如何使用用户名和密码保护 MongoDB

How to secure MongoDB with username and password

提问by murvinlai

I want to set up user name & password authentication for my MongoDB instance, so that any remote access will ask for the user name & password. I tried the tutorial from the MongoDB site and did following:

我想为我的 MongoDB 实例设置用户名和密码身份验证，以便任何远程访问都会要求输入用户名和密码。我尝试了 MongoDB 站点上的教程并执行了以下操作：

use admin
db.addUser('theadmin', '12345');
db.auth('theadmin','12345');

After that, I exited and ran mongo again. And I don't need password to access it. Even if I connect to the database remotely, I am not prompted for user name & password.

之后，我退出并再次运行mongo。而且我不需要密码来访问它。即使我远程连接到数据库，也不会提示我输入用户名和密码。

---

---

UPDATEHere is the solution I ended up using

更新这是我最终使用的解决方案

1) At the mongo command line, set the administrator:

    use admin;
    db.addUser('admin','123456');

2) Shutdown the server and exit

    db.shutdownServer();
    exit

3) Restart mongod with --auth

  $ sudo ./mongodb/bin/mongod --auth --dbpath /mnt/db/

4) Run mongo again in 2 ways:

   i) run mongo first then login:

        $ ./mongodb/bin/mongo localhost:27017
        use admin
        db.auth('admin','123456');

  ii) run & login to mongo in command line.

        $ ./mongodb/bin/mongo localhost:27017/admin -u admin -p 123456

The username & password will work the same way for mongodumpand mongoexport.

用户名和密码对mongodump和 的工作方式相同mongoexport。

采纳答案by Alexandru Petrescu

You need to start mongodwith the --authoption after setting up the user.

您需要在设置用户后mongod从--auth选项开始。

From the MongoDB Site:

从 MongoDB 站点：

Run the database (mongod process) with the --authoption to enable security. You must either have added a user to the admin db before starting the server with --auth, or add the first user from the localhost interface.

使用--auth启用安全性的选项运行数据库（mongod 进程）。您必须在使用 启动服务器之前将用户添加到管理数据库--auth，或者从本地主机界面添加第一个用户。

MongoDB Authentication

MongoDB 认证

回答by Karl Morrison

Wow so many complicated/confusing answers here.

哇，这里有这么多复杂/令人困惑的答案。

This is as of v3.4.

这是从v3.4 开始的。

Short answer.

简短的回答。

1) Start MongoDB without access control.

1）在没有访问控制的情况下启动MongoDB。

mongod --dbpath /data/db

2) Connect to the instance.

2) 连接到实例。

mongo

3) Create the user.

3）创建用户。

use some_db
db.createUser(
  {
    user: "myNormalUser",
    pwd: "xyz123",
    roles: [ { role: "readWrite", db: "some_db" },
             { role: "read", db: "some_other_db" } ]
  }
)

4) Stop the MongoDB instance and start it again with access control.

4) 停止 MongoDB 实例并使用访问控制重新启动它。

mongod --auth --dbpath /data/db

5) Connect and authenticate as the user.

5) 以用户身份连接并进行身份验证。

use some_db
db.auth("myNormalUser", "xyz123")
db.foo.insert({x:1})
use some_other_db
db.foo.find({})

Long answer: Read this if you want to properly understand.

长答案：如果您想正确理解，请阅读此内容。

It's really simple. I'll dumb the following down https://docs.mongodb.com/manual/tutorial/enable-authentication/

这真的很简单。我会把以下内容写下来https://docs.mongodb.com/manual/tutorial/enable-authentication/

If you want to learn more about what the roles actually do read more here: https://docs.mongodb.com/manual/reference/built-in-roles/

如果您想了解有关角色实际作用的更多信息，请在此处阅读更多内容：https: //docs.mongodb.com/manual/reference/built-in-roles/

1) Start MongoDB without access control.

1）在没有访问控制的情况下启动MongoDB。

mongod --dbpath /data/db

2) Connect to the instance.

2) 连接到实例。

mongo

3) Create the user administrator. The following creates a user administrator in the adminauthentication database. The user is a dbOwnerover the some_dbdatabase and NOT over the admindatabase, this is important to remember.

3) 创建用户管理员。下面在admin身份验证数据库中创建一个用户管理员。用户是dbOwner在some_db数据库之上而不是在admin数据库之上，记住这一点很重要。

use admin
db.createUser(
  {
    user: "myDbOwner",
    pwd: "abc123",
    roles: [ { role: "dbOwner", db: "some_db" } ]
  }
)

Or if you want to create an admin which is admin over any database:

或者，如果您想创建一个管理任何数据库的管理员：

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: "abc123",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

4) Stop the MongoDB instance and start it again with access control.

4) 停止 MongoDB 实例并使用访问控制重新启动它。

mongod --auth --dbpath /data/db

5) Connect and authenticate as the user administrator towards the adminauthentication database, NOT towards the some_dbauthentication database. The user administrator was created in the adminauthentication database, the user does not exist in the some_dbauthentication database.

5) 以用户管理员身份连接并验证身份admin验证数据库，而不是some_db身份验证数据库。用户管理员是在admin认证数据库中创建的，该用户在some_db认证数据库中不存在。

use admin
db.auth("myDbOwner", "abc123")

You are now authenticated as a dbOwnerover the some_dbdatabase. So now if you wish to read/write/do stuff directly towards the some_dbdatabase you can change to it.

您现在已dbOwner通过some_db数据库进行身份验证。所以现在如果你想直接对some_db数据库读/写/做东西，你可以改变它。

use some_db
//...do stuff like db.foo.insert({x:1})
// remember that the user administrator had dbOwner rights so the user may write/read, if you create a user with userAdmin they will not be able to read/write for example.

More on roles: https://docs.mongodb.com/manual/reference/built-in-roles/

更多关于角色：https: //docs.mongodb.com/manual/reference/built-in-roles/

If you wish to make additional users which aren't user administrators and which are just normal users continue reading below.

如果您希望创建不是用户管理员而只是普通用户的其他用户，请继续阅读下面的内容。

6) Create a normal user. This user will be created in the some_dbauthentication database down below.

6）创建一个普通用户。该用户将在some_db下面的身份验证数据库中创建。

use some_db
db.createUser(
  {
    user: "myNormalUser",
    pwd: "xyz123",
    roles: [ { role: "readWrite", db: "some_db" },
             { role: "read", db: "some_other_db" } ]
  }
)

7) Exit the mongo shell, re-connect, authenticate as the user.

7) 退出 mongo shell，重新连接，以用户身份进行身份验证。

use some_db
db.auth("myNormalUser", "xyz123")
db.foo.insert({x:1})
use some_other_db
db.foo.find({})

回答by Shnkc

First, un-comment the line that starts with #auth=truein your mongod configuration file (default path /etc/mongo.conf). This will enable authentication for mongodb.

首先，取消注释以#auth=truemongod 配置文件（默认路径/etc/mongo.conf）开头的行。这将为 mongodb 启用身份验证。

Then, restart mongodb : sudo service mongod restart

然后，重新启动 mongodb ： sudo service mongod restart

回答by Sdembla

This answer is for Mongo 3.2.1 Reference

此答案适用于 Mongo 3.2.1 参考

Terminal 1:

1号航站楼：

$ mongod --auth

Terminal 2:

2 号航站楼：

db.createUser({user:"admin_name", pwd:"1234",roles:["readWrite","dbAdmin"]})

if you want to add without roles (optional):

如果你想添加没有角色（可选）：

db.createUser({user:"admin_name", pwd:"1234", roles:[]})

to check if authenticated or not:

检查是否通过身份验证：

db.auth("admin_name", "1234")

it should give you:

它应该给你：

1

else :

别的 ：

Error: Authentication failed.
0

回答by Bharadvaj

Here is a javascript code to add users.

这是用于添加用户的 javascript 代码。

1. Start mongodwith --auth = true

2. Access admin database from mongo shell and pass the javascript file.

   mongo admin "Filename.js"

   "Filename.js"

   // Adding admin user
   db.addUser("admin_username", " admin_password");
   // Authenticate admin user
   db.auth("admin_username ", " admin_password ");
   // use  database code from java script
   db = db.getSiblingDB("newDatabase");
   // Adding newDatabase database user  
   db.addUser("database_username ", " database_ password ");
   

3. Now user addition is complete, we can verify accessing the database from mongo shell

1. 开始mongod于--auth = true

2. 从 mongo shell 访问管理数据库并传递 javascript 文件。

   mongo 管理员“文件名.js”

   “文件名.js”

   // Adding admin user
   db.addUser("admin_username", " admin_password");
   // Authenticate admin user
   db.auth("admin_username ", " admin_password ");
   // use  database code from java script
   db = db.getSiblingDB("newDatabase");
   // Adding newDatabase database user  
   db.addUser("database_username ", " database_ password ");
   

3. 现在用户添加完成，我们可以验证从 mongo shell 访问数据库

回答by alicanozkara

https://docs.mongodb.com/manual/reference/configuration-options/#security.authorization

https://docs.mongodb.com/manual/reference/configuration-options/#security.authorization

Edit the mongo settings file;

编辑 mongo 设置文件；

sudo nano /etc/mongod.conf

Add the line:

添加行：

security.authorization : enabled

Restart the service

重启服务

sudo service mongod restart

Regards

问候

回答by PRAVESH kumar

First run mongoDB on terminal using

首先在终端上运行 mongoDB 使用

mongod

now run mongo shell use following commands

现在运行 mongo shell 使用以下命令

    use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: "abc123",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Re-start the MongoDB instance with access control.

使用访问控制重新启动 MongoDB 实例。

mongod --auth

Now authenticate yourself from the command line using

现在使用命令行验证自己

mongo --port 27017 -u "myUserAdmin" -p "abc123" --authenticationDatabase "admin"

I read it from

我从

https://docs.mongodb.com/manual/tutorial/enable-authentication/

https://docs.mongodb.com/manual/tutorial/enable-authentication/

回答by Jinmin

This is what I did on Ubuntu 18.04:

这是我在 Ubuntu 18.04 上所做的：

$ sudo apt install mongodb
$ mongo
> show dbs
> use admin
> db.createUser({  user: "root",  pwd: "rootpw",  roles: [ "root" ]  })  // root user can do anything
> use lefa
> db.lefa.save( {name:"test"} )
> db.lefa.find()
> show dbs
> db.createUser({  user: "lefa",  pwd: "lefapw",  roles: [ { role: "dbOwner", db: "lefa" } ]  }) // admin of a db
> exit
$ sudo vim /etc/mongodb.conf
auth = true
$ sudo systemctl restart mongodb
$ mongo -u "root" -p "rootpw" --authenticationDatabase  "admin"
> use admin
> exit
$ mongo -u "lefa" -p "lefapw" --authenticationDatabase  "lefa"
> use lefa
> exit

回答by deusxmachine

You could change /etc/mongod.conf.

你可以改变/etc/mongod.conf。

Before

前

#security:

#security:

After

后

security:
    authorization: "enabled"

Then sudo service mongod restart

然后 sudo service mongod restart

回答by rahil471

Follow the below steps in order

请按顺序执行以下步骤

• Create a user using the CLI

• 使用 CLI 创建用户

use admin
db.createUser(
  {
    user: "admin",
    pwd: "admin123",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
  }
)

• Enable authentication, how you do it differs based on your OS, if you are using windows you can simply mongod --authin case of linux you can edit the /etc/mongod.conffile to add security.authorization : enabledand then restart the mongd service
• To connect via cli mongo -u "admin" -p "admin123" --authenticationDatabase "admin". That's it

• 启用身份验证，您的操作方式因操作系统而异，如果您使用的是 Windows，您可以简单地mongod --auth在 linux 的情况下，您可以编辑/etc/mongod.conf文件以添加security.authorization : enabled然后重新启动 mongd 服务
• 通过 cli 连接mongo -u "admin" -p "admin123" --authenticationDatabase "admin"。就是这样

You can check out this postto go into more details and to learn connecting to it using mongoose.

您可以查看这篇文章以了解更多详细信息并学习使用 mongoose 连接到它。