MQTT消息服务

MQTT代理服务器Mosquitto实战

2018-07-19  本文已影响0人  徐际威

市面上有相当多的高质量MQTT代理,mosquitto是一个开源的轻量级的C实现,完全兼容MQTT 3.1和MQTT 3.1.1,配合mosquitto_pub和mosquitto_sub命令行工具,是一个比较适合MQTT入门的工具。
本文以mosquitto为例搭建MQTT服务,测试环境是阿里云(mqtt.youyangiot.com:47.94.221.244)和本地(192.168.100.101)Ubuntu 16.04.4 LTS系统。

1. 安装和使用

安装mosquitto及mosquitto-clients

sudo apt-get install software-properties-common python-software-properties
sudo apt-add-repository ppa:mosquitto-dev/mosquitto-ppa
sudo apt-get update
sudo apt-get install mosquitto
sudo apt-get install mosquitto-clients

测试订阅

mosquitto_sub -h 47.94.221.244 -d -t 'room-A/temperature'

测试发送

mosquitto_pub -h 47.94.221.244 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}'
2. SSL/TLS加密

MQTT是基于TCP的,默认情况通讯并不加密。如果需要传输敏感信息或者对设备进行反控,使用SSL/TLS几乎是必须的。
注意:在填写FQDN(Fully Qualified Domain Name)字段的时候最好用服务器域名,本文中使用mqtt.youyangiot.com。

生成CA证书和密钥

openssl req -new -x509 -days 365 -extensions v3_ca -keyout ca.key -out ca.crt

生成MQTT代理服务器的密钥

openssl genrsa -out server.key 2048

生成MQTT代理服务器的CSR(Certificate Signing Request)

openssl req -out server.csr -key server.key -new

通过CA签署CSR,生成MQTT代理证书

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

配置/etc/mosquitto/mosquitto.conf,启用SSL/TLS

listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

重启mosquitto服务

sudo service  mosquitto stop
sudo service  mosquitto start

测试订阅

mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt

测试发送

mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt
3. 客户端X509证书认证

MQTT代理在TLS握手成功之后可以继续发送客户端的X509证书来认证设备,如果设备不合法便可以中断连接,代价是需要有较好的证书创建流程和证书的管理系统。

生成MQTT设备的密钥

openssl genrsa -out client.key 2048

生成MQTT设备的CSR(Certificate Signing Request)

openssl req -out client.csr -key client.key -new

通过CA签署CSR,生成MQTT设备证书

openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365

配置/etc/mosquitto/mosquitto.conf,启用SSL/TLS

listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate true

重启mosquitto服务

sudo service  mosquitto stop
sudo service  mosquitto start

测试订阅

mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt --cert client.crt --key client.key

测试发送

mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt --cert client.crt --key client.key
4. 客户端用户名密码认证

Mosquitto支持用户名/密码认证方式,使用起来非常方便,不过由于用户名密码是以明文形式传输,最好配合SSL/TSL加密使用。

生成用户名和密码文件

cd /etc/mosquitto
sudo mosquitto_passwd -c passwd test

配置/etc/mosquitto/mosquitto.conf,启用SSL/TLS

listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
password_file /etc/mosquitto/passwd
allow_anonymous false

重启mosquitto服务

sudo service  mosquitto stop
sudo service  mosquitto start

测试订阅

mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt -u test -P 123456

测试发送

mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt -u test -P 123456
5. WebSocket支持

Mosquitto支持WebSocket的调用方式,为HTML类型的应用提供非常便利的方式。

配置/etc/mosquitto/mosquitto.conf,启用WebSocket

listener 8080
protocol websockets

如果要启用SSL/TLS WebSocket

listener 8081
protocol websockets
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

重启mosquitto服务

sudo service  mosquitto stop
sudo service  mosquitto start

JS在线客户端测试 paho JS client

websocket-js-online.png

python客户端WebSocket适配代码

client = mqtt.Client(transport='websockets')
client.connect(mqtt.youyangiot.com, 8080, 60)

参考文章


Eclipse Mosquitto - An open source MQTT broker
Eclipse Paho
MQTT入门篇

上一篇下一篇

猜你喜欢

热点阅读