DietPi-Software | Mosquitto: Updates for v2 and other enhancements #4223
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
+ DietPi-Software | Mosquitto: Since the Bullseye suite of the official repository does not yet exist, use Buster instead + DietPi-Software | MPD: Simplify systemd service runtime directory creation by using the RuntimeDirectory setting + DietPi-Software | Mosquitto: Restore pre-v2.0 behaviour by explicitly adding the port 1883 listener without IP binding, as by default it now binds to the loopback IP: #4133 + DietPi-Software | Mosquitto: Restore pre-v2.0 behaviour by explicitly allowing anonymous client connections. We might switch to a user+password authenticated default, using the global software password, but for now restoring the previous default should be fine. + DietPi-Software | Mosquitto: Always use our own systemd unit, which allows us to simplify and align it with other units we ship. + DietPi-Software | Mosquitto: Disable PID and log file, both not required when using the systemd unit as it can track the service status directly and logs can be viewed via journalctl then. This allows to simplify the systemd unit and start it as mosquitto user directly, instead of having the daemon forking itself as mosquitto user. + DietPi-Software | Mosquitto: Do not automatically restart the service on failure. Generally we think that a failed service has a reason that should be recognised and investigated ASAP before starting it again, whether it is OOM failure, filesystem/database corruption or a DDoS attack and such things, where an automatic restart might cause further damage. When services restart automatically (up to five times by default in a certain time), they do not only mess logs, making debugging difficult, but also as the service can stay up, an urgent reason for the crash might be recognised with much delay. When a service is that important that it must stay even when the server is running into troubles that lead to service crashes, then this should be configured only manually by admins that do know what they do.
+ CHANGELOG | Mosquitto: Since v2, by default remote connections and no unauthenticated requests are possible anymore. On fresh installs and reinstalls, we'll enable remote connections, but create a password file, so that MQTT clients need to authenticate with the "dietpi" user and the global software password by default.
+ DietPi-Software | ownCloud/Nextcloud: Instead of "<omitted>", show "XXXX" as replacement for passwords during CLI install with the amount of Xes matching the length of the password + DietPi-Software | Mosquitto: Switch from unauthenticated requests to authenticated requests via password file by default, with "mosquitto" username and global software password. Use umask to have it created with strict permissions, as by default it's 644, i.e. world-readable, even that passwords are sha512-pbkdf2-hashed. Grant write access to root only (default) but read access to "mosquitto" so that it can read it even when starting as "mosquitto" in the first place (instead of re-forking from "root" to "mosquitto").
MichaIng
added
Solution available 🥂
Joulinar
approved these changes
Apr 4, 2021
ravenclaw900
approved these changes
Apr 4, 2021
|
Related documentation changes: MichaIng/DietPi-Docs#413 |
MichaIng
removed
Solution available 🥂
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status: Review
Commit list/description: