Catalog / Messaging & streaming

Mosquitto

MQTT broker with a TLS-only listener, password authentication and topic ACLs

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace2.1.2↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.1.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-17Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseEPL-2.0 OR BSD-3-Clause
UpstreamEclipse Foundation AISBL
Machine-readableproduct.json · catalog.json
What is Mosquitto

Eclipse Mosquitto is an open-source message broker implementing MQTT 5.0, 3.1.1 and 3.1 - the lightweight publish/subscribe protocol that most IoT devices, industrial sensors, home-automation controllers and telemetry pipelines speak. Publishers send messages to a topic, subscribers receive everything on the topics they care about, and the broker keeps track in between. It is a single small C daemon with no database, no cache and no runtime to manage, which is why it runs equally well on a gateway at the edge and as the central broker for a fleet. Feature set: QoS levels 0, 1 and 2, retained messages, last-will-and-testament notifications, shared subscriptions, topic aliases, per-topic access control, and persistent sessions that queue messages for devices while they are offline. It persists retained and queued messages to local disk, so a restart does not lose them. Any standard MQTT client works with it - Paho, MQTT.js, HiveMQ clients, Home Assistant, Node-RED, Telegraf, and the mosquitto_pub / mosquitto_sub tools included in this image. EPL-2.0 OR BSD-3-Clause license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • TLS-only listener on 8883 - there is no cleartext 1883 listener in this image at all, so a plain MQTT client is refused at the handshake rather than silently downgraded. MQTT sends the password inside the CONNECT packet, so a cleartext fallback would put the credential on the wire
  • Anonymous connections refused - allow_anonymous is false and no mapping hands an unauthenticated client a real identity
  • Two ACL-scoped users created at first launch - a messaging user with read and write on your topics, and a monitoring user restricted to the broker statistics tree, so a metrics collector never holds a credential that can publish
  • Per-instance credentials, stored hashed - the distributed image contains no password file at all; passwords are generated on your own instance
  • Per-instance TLS certificate - issued on your instance, carrying its own address, and reissued automatically if that address changes. The private key is never part of the image
  • Sandboxed service - the broker runs unprivileged on a read-only filesystem apart from its own data and log directories, and cannot rewrite its own password file or access rules
  • UFW firewall pre-configured - inbound limited to SSH 22 and MQTT over TLS 8883, nothing else
  • fail2ban and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Eclipse and Mosquitto are trademarks of Eclipse Foundation AISBL.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/mosquitto-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer mosquitto --plan payg-gen2
az vm create -g my-rg -n mosquitto --size Standard_D2s_v3 \
  --image lynxroute:mosquitto:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Mosquitto 2.1.2 - Initial release (August 2026)

Azure · 2026-08-17
  • Eclipse Mosquitto 2.1.2 on Ubuntu 24.04 LTS
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • TLS-only MQTT listener on 8883; no cleartext 1883 listener in the image
  • Anonymous connections refused; two ACL-scoped users with per-instance passwords generated at first launch
  • Per-instance self-signed TLS certificate, reissued automatically if the instance address changes
  • Retained and queued messages persist across a reboot
  • UFW firewall pre-configured (ports 22 and 8883 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced