitto\dynamic-security.json
   
   # TLS listener
   listener 8883
   allow_anonymous false
   cafile C:\Program Files\mosquitto\certs\ca.crt
   certfile C:\Program Files\mosquitto\certs\server.crt
   keyfile C:\Program Files\mosquitto\certs\server.key
   password_file C:\Program Files\mosquitto\p1.txt
   acl_file C:\Program Files\mosquitto\acl.acl
   

2. 重启Mosquitto服务，让新配置生效。

3. 重新执行查询命令，确保指定1883端口（动态安全插件仅在此端口启用）：

   "C:\Program Files\mosquitto\mosquitto_ctrl.exe" -h localhost -p 1883 -u admin -P "你的admin密码" dynsec listClients
   

另外要确认dynamic-security.json文件路径正确，且Mosquitto服务拥有该文件的读写权限，避免初始化后的配置无法被加载。

内容的提问来源于stack exchange，提问作者Muhammad Awais