search

iegomez / mosquitto-go-auth

Auth plugin for mosquitto.
MIT License
519 stars 170 forks source link

mosquitto_passwd should not be part of the docker image #269

Open ccvca opened 1 year ago

ccvca commented 1 year ago

mosquitto_passwd should not be part of the docker image, as the generated passwords are not compatible.

https://github.com/iegomez/mosquitto-go-auth/blob/9e9d90b676c97ec069bd39d96fa2235269f83932/Dockerfile#L116

From my point of view, this should be either omitted, or replaced with a shell script, which outputs, something like this: mosquitto_passwd is not supported by mosquitto-go-auth, use /mosquitto/pw instead

PS: If someone is iterested, the hashed passwords are nearly compatible, when using a recent mosquitto_passwd with the default settings, only the PBKDF2 prefix is missing, so this $7$101$BZwdvumJzWygl4Bp$nO25BJ4fb7r8So1KAqeoAo... must be edited to this PBKDF2$7$101$BZwdvumJzWygl4Bp$nO25BJ4fb7r8So1KAqeoAo....

iegomez commented 1 year ago

Hey, @ccvca, thanks for reporting this.

I was taking a look and found this old issue: https://github.com/iegomez/mosquitto-go-auth/issues/115 I'm not sure if I just forgot to address it or was a bit reluctant to do so at the time. The man pages still state Passwords are stored in a similar format to [crypt](https://linux.die.net/man/3/crypt)(3). :shrug: So I don't know, It's been a long while since it was posted.

As you say, right now crypto(3) strategy used by mosquitto_passwd is not supported and the image most likely doesn't need to ship with it, I never thought it'd be a source for confusion given the docs. If you feel strongly about removing or addressing it, I'd welcome a PR for adding support or simply getting rid of the utility since I'm not actively working on the plugin itself and prefer to review contributions instead.