The broker is EMQX 6.0.1, not 5.x as first assumed -- 6.x keeps serving its
management API under /api/v5 for backward compatibility, so the API path is
not a version indicator. Menu paths in the setup guide verified against the
current EMQX documentation.
tools/check_broker.py verifies broker configuration end to end: anonymous
refused, made-up credentials refused, the configured account accepted, and
publishes permitted to both topic trees the firmware uses. It reads the local
config header by path and never prints the account secret, so its output is
safe to paste anywhere.
Two bugs found and fixed while testing it against the live broker:
- paho 2.x hands the VERSION2 on_connect callback a ReasonCode object, not
an int. int(rc) raised, every probe fell back to the timeout path, and the
script reported an open broker as secure -- a false pass on the one check
that most needs to be trustworthy.
- An inconclusive result (timeout, transport error) was rendered as a pass.
It now reports INCONCLUSIVE and fails the run, because "could not tell"
must never read as "locked down".
The reason-code table now covers both MQTT 3.1.1 CONNACK codes and the MQTT 5
numbering paho normalises onto, so refusals print as text rather than 134/135.
Co-Authored-By: Claude <noreply@anthropic.com>
mattandClaude
ee22a54398