Mosquitto auth plugin password hash integration

ChirpStack Application Server
#1

Hi @brocaar, thank you so much for this awesome project. I’m having an issue when integrating the mosquitto auth plugin.
The Hash generated by the lora app server is incompatible with the hash generated by the plugin. Can you please point me in the right direction?

I’am already changed the source code to use SHA256, iterations and other parameters used in the mosquitto auth plugin.

thanks in advance

#2

You need to compile the auth plugin with the RAW_SALT flag. From the mosquitto auth docs:

Note that the salt by default will be taken as-is (thus it will not be base64 decoded before the validation). In case your own implementation uses the raw bytes when hashing the password and base64 is only used for display purpose, compile this project with the -DRAW_SALT flag (you could add this in the config.mk file to CFG_CFLAGS).

See https://github.com/brocaar/loraserver-setup for how it can be implemented (https://github.com/brocaar/loraserver-setup/tree/master/roles/mosquitto-auth-plug in specific).

1 Like
#3

Yes, I cloned both repositories and compiled manually both. With the config.mk with the -DRAW_SALT. When i perform a connection to the MQTT broker (e.g. mqtt sub -t ‘#’ -h ‘163.172.156.64’ -v -u ‘admin’ -P ‘admin’ ) the mosquitto shuts down the connection with the following error:

Blockquote Set 25 08:54:24 scw-2caf11 mosquitto[17559]: 1506329664: New client connected from ::1 as b0f3fb2c-5941-4479-9b4c-059d0910bf25 (c1, k30).
Set 25 08:54:39 scw-2caf11 mosquitto[17559]: 1506329679: New connection from ::1 on port 1883.
Set 25 08:54:39 scw-2caf11 mosquitto[17559]: 1506329679: New client connected from ::1 as 25b56949-4b7f-4a92-8edf-363d1e10a4af (c1, k30).
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: New connection from 62.28.178.18 on port 1883.
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: |-- mosquitto_auth_unpwd_check(admin)
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: |-- ** checking backend postgres
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: |-- GETTING USERS: admin
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: |-- ERROR: permission denied for relation user
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: |-- getuser(admin) AUTHENTICATED=0 by none
Set 25 08:56:05 scw-2caf11 mosquitto[17559]: 1506329765: Socket error on client , disconnecting.

#4

Hi, @brocaar. I figured it out. Many thanks for your help

#5

Could you let us know what the issue was? It might be helpful to others facing the same issue :slight_smile:

#6

I cant explain the exact issue, but for me, the solution was to compile without the flag and then recompile with the flag again. After that all worked fine :slight_smile:

1 Like