How do I secure a Mosquitto MQTT broker so that not every client can subscribe to everything?

There are three layers, and you need all of them on a broker that is reachable from the internet. Encryption: TLS on the listener, so that credentials and data cannot be read in transit; the conventional port is 8883, against 1883 for plain MQTT. Authentication: every client proves who it is, with a username and password or a client certificate. Authorisation: an access control list says which topics each authenticated identity may read and write.

Passwords without TLS are of little value, since the CONNECT packet carries them in clear text.

In Mosquitto the pieces are a few configuration lines. Turn off anonymous access with allow_anonymous false, point password_file at a file created with the mosquitto_passwd tool (it stores hashes, not the passwords), and define a listener on 8883 with certfile and keyfile. A certificate from a public certificate authority works if the broker has a domain name; with your own CA, each device needs the CA certificate to verify the server.

Since version 2.0, Mosquitto only listens on localhost and refuses anonymous clients unless the configuration says otherwise, so an open broker today usually means someone enabled it deliberately during testing.

Per-device restriction is done in the ACL file, referenced by acl_file. Pattern rules avoid writing an entry for each device: pattern readwrite devices/%u/# gives every user access only to the branch that contains its own username, with %u replaced by the username and %c available for the client ID. A device logged in as node17 can then use devices/node17/... and nothing else, and a subscription to # returns only what the ACL allows.

Give the backend or dashboard its own user with explicit rules, for example topic read devices/# under its user line, and a separate rule for the command branch it may write to.

Give each device its own credentials rather than one shared password in the firmware. If a single device is opened and its flash read out, a shared secret exposes the whole fleet, while an individual one can be revoked by deleting one line.

On ESP32-class hardware, keep credentials out of the source code, and make sure the device actually verifies the server certificate; using the insecure option on the TLS client to skip verification gives encryption without any assurance of who is on the other end. Finally, firewall everything else: expose only 8883, keep 1883 closed or bound to localhost, and watch the broker log for repeated failed logins.