mosquitto-go-auth icon indicating copy to clipboard operation
mosquitto-go-auth copied to clipboard

mosquitto_passwd should not be part of the docker image

Open ccvca opened this issue 2 years ago • 1 comments

mosquitto_passwd should not be part of the docker image, as the generated passwords are not compatible.

https://github.com/iegomez/mosquitto-go-auth/blob/9e9d90b676c97ec069bd39d96fa2235269f83932/Dockerfile#L116

From my point of view, this should be either omitted, or replaced with a shell script, which outputs, something like this: mosquitto_passwd is not supported by mosquitto-go-auth, use /mosquitto/pw instead

PS: If someone is iterested, the hashed passwords are nearly compatible, when using a recent mosquitto_passwd with the default settings, only the PBKDF2 prefix is missing, so this $7$101$BZwdvumJzWygl4Bp$nO25BJ4fb7r8So1KAqeoAo... must be edited to this PBKDF2$7$101$BZwdvumJzWygl4Bp$nO25BJ4fb7r8So1KAqeoAo....

ccvca avatar Mar 14 '23 12:03 ccvca

Hey, @ccvca, thanks for reporting this.

I was taking a look and found this old issue: https://github.com/iegomez/mosquitto-go-auth/issues/115 I'm not sure if I just forgot to address it or was a bit reluctant to do so at the time. The man pages still state Passwords are stored in a similar format to [crypt](https://linux.die.net/man/3/crypt)(3). :shrug: So I don't know, It's been a long while since it was posted.

As you say, right now crypto(3) strategy used by mosquitto_passwd is not supported and the image most likely doesn't need to ship with it, I never thought it'd be a source for confusion given the docs. If you feel strongly about removing or addressing it, I'd welcome a PR for adding support or simply getting rid of the utility since I'm not actively working on the plugin itself and prefer to review contributions instead.

iegomez avatar Mar 16 '23 04:03 iegomez