How to disable RabbitMQ default tcp listening port - 5672

Question

I have configured the RabbitMQ rabbitmq.config file with new port number i.e. 5671 with SSL.

Now I want to disable the default port i.e. 5672.

Config file as below :-

[
  {rabbit, [
     {ssl_listeners, [5671]},
     {ssl_options, [{cacertfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/cacert.pem"},
                    {certfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/cert.pem"},
                    {keyfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/key.pem"},
                    {verify,verify_peer},
                    {fail_if_no_peer_cert,false},

                   {ciphers,[{dhe_rsa,aes_256_cbc,sha},
 {dhe_dss,aes_256_cbc,sha},
 {rsa,aes_256_cbc,sha}]}

                    ]

    }
   ]}
].

Now its working on both port 5671 and 5672.But I need to disable the port 5672. Give some comments or suggestion.

Thanks in advance.

Answer 1

To disable standart RabbitMQ 5672 port add {tcp_listeners, []} to your rabbitmq.conf:

[
  {rabbit, [
     {tcp_listeners, []},
     {ssl_listeners, [5671]},
     {ssl_options, [{cacertfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/cacert.pem"},
                    {certfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/cert.pem"},
                    {keyfile,"/ay/app/xxx/softwares/rabbitmq_server-3.1.1/etc/ssl/key.pem"},
                    {verify,verify_peer},
                    {fail_if_no_peer_cert,false},

                   {ciphers,[{dhe_rsa,aes_256_cbc,sha},
 {dhe_dss,aes_256_cbc,sha},
 {rsa,aes_256_cbc,sha}]}

                    ]

    }
   ]}
].

It works with RabbitMQ 3.1.5

Answer 2

Here's how to do it with the new configuration file format introduced in RabbitMQ 3.7:

1. Set up the SSL listener in rabbitmq.conf:

   listeners.ssl.1 = 5671
   ssl_options.cacertfile = /path/to/testca/cacert.pem
   ssl_options.certfile = /path/to/server/cert.pem
   ssl_options.keyfile = /path/to/server/key.pem
   ssl_options.verify = verify_peer
   ssl_options.fail_if_no_peer_cert = false
   

2. Disable the non-SSL listener in advanced.config:

   [
    {rabbit,
     [{tcp_listeners, []}
     ]}
   ].