How to set username/password mosquitto?

By default, Mosquitto will still allow anonymous connections, i.e. connections where no username/password is provided.
In addition to the password_file entry, you also need:

allow_anonymous false