{
 "slug": "mosquitto",
 "name": "Mosquitto",
 "tagline": "MQTT broker with a TLS-only listener, password authentication and topic ACLs",
 "category": "messaging",
 "use_cases": [
  "mqtt",
  "iot-messaging",
  "pub-sub"
 ],
 "aliases": [
  "eclipse mosquitto"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Eclipse Foundation AISBL",
  "url": "https://mosquitto.org",
  "license": "EPL-2.0 OR BSD-3-Clause",
  "license_url": "https://github.com/eclipse-mosquitto/mosquitto/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   8883
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "2.1.2",
   "last_build": "2026-08-17",
   "offer_id": "mosquitto",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:mosquitto:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.mosquitto?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/mosquitto/",
  "json": "https://lynxroute.com/products/mosquitto/product.json"
 },
 "release_notes": [
  {
   "version": "2.1.2",
   "title": "Mosquitto 2.1.2 - Initial release (August 2026)",
   "notes": "* Eclipse Mosquitto 2.1.2 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* TLS-only MQTT listener on 8883; no cleartext 1883 listener in the image\n* Anonymous connections refused; two ACL-scoped users with per-instance passwords generated at first launch\n* Per-instance self-signed TLS certificate, reissued automatically if the instance address changes\n* Retained and queued messages persist across a reboot\n* UFW firewall pre-configured (ports 22 and 8883 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-17"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.1.2",
   "azure": "2026-08-17"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer mosquitto --plan payg-gen2\naz vm create -g my-rg -n mosquitto --size Standard_D2s_v3 \\\n  --image lynxroute:mosquitto:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Eclipse Mosquitto is an open-source message broker implementing MQTT 5.0, 3.1.1 and 3.1 - the lightweight publish/subscribe protocol that most IoT devices, industrial sensors, home-automation controllers and telemetry pipelines speak. Publishers send messages to a topic, subscribers receive everything on the topics they care about, and the broker keeps track in between. It is a single small C daemon with no database, no cache and no runtime to manage, which is why it runs equally well on a gateway at the edge and as the central broker for a fleet. Feature set: QoS levels 0, 1 and 2, retained messages, last-will-and-testament notifications, shared subscriptions, topic aliases, per-topic access control, and persistent sessions that queue messages for devices while they are offline. It persists retained and queued messages to local disk, so a restart does not lose them. Any standard MQTT client works with it - Paho, MQTT.js, HiveMQ clients, Home Assistant, Node-RED, Telegraf, and the mosquitto_pub / mosquitto_sub tools included in this image. EPL-2.0 OR BSD-3-Clause license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* TLS-only listener on 8883 - there is no cleartext 1883 listener in this image at all, so a plain MQTT client is refused at the handshake rather than silently downgraded. MQTT sends the password inside the CONNECT packet, so a cleartext fallback would put the credential on the wire\n* Anonymous connections refused - allow_anonymous is false and no mapping hands an unauthenticated client a real identity\n* Two ACL-scoped users created at first launch - a messaging user with read and write on your topics, and a monitoring user restricted to the broker statistics tree, so a metrics collector never holds a credential that can publish\n* Per-instance credentials, stored hashed - the distributed image contains no password file at all; passwords are generated on your own instance\n* Per-instance TLS certificate - issued on your instance, carrying its own address, and reissued automatically if that address changes. The private key is never part of the image\n* Sandboxed service - the broker runs unprivileged on a read-only filesystem apart from its own data and log directories, and cannot rewrite its own password file or access rules\n* UFW firewall pre-configured - inbound limited to SSH 22 and MQTT over TLS 8883, nothing else\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nEclipse and Mosquitto are trademarks of Eclipse Foundation AISBL."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}