Skip to content

Security

This page describes how the suite protects credentials, bounds the resources a broker can make it use, behaves on a redundant gateway pair, and records changes.

Secrets

  • Never shown or logged. Passwords, TLS client-key passwords, PEM key material and any credentials in a broker URL are never returned by any status, read or log path. The web pages show a mask instead.
  • Stored encrypted. The broker password, TLS client key and key password are stored in config.json as Ignition embedded secrets, encrypted with the gateway's system encryption key, and decrypted only in memory. Profiles saved by earlier versions are migrated once, at the first startup after an upgrade.
  • Plaintext or mask only. The web pages and API accept a secret only as plaintext or as its mask. A request carrying an Ignition secret object (a reference to another gateway secret, or copied ciphertext) is refused.
  • No passwords in URLs. A password inside a broker URL (user:pass@host) is refused on save; use the password field.
  • A credential never follows a retarget. If a profile edit changes the broker URLs or the TLS trust settings (TLS on/off, CA, hostname verification) without re-entering the password, the stored password is cleared instead of being sent to the new destination.

Bounded resources

A broker or a publisher cannot make the gateway create unbounded tags or consume unbounded memory:

Limit Default Effect
maxPayloadBytes 8 MiB Larger incoming payloads are dropped before they are decoded.
maxTags 10 000 Caps the tags, edge nodes, devices, aliases and JSON members one subscription or host application may create.
maxTagPathDepth 64 levels Refuses absurdly deep tag paths.
maxScriptBacklogBytes 64 MiB Caps the payloads queued for one subscription's script callback.

In addition:

  • Pub caps how many tags and folder levels a mapping expands.
  • JSON nested too deeply to expand is kept as a raw string rather than failing.
  • Sparkplug control messages that come from the broker (node commands, primary host STATE, the host's own STATE) are size-checked before they are decoded.
  • An error in one consumer on a connection cannot stop delivery to the others on the same connection.

Ordered, non-blocking receive

  • Each connection delivers incoming messages on a single thread, in order, which preserves Sparkplug's per-edge-node ordering.
  • Script callbacks and write-back publishes run on their own bounded threads, never on the receive thread or on Ignition's shared tag-write thread.
  • QoS 1 publishes are time-limited, so a broker that never acknowledges cannot hang the gateway's tag threads or shutdown.
  • On shutdown or restart, one subscription, mapping, edge node, host application or connection that fails to stop does not leave the others running. Work in progress gets up to 5 seconds per engine to finish, and the log warns about any task that ignores the stop request.

Redundant gateways

  • Active node only. On a redundant pair, MQTT sessions run only on the node whose activity level is Active. The standby keeps its profiles registered but not started, refuses publishes rather than buffering them, and when it stands down it publishes its Sparkplug deaths first.
  • Override. To run sessions on the standby as well, set the JVM property -Dartek.mqtt.runOnStandby=true in ignition.conf.
  • Configure on the master. The backup refuses every create, modify and delete through the web pages or API with 409 and a message naming the master, whatever its activity level and whatever runOnStandby says. The master's settings sync over the backup's, so a change made on the backup could never stay.

Scripting access

system.artekmqtt.* runs on the gateway. Calls that arrive from a client are served only for a Designer session; any other client session (for example a Vision client) is refused. Gateway and Perspective scripts are unaffected. Arguments are positional only. See Scripting.

Sparkplug identities

  • Edge node configuration refuses group, edge node, device and primary host ids that are empty, padded with spaces, or contain /, + or #.
  • The host application refuses messages with an empty or padded id level.
  • If two different edge ids would map to the same tag folder (for example E.1 and E_1, or ids that differ only in case), the host refuses both and holds that folder's tags Bad, so neither can take over the other's tags.
  • Each tag path has one owner: a second subscription or host application that would feed a path another already feeds is refused.

Web pages and API

  • Only the signed-in, CSRF-protected web routes and the read-only /status routes are exposed.
  • Unknown fields in a request are refused with 400 and nothing is applied.
  • Resource names with control characters, or that are too long, are refused, so they never reach the configuration store or the logs.
  • A save is answered only once it has been applied; see The web API.

Audit

Every create and delete of a connection, mapping, edge node or host application is recorded to ArtekMQTT.Audit with the actor, remote address, action, target and outcome. Saves that fail, or that are not applied within 20 seconds, are recorded as failures.

Write-back

Write-back (publishing when a subscribed tag is written) is off by default and must be enabled per subscription. See Write-back.