From 3eeb2aadca878ea5c542477d34cbf29bc4fd133a Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 8 Jul 2026 10:10:52 +0200 Subject: [PATCH] mosquitto: add DoS/resource guards (security review, broker hardening) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The broker had no resource limits at all. It's now load-bearing and reachable by ~30 untrusted IoT devices (the Shelly fleet) + the edge host on a single 256Mi replica, so a misbehaving/compromised client is a real DoS vector. Add: - message_size_limit 1048576 — MQTT permits up to 256 MB per publish; one such message would OOM the broker. Every legit payload here (HA discovery, Shelly/open3e/evcc telemetry) is <10 KB. - persistent_client_expiration 1d — reap abandoned persistent sessions (the edge bridges reconnect within seconds, so they never hit this). - max_connections 200 per listener — bound a connection flood (~40 clients today; generous headroom, not the previous unlimited). All values chosen well above real usage, so no legit client is affected. Apply: the ConfigMap has no checksum annotation, so Flux won't restart the pod on its own — needs `kubectl -n home-assistant rollout restart deploy/mosquitto` (brief reconnect; clients auto-reconnect) after reconcile. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../apps/home-assistant/mosquitto-config.yaml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/kubernetes/apps/home-assistant/mosquitto-config.yaml b/kubernetes/apps/home-assistant/mosquitto-config.yaml index 74953095..a7b3d7e2 100644 --- a/kubernetes/apps/home-assistant/mosquitto-config.yaml +++ b/kubernetes/apps/home-assistant/mosquitto-config.yaml @@ -12,11 +12,31 @@ data: log_type warning log_type notice + # --- Resource / DoS guards ------------------------------------------ + # The broker is now load-bearing and reachable by ~30 untrusted IoT + # devices (the Shelly fleet) plus the edge host, on a single 256Mi + # replica. Bound what a misbehaving or compromised client can do: + # message_size_limit caps a single publish (MQTT allows up to 256 MB — + # one such message would OOM the broker). Every + # legit payload here (HA discovery, Shelly/open3e/ + # evcc telemetry) is well under 10 KB. + # persistent_client_expiration reaps abandoned persistent sessions so + # their queued state can't accumulate (the edge + # bridges reconnect within seconds, so they never + # hit this). + # max_connections (per listener) bounds a connection flood (~40 clients + # today; 200 is generous headroom, not unlimited). + message_size_limit 1048576 + persistent_client_expiration 1d + # Omit the bind address so mosquitto listens on all interfaces # (v4 + v6 wildcard). With a bind address of 0.0.0.0 the broker # accepts v4 only and refuses TCP on the v6 LB VIP fd99::81. listener 1883 + max_connections 200 + listener 8883 + max_connections 200 certfile /mosquitto/tls/tls.crt keyfile /mosquitto/tls/tls.key -- 2.54.0