Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Eclipse Mosquitto is a single-binary C message broker implementing MQTT 5.0, 3.1.1 and 3.1, the publish/subscribe protocol most IoT devices and telemetry pipelines speak. This Lynxroute build is hardened and ready out of the box: a TLS-only listener on 8883 with no cleartext port at all, anonymous connections refused, two ACL-scoped users with per-instance passwords generated at first launch, a per-instance TLS certificate, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
EPL-2.0 OR BSD-3-Clause license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS ECLIPSE MOSQUITTO
Eclipse Mosquitto is an open-source message broker implementing MQTT 5.0, 3.1.1 and 3.1 - the lightweight publish/subscribe protocol that most IoT devices, industrial sensors, home-automation controllers and telemetry pipelines speak. Publishers send messages to a topic, subscribers receive everything on the topics they care about, and the broker keeps track in between. It is a single small C daemon with no database, no cache and no runtime to manage, which is why it runs equally well on a gateway at the edge and as the central broker for a fleet. Feature set: QoS levels 0, 1 and 2, retained messages, last-will-and-testament notifications, shared subscriptions, topic aliases, per-topic access control, and persistent sessions that queue messages for devices while they are offline. It persists retained and queued messages to local disk, so a restart does not lose them. Any standard MQTT client works with it - Paho, MQTT.js, HiveMQ clients, Home Assistant, Node-RED, Telegraf, and the mosquitto_pub / mosquitto_sub tools included in this image. EPL-2.0 OR BSD-3-Clause license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- TLS-only listener on 8883 - there is no cleartext 1883 listener in this image at all, so a plain MQTT client is refused at the handshake rather than silently downgraded. MQTT sends the password inside the CONNECT packet, so a cleartext fallback would put the credential on the wire
- Anonymous connections refused - allow_anonymous is false and no mapping hands an unauthenticated client a real identity
- Two ACL-scoped users created at first launch - a messaging user with read and write on your topics, and a monitoring user restricted to the broker statistics tree, so a metrics collector never holds a credential that can publish
- Per-instance credentials, stored hashed - the distributed image contains no password file at all; passwords are generated on your own instance
- Per-instance TLS certificate - issued on your instance, carrying its own address, and reissued automatically if that address changes. The private key is never part of the image
- Sandboxed service - the broker runs unprivileged on a read-only filesystem apart from its own data and log directories, and cannot rewrite its own password file or access rules
- UFW firewall pre-configured - inbound limited to SSH 22 and MQTT over TLS 8883, nothing else
- fail2ban and AppArmor pre-configured
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Eclipse and Mosquitto are trademarks of Eclipse Foundation AISBL.
Highlights
- Mosquitto security baked in: TLS-only listener on 8883 with no cleartext port at all, anonymous connections refused, two ACL-scoped users with per-instance passwords generated at first launch, a per-instance TLS certificate that never ships in the image, and UFW limited to SSH and MQTT over TLS.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Standards-only MQTT for IoT and telemetry: MQTT 5.0, 3.1.1 and 3.1, QoS 0-2, retained messages, last-will, shared subscriptions, and persistent sessions that queue messages for offline devices. Works with any standard client - Paho, MQTT.js, Home Assistant, Node-RED, Telegraf. EPL-2.0 OR BSD-3-Clause license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.small Recommended | $0.03 |
t3.large | $0.05 |
t3.medium | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour for the EC2 instance size you run this hardened MQTT broker on. Four instance options are available: t3.small, t3.medium, and t3.large from the burstable t3 family, plus m6i.large. They differ by compute, memory, and network capacity, so hourly rates rise with the resources each instance provides. Pick the size that fits your workload. Billing runs on usage, so you pay only for the hours the instance runs. All four options deliver the same hardened, pre-configured image.
Top-of-mind questions for buyers
You pay for a security-hardened MQTT broker image running on the EC2 instance size you choose. The t3.small, t3.medium, and t3.large use the burstable t3 family, while m6i.large offers steady compute. Each option differs in CPU, memory, and network capacity, so higher-resource instances carry higher hourly rates.
Hourly software charges accrue only while the instance runs. Stopping the instance halts the per-hour software billing. Underlying AWS storage fees for the attached disk may still apply while the instance is stopped, but those are separate from this listing's software charge.
Every instance ships the same hardened Ubuntu 24.04 LTS base with CIS Level 1 benchmarks applied. It includes CVE scanning results, a CycloneDX SBOM, and a CIS Conformance Report bundled inside. Unique credentials generate at first boot, so no shared passwords or default secrets exist.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Mosquitto 2.1.2 - Initial release (August 2026)
- Eclipse Mosquitto 2.1.2 on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- TLS-only MQTT listener on 8883; no cleartext 1883 listener in the image
- Anonymous connections refused; two ACL-scoped users with per-instance passwords generated at first launch
- Per-instance self-signed TLS certificate, reissued automatically if the instance address changes
- Retained and queued messages persist across a reboot
- UFW firewall pre-configured (ports 22 and 8883 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.small recommended)
- Open Security Group - allow TCP 8883 from the networks your devices connect from, and TCP 22 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/mosquitto-credentials.txt
- Subscribe from the instance: mosquitto_sub -h localhost -p 8883 --cafile /etc/mosquitto/certs/server-cert.pem -u app -P <password> -t 'demo/#' -v
- Publish from a second shell: mosquitto_pub -h localhost -p 8883 --cafile /etc/mosquitto/certs/server-cert.pem -u app -P <password> -t demo/hello -m 'hello world'
- Connect a remote client: copy /etc/mosquitto/certs/server-cert.pem to the client and point it at <PUBLIC_IP> port 8883 with the same user and password
TLS is mandatory on 8883. There is no cleartext 1883 listener, so a plain MQTT client is refused at the handshake. Anonymous connections are refused.
Two users are created on first launch: 'app' has read and write on your application topics; 'monitor' has read access to the $SYS broker statistics tree only. Both passwords are in /root/mosquitto-credentials.txt.
The TLS certificate is self-signed and generated on your instance, so clients must be pointed at it with --cafile. For production, replace it with a certificate from your own CA: put the certificate and key in /etc/mosquitto/certs (key mode 0600, owned by mosquitto), then run sudo mosquitto --test-config -c /etc/mosquitto/mosquitto.conf and sudo systemctl restart mosquitto.
Add a user per device rather than sharing 'app': sudo mosquitto_passwd /etc/mosquitto/passwd <username> sudo chown mosquitto:mosquitto /etc/mosquitto/passwd sudo nano /etc/mosquitto/acl # scope the new user to its own topic branch sudo systemctl reload mosquitto
Retained messages and the queued messages of offline clients persist in /var/lib/mosquitto and survive a reboot.
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Eclipse Mosquitto documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Code, debug, and modernize IBM zSystems applications with fully integrated tools in your choice of IDE.
Secure Java runtime environment with OpenJDK 8 LTS (Eclipse Temurin) preinstalled and JAVA_HOME configured. Built with the latest Linux security patches and ready to run Java workloads such as Tomcat, Cassandra, Kafka, and other JVM-based applications. Kurian provides this product across multiple Linux distributions including Ubuntu, Debian, Amazon Linux, Rocky Linux, AlmaLinux, Oracle Linux, Fedora, and Red Hat Enterprise Linux.
Code, debug, and modernize IBM zSystems applications with fully integrated tools in your choice of IDE. Contact Rocket Software for a Private Offer which includes 24/7 Enterprise Support.
Secure Java runtime environment with OpenJDK 17 LTS (Eclipse Temurin) preinstalled and JAVA_HOME configured. Built with the latest Linux security patches and ready to run Java workloads such as Tomcat, Cassandra, Kafka, and other JVM-based applications. Kurian provides this product across multiple Linux distributions including Ubuntu, Debian, Amazon Linux, Rocky Linux, AlmaLinux, Oracle Linux, Fedora, and Red Hat Enterprise Linux.
Secure Java runtime environment with OpenJDK 11 LTS (Eclipse Temurin) preinstalled and JAVA_HOME configured. Built with the latest Linux security patches and ready to run Java workloads such as Tomcat, Cassandra, Kafka, and other JVM-based applications. Kurian provides this product across multiple Linux distributions including Ubuntu, Debian, Amazon Linux, Rocky Linux, AlmaLinux, Oracle Linux, Fedora, and Red Hat Enterprise Linux.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.