Mosquitto TLS 安全 - 可以读取消息负载吗？

Question

I am running mosquitto broker on ubuntu on aws ec2, using TLS over port 8883. For example:

mosquitto_sub -h domain.com -t topic --cafile /etc/mosquitto/certs/ca.crt -p 8883

The client is esp8266 using TLS configuration.

Is it possible for someone to still intercept or read the outgoing or incoming mqtt message?

All communication is on port 8883 using a certificate.

Answer 1

(1) The most trivial answer with MQTT context is:

Use another MQTT client and subscribe to '#' to see all messages your broker receives from anywhere.

If you know the topics your esp8266 client is publishing or subscribed to, subscribe to all these with the other client (eg with 'mosquitto_sub').

The broker provides messages on the topic "topic" mentioned above to all subscribed clients, independent from their communication channel security.

This way you get the messages for the esp8266 with any other client. For example, if the unencrypted channel is not deactivated: mosquitto_sub -h domain.com -t topic -p 1883

TLS ensures encryption for the communication channel only, and not for the actual payload before putting it onto the channel between client and server.

(2) If (1) is not the expected answer and you rather want to wiretap the encrypted communication:

• Short answer is: no, not with trivial tooling; that's the purpose of TLS.

A good article for MQTT security fundamentals:https://www.hivemq.com/blog/mqtt-security-fundamentals-tls-ssl/

• Long answer is:

[Disclaimer: no assumptions about advanced abilities of 3rd parties]

The TLS communication is properly encrypted, and to decrypt the MQTT communication requires the session secrets client and server use after their successful TLS handshake.

A solutions requires you as the operator of the broker.

There is a short article about how to do it: https://adrianalin.gitlab.io/popsblog.me/posts/decrypt-mqtt-tls-traffic/

In essence:

• You can use Wireshark to eavesdrop the traffic, if you configure the session secrets there.
• To get the secrets you adjust and re-build mosquitto according the article, so that your broker print the session secrets.

(Whether you are able to setup this with root privileges on your EC2 instance in AWS, is another question).