Previously I've had mosquitto running on a Raspberry Pi. I'm excited that I can now integrate that service into the router with OpenWrt.
I have installed the mosquitto-nossl package because my MQTT devices cannot speak SSL, and have followed the standard instructions to activate mosquitto password authentication and have placed the password file with hashes onto the device.
However, everytime a device tried to connect and authenticate, mosquitto responded with "Client ClientID disconnected, not authorised".
I've tried changing file permissions and the password hash algorithm, and also tested the same config on a Linux PC (where it did not exhibit these problems).
What finally worked was to uninstall mosquitto-nossl and instead install the mosquitto-ssl packet. Even though I do not use SSL, I have to use the SSL version of the mosquitto package on OpenWRT in order to use password authentication.
Maybe this report can help someone else facing the same problem.