Installing Mosquitto MQTT Broker on Ubuntu 24.04

Mosquitto is an open-source message broker implementing the MQTT (Message Queuing Telemetry Transport) protocol — a lightweight TCP/IP messaging platform built for IoT devices with minimal resources, such as low bandwidth or short battery life. It relies on a publish-subscribe (pub/sub) topology, where publishers send messages to the broker and subscribers receive them through a channel. This guide installs Mosquitto on Ubuntu 24.04, manages it as a systemd service, tests pub/sub messaging with the Mosquitto CLI clients, and secures the broker with password authentication. By the end, you'll have a password-protected Mosquitto MQTT broker ready for IoT messaging.

Prerequisites: an Ubuntu 24.04 server, a non-root user with sudo privileges, and an updated system.

Install Mosquitto MQTT Broker

Mosquitto is available in the default Ubuntu 24.04 package repositories.

1. Install the Mosquitto package:

$ sudo apt install -y mosquitto

2. Verify the installed version:

$ mosquitto -v

Output:

1730087147: mosquitto version 2.0.18 starting
1730087147: Using default config.
1730087147: Starting in local only mode. Connections will only be possible from clients running on this machine.
1730087147: Create a configuration file which defines a listener to allow remote access.

Manage the Mosquitto System Service

Mosquitto runs as a system service under mosquitto.

1. View the service status:

$ sudo systemctl status mosquitto

Output:

● mosquitto.service - Mosquitto MQTT Broker
 Loaded: loaded (/usr/lib/systemd/system/mosquitto.service; enabled; preset: enabl>
 Active: active (running) since Fri 2024-10-25 06:51:37 UTC; 12min ago
   Docs: man:mosquitto.conf(5)
      man:mosquitto(8)
...

2. Stop the service:

$ sudo systemctl stop mosquitto

3. Start the service:

$ sudo systemctl start mosquitto

4. Restart the service:

$ sudo systemctl restart mosquitto

Install and Test the Mosquitto Clients

Publishers and subscribers connect to a Mosquitto server and exchange messages using the Mosquitto command-line interface.

1. Install the mosquitto-clients package:

$ sudo apt install -y mosquitto-clients

2. Subscribe to a topic as a background process:

$ mosquitto_sub -t "home/sensor/temperature" &

Output:

23.5

3. Publish a message to the topic:

$ mosquitto_pub -t "home/sensor/temperature" -m "30.5" -q 1 -r

Output:

30.5
30.5

4. Publish another message:

$ mosquitto_pub -t "home/sensor/temperature" -m "45.2" -q 1 -r

Output:

45.2
45.2

5. View active background jobs and note the mosquitto_sub job ID:

$ jobs

Output:

[1]   Running                 mosquitto_sub -t "home/lights/sitting_room" &

6. Stop the job by specifying its ID:

$ kill %1

Output:

[1]   Done                    mosquitto_sub -t "home/lights/sitting_room" &

Secure the Mosquitto Server

By default, Mosquitto allows clients to connect without any authentication. Enable password-based authentication so clients must connect with a username and password.

1. Create a new configuration file:

$ sudo nano /etc/mosquitto/conf.d/default.conf

2. Add the following to disable anonymous connections and point Mosquitto at the credentials file:

allow_anonymous false
password_file /etc/mosquitto/passwd

Save and close the file.

3. Open the password file:

$ sudo nano /etc/mosquitto/passwd

4. Add user credentials (replace EXAMPLE_PASSWORD and STRONG_PASSWORD with your own values):

john_doe:EXAMPLE_PASSWORD
mary_smith:STRONG_PASSWORD

Save and close the file.

5. Encrypt the plaintext passwords:

$ sudo mosquitto_passwd -U /etc/mosquitto/passwd

6. Verify the passwords are encrypted:

$ sudo cat /etc/mosquitto/passwd

Output:

john_doe:$6$TSzNycsj...5Qyvgd4g==
mary_smith:$6$DtlKf1lG.../rLHIL0Q==

7. Restart Mosquitto to apply the changes:

$ sudo systemctl restart mosquitto

8. Subscribe using a valid username and password:

$ mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "/home/sensor/temperature"

9. Publish a message using valid credentials:

$ mosquitto_pub -u john_doe -P EXAMPLE_PASSWORD -t "home/sensor/temperature" -m "22.5" -q 1 -r

Output:

22.5

10. View active background jobs and note the job ID:

$ jobs

Output:

[1]   Running                 mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "home/lights/sitting_room" &

11. Stop the job by specifying its ID:

$ kill %1

Output:

[1]   Done                    mosquitto_sub -u john_doe -P EXAMPLE_PASSWORD -t "home/lights/sitting_room" &

12. Confirm authentication is enforced by trying incorrect credentials:

$ mosquitto_pub -u john_doe -P VERY_WRONG_PASSWORD -t "home/sensor/temperature" -m "22.5" -q 1 -r

Output:

Connection error: Connection Refused: not authorised.
Error: The connection was refused.

The connection fails because Mosquitto can't authorize the user.

Next Steps

• Integrate Mosquitto with a programming language like Python, PHP, Ruby, or Go to build IoT applications
• Add TLS encryption to secure MQTT traffic in transit
• Configure per-topic ACLs to restrict which clients can publish or subscribe to specific topics
• Monitor broker health and traffic using Mosquitto's $SYS topics

For the full guide with additional tips, visit the original article on Vultr Docs.