Secure the SynoCommunity Mosquitto broker in 2023

mosquitto-2-0-15

Recently I was upgrading packages on my Synology NAS, with one of those packages being SynoCommunity Mosquitto Broker. Shortly after the upgrade, I noticed the MQTT based devices in my Home Assistant server went off-line. It was then I realised that the upgrade to 2.0.15 had reset the MQTT username and password. When I checked out my previous post on how to add a user and password to the SynoCommunity Mosquitto Broker, I noted that a few things have changed slightly with this latest version, so I will document the current process below.

This post assumes you already have the SynoCommunity Mosquitto package running on your NAS and, like me, you need to re-enable the password. If you need to install the plugin on your NAS from scratch, follow Part 1 of my previous guide here but come back to this post for part 2.

First, we need to enable the SSH terminal from The Synology control panel. Also head over to the Synology package centre and stop the Mosquitto broker.

Now we will download putty and connect to your NAS. Add the IP address of your NAS in the “Host Name” box of putty, then click open (all other settings can remain as default).

If a security warning comes up, click ok and then type your NAS username and password in the terminal window when prompted.

If you have successfully logged in, you will be at a Linux prompt that looks like yourusername@NASNAME:~$

NOTE: The following commands in the boxes below can be copied and then pasted into putty by clicking the right mouse button on the putty window once the command is copied to the clipboard.

Now we will change to the correct directory with

cd /var/packages/mosquitto/var

To check you are in the right directory you can enter the dir command like below, and you will see similar to the below files

putty-mosquitto-dir

First we will switch to the root user with the following command, you will have to enter your password again

sudo -i

Now we will set up a new MQTT password with the following command

/var/packages/mosquitto/target/bin/mosquitto_passwd -b /var/packages/mosquitto/var/passwd user password

You will be asked for your new password twice

Now we will edit Mosquitto’s config file to use the new password with Synology’s built-in vi text editor.  (see the bottom of this post for useful vi commands)

 vi mosquitto.conf

Around line 234 find the line that starts with listener 1883 and delete the 127.0.0.1 ip address after it if it exists

listener 1883

Around line 532 we need to change allow anonymous from true to false

Around line 553 you will need to find the below password_file text and remove the # from in front of it.

password_file /var/packages/mosquitto/var/passwd

Now that this is done, you can close putty and head back to your Synology Package Center and restart the MQTT broker and test with Home Assistant or a tool like MQTT Explorer. Also, don’t forget to turn off SSH from the Control Panel.

Note that I made a few errors before getting these instructions together, uninstalling the plugin and ticking off wipe the installation files and the reinstalling was a quick easy fix to get back to a vanilla installation of the SynoCommunity Mosquitto package.

Useful vi Commands

quit vi with no changes: hit Esc then : (colon) then type q! then enter

quit vi saving changes: hit Esc then : (colon) then type wq then enter

adding text: hit the insert or I key to get into insert mode and hit Esc when done

delete a character:  place the cursor on where you want to delete and hit Delete or X to delete the character