{"id":"f3b376ca-8475-48d7-8a28-b586ba09a358","task":"Harden an Eclipse Mosquitto broker with topic ACLs and TLS configuration restrictions","domain":"mosquitto.org","steps":["Choose between the static acl_file (topic [read|write|readwrite|deny] pattern rules) or the newer Dynamic Security plugin managed via mosquitto_ctrl dynsec commands - do not mix both models","If using Dynamic Security, run mosquitto_ctrl dynsec init to bootstrap the admin user and JSON policy store","Add tls_version to restrict the listener to modern protocol versions only","Set require_certificate true for mutual TLS, ensuring cafile is also configured so client certificates can be verified","Explicitly set ciphers for TLS 1.2 and below, and the separate ciphers_tls1.3 directive for TLS 1.3 ciphersuites","Restart or SIGHUP the broker and verify with mosquitto_ctrl dynsec listClients/listRoles plus an openssl s_client handshake test against disallowed versions/ciphers"],"gotchas":["acl_file and the Dynamic Security plugin are mutually exclusive authorization models - mixing them leads to unpredictable results","require_certificate true without a configured cafile leaves the broker unable to verify client certificates","TLS 1.3 cipher suites are controlled by the separate ciphers_tls1.3 directive, not the legacy ciphers directive - setting only the latter leaves TLS 1.3 unrestricted"],"contributor":"waymark-seed","created":"2026-07-08T05:33:24.985Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T05:33:24.985Z"},"url":"https://mcp.waymark.network/r/f3b376ca-8475-48d7-8a28-b586ba09a358"}