Question 1

rabbitmqctl can't reach the node or reports an authentication (cookie) error

Accepted Answer

Check: Did you run it with sudo?. Fix: The cookie /var/lib/rabbitmq/.erlang.cookie is readable by the rabbitmq user only; with sudo the CLI tools run as rabbitmq and target rabbit@localhost (from /etc/rabbitmq/rabbitmq-env.conf).

Question 2

guest/guest is refused

Accepted Answer

Check: sudo rabbitmqctl list_users. Fix: guest is deleted on first boot by design. Sign in as admin (/root/rabbitmq-admin-credentials.txt) and create per-application users.

Question 3

Clients on other VMs can't connect

Accepted Answer

Check: sudo rabbitmq-diagnostics listeners; the tcp:5672 firewall rule and its source ranges. Fix: Every listener is on 127.0.0.1 by default: add one on the internal IP in rabbitmq.conf, restart, and allow your client range.

Question 4

The broker isn't running after first boot

Accepted Answer

Check: systemctl status rabbitmq-firstboot rabbitmq-server rabbitmq-admin-firstboot; journalctl -u rabbitmq-server. Fix: The broker waits for rabbitmq-firstboot (cookie + credential); rabbitmq-admin-firstboot stays armed and retries on the next boot if it failed.

Troubleshoot DCA Hardened Message Broker

Logs & useful commands

Symptom	Check	Fix
rabbitmqctl can't reach the node or reports an authentication (cookie) error	Did you run it with sudo?	The cookie /var/lib/rabbitmq/.erlang.cookie is readable by the rabbitmq user only; with sudo the CLI tools run as rabbitmq and target rabbit@localhost (from /etc/rabbitmq/rabbitmq-env.conf).
guest/guest is refused	sudo rabbitmqctl list_users	guest is deleted on first boot by design. Sign in as admin (/root/rabbitmq-admin-credentials.txt) and create per-application users.
Clients on other VMs can't connect	sudo rabbitmq-diagnostics listeners; the tcp:5672 firewall rule and its source ranges	Every listener is on 127.0.0.1 by default: add one on the internal IP in rabbitmq.conf, restart, and allow your client range.
The broker isn't running after first boot	systemctl status rabbitmq-firstboot rabbitmq-server rabbitmq-admin-firstboot; journalctl -u rabbitmq-server	The broker waits for rabbitmq-firstboot (cookie + credential); rabbitmq-admin-firstboot stays armed and retries on the next boot if it failed.