Unable to use without usr/pwd after upgrading from 6.0.2 to 6.1.1

[bigboban]

Describe the issue you are experiencing

I have no usr/pwd config. This is config in plugin:

logins: []
require_certificate: false
certfile: fullchain.pem
keyfile: privkey.pem
customize:
  active: true
  folder: mosquitto
anonymous: true

2 main clients:

• zigbee2mqtt
• HA core

After upgrading communication is broken. Error messages are in addon log - see below.

I think this could be source of problem:

Remove mosquitto-auth-plug and replace with mosquitto-go-auth 1.8.2

But i don't see any info about breaking changes.

What type of installation are you running?

Home Assistant Supervised

Which operating system are you running on?

Other (e.g., Raspbian/Raspberry Pi OS/Fedora)

Which add-on are you reporting an issue with?

Mosquitto broker

What is the version of the add-on?

6.1.1

Steps to reproduce the issue

1. Use "no usr/pwd" (anon) config of plugin
2. upgrade to 6.1.1
3. errors in log, mqtt communication broken
   ...

Anything in the Supervisor logs that might be useful for us?

No response

Anything in the add-on logs that might be useful for us?

1651863797: New connection from xx.xx.xx.xx:33658 on port 1883.
error: received null username or password for unpwd check
1651863797: Client <unknown> disconnected, not authorised.

Additional information

No response

[Praetorian-hub]

I'm having the same issue, restarting does not correct it. anonymous logins no longer working regardless of the option set in the config.

[glennswest]

Same issue as well.

[glennswest]

Ok, I did the "bad" thing. I downgraded(Restored backup) to MQTT 6.0.1, with 2022.5 HA. And turned off the auto-update. My device(s) are working fine again.

[damclarkd]

Like others here, I am having the same un/pw issue on 6.1.1. I have 6.0.2 installed again and it is back to working for me.

[Praetorian-hub]

Yeah I've also restored from backup, running 6.0.1 on HA core 2022.5.2 and able to use MQTT Clients again. This update really should have included the breaking changes in the notification.

…

On Sun, 8 May 2022, 12:40 pm damclarkd, ***@***.***> wrote: Like others here, I am having the same un/pw issue on 6.1.1. I have 6.0.2 installed again and it is back to working for me. — Reply to this email directly, view it on GitHub <#2483 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AUASLMW6K77SH2ICL2GDVVTVI4SRZANCNFSM5VJAI4HA> . You are receiving this because you commented.Message ID: ***@***.***>

[phk-r]

Same problem here. Downgraded from 6.1.1 to 6.0.2 and now it works again.

[gmobilize]

Can confirm the same issue, downgrading fixes the problem, this should be checked as many people are facing critical issues regarding this.

[bdewitte123]

Same issue here!

[mdegat01]

I noted this in another thread but one of the big breaking changes of #2007 was to remove support for anonymous logins for version 6.0.0 of this addon. However it appears that by mistake anonymous logins were actually enabled by default for everyone. This is because the line allow_anonymous was simply removed from the config without realizing that mosquitto enabled anonymous logins by default in v1.6.

In v2.0+ of Mosquitto they corrected security issue with their own breaking change - anonymous logins are now disabled by default. Which means version 6.1.0 of this addon accidently implemented the breaking change that was supposed to be in there for v6.0.0 already.

I would've noted this in the release notes had I realized this but I thought anonymous logins were already removed. That being said, since they were already supposed to be gone this is a correction of a bug. Anonymous logins are disabled in the addon as it is bad security practice.

If you really want to enable them on your instance then you can do so with the customize option. But I'd definitely advise against it.

[bdewitte123]

I had tried the solution with the customize option by adding the "allow_anonymous true" in a file under /share/mosquitto.
Unfortunately this doesn't seem to work...
The file is picked up alright, but my devices still can't connect.

Any thoughts?

[s6-init] making user provided files available at /var/run/s6/etc...exited 0. [s6-init] ensuring user provided files have correct perms...exited 0. [fix-attrs.d] applying ownership & permissions fixes... [fix-attrs.d] done. [cont-init.d] executing container initialization scripts... [cont-init.d] mosquitto.sh: executing... [08:58:56] INFO: SSL is not enabled [cont-init.d] mosquitto.sh: exited 0. [cont-init.d] nginx.sh: executing... [cont-init.d] nginx.sh: exited 0. [cont-init.d] done. [services.d] starting services [services.d] done. [08:58:57] INFO: Starting NGINX for authentication handling... [08:58:58] INFO: Starting mosquitto MQTT broker... 1652165938: Loading config file /share/mosquitto/acl.conf 1652165938: Loading config file /share/mosquitto/anonymous.conf 1652165938: Warning: Mosquitto should not be run as root/administrator. [08:58:59] INFO: Successfully send discovery information to Home Assistant. 1652165938: mosquitto version 2.0.11 starting 1652165938: Config loaded from /etc/mosquitto/mosquitto.conf. 1652165938: Loading plugin: /usr/share/mosquitto/go-auth.so 1652165938: ├── Username/password checking enabled. 1652165938: ├── TLS-PSK checking enabled. 1652165938: └── Extended authentication not enabled. 1652165938: Opening ipv4 listen socket on port 1883. 1652165938: Opening ipv6 listen socket on port 1883. 1652165938: Opening websockets listen socket on port 1884. 1652165938: mosquitto version 2.0.11 running 1652165938: New connection from 127.0.0.1:35938 on port 1883. 1652165938: Client <unknown> closed its connection. 1652165939: New connection from 192.168.10.196:56852 on port 1883. error: received null username or password for unpwd check [08:58:59] INFO: Successfully send service information to the Supervisor. 1652165939: Client <unknown> disconnected, not authorised. 1652165940: New connection from 192.168.10.95:63075 on port 1883. error: received null username or password for unpwd check 1652165940: Client <unknown> disconnected, not authorised. 1652165940: New connection from 192.168.10.103:54500 on port 1883. error: received null username or password for unpwd check 1652165940: Client <unknown> disconnected, not authorised. 1652165941: New connection from 192.168.10.100:56067 on port 1883. error: received null username or password for unpwd check 1652165941: Client <unknown> disconnected, not authorised. 1652165941: New connection from 192.168.10.130:50892 on port 1883. error: received null username or password for unpwd check 1652165941: Client <unknown> disconnected, not authorised

[bigboban]

@mdegat01 wrote: If you really want to enable them on your instance then you can do so with the customize option.

I think it is not true, because doc has no "anonymous" mode anymore.

And i have to reply to "anon mode is dangerous". Why? I have router, firewall, and my secure LAN. Why double-secure servers inside LAN? Do you lock rooms inside locked house? NO! Yes it is safer to lock also room in locked house. But who do it? It is nonsense.

So let users to decide and bring anon mode back please.

[mdegat01]

I honestly thought the customize option would work. I'm trying to figure out why now but if it doesn't then there's four options available:

1. Don't upgrade
2. Fork the addon or copy the source code locally into /addons. Add anonymous login support there and maintain that copy
3. Deploy a your own instance of Mosquitto or some other MQTT broker and connect everything to it
4. Change your clients to authenticate with the broker

Formal anonymous login support is not going to be added back as it is a bad practice from a security perspective. If you can figure out a way to do it with customize alone you're welcome to but the addon isn't going to make it easier.

So let users to decide and bring anon mode back please.

This option was removed from the addon almost a year ago. It hasn't been in the doc or schema of the addon since it was removed in #2007 on May 21st, 2021 for v6.0.0. It's not going to be added back.

If you've been using it you either haven't updated to v6.0.0 or have been getting a warning about it in your log for a year since you have an unrecognized option in your addon config that doesn't do anything. I explained the real reason anonymous logins worked for the past year above, it was a bug and now it is fixed.

Bear in mind that addons are preconfigured common software that many HA users want/need. They are supposed to have a small set of configurable options based on what is tested and supported. Many decisions are made for users based on currently published best practices for that piece of software.

If you don't like or agree with some of those decisions that is fine, you can run any software you want at your house. You just won't necessarily be able to use the addon. In this case if you want to use anonymous logins you'll need to take one of the four options I laid out above.

[damclarkd]

I honestly thought the customize option would work. I'm trying to figure out why now but if it doesn't then there's four options available:

1. Don't upgrade
2. Fork the addon or copy the source code locally into /addons. Add anonymous login support there and maintain that copy
3. Deploy a your own instance of Mosquitto or some other MQTT broker and connect everything to it
4. Change your clients to authenticate with the broker

Formal anonymous login support is not going to be added back as it is a bad practice from a security perspective. If you can figure out a way to do it with customize alone you're welcome to but the addon isn't going to make it easier.

So let users to decide and bring anon mode back please.

This option was removed from the addon almost a year ago. It hasn't been in the doc or schema of the addon since it was removed in #2007 on May 21st, 2021 for v6.0.0. It's not going to be added back.

If you've been using it you either haven't updated to v6.0.0 or have been getting a warning about it in your log for a year since you have an unrecognized option in your addon config that doesn't do anything. I explained the real reason anonymous logins worked for the past year above, it was a bug and now it is fixed.

Bear in mind that addons are preconfigured common software that many HA users want/need. They are supposed to have a small set of configurable options based on what is tested and supported. Many decisions are made for users based on currently published best practices for that piece of software.

If you don't like or agree with some of those decisions that is fine, you can run any software you want at your house. You just won't necessarily be able to use the addon. In this case if you want to use anonymous logins you'll need to take one of the four options I laid out above.

Mike, I am currently at stage #1 of your response after a downgrade back to 6.0.2. My attempts at #4 have been met with failure. Similar to issue #2474 I keep getting null username/pswd errors when trying to authenticate. This is using websockets on 1884. Might there still be an issue with authentication or using websockets with authentication?
Cheers.