MongoDB User and Rights Management (i): Role description

MongoDB After the installation of the default is not to turn on The Auth module, ordinary users and super-administrators are not certified to operate. Of course, the bare-Ben risky, security or open the auth module.

First, you need to understand the following points:

1,mongodb is no default administrator account, so you have to add an administrator account, and then turn on permission authentication.

2, switch to the admin database, add the account is the Administrator account.

3, users can only log in the user's database, including the administrator account.

4, the administrator can manage all the databases, but can not directly manage other databases, to the Admin database before the authentication. This is rather odd.

1. User Rights role Description

1.1 Database User Roles

• Read

Allows the user to read the specified database

Provides the ability to read data on Allnon-system collections and on the following system Collections:system.indexes,sys Tem.js, and System.namespaces collections.

Have the following permissions:

Aggregate,checkshardingindex,clonecollectionascapped,collstats Count,datasize,dbhash,dbstats,distinct,filemd5 Geonear,geosearch,geowalk,group MapReduce (inline output only.), text (Beta feature.)

• ReadWrite

Allow users to read and write to a specified database

Provides all the privileges of the readrole and the ability to modify data in all Non-system collections and Thesystem.js Collection.

in addition to having read permission, you have the following permissions:

Clonecollection (as the target database.), converttocapped Create (and to create collections implicitly.) Drop (), Dropindexes,emptycapped,ensureindex () Findandmodify,mapreduce (output to a collection.) Renamecollection (within the same database.) Read and ReadWrite as long as they are operational permissions on the tables in the library

1.2 Database Administration Roles

• DbAdmin

allows the user to perform administrative functions in the specified database, such as index creation, deletion, viewing statistics, or accessing system.profile

Provides the ability to performadministrative tasks such as schema-related tasks, indexing, gatheringstatistics. This role does not the grant privileges for user and role management.

Have the following permissions:

clean,collmod,collstats,compact,converttocapped Create,db.createcollection (), Dbstats,drop (), Dropindexes,ensureindex () Indexstats,profile,reindex,renamecollection (within a single database.), validate

• Dbowner

Provides the ability to perform anyadministrative action on the database. This role combines the privilegesgranted by the ReadWrite, DbAdmin and useradmin roles.

• Useradmin

allows users to write to the System.users collection to create, delete, and manage users in the specified database

Provides the ability to create and modifyroles and users on the current database. Since the Useradmin role allows usersto grant any privilege to any user, including themselves, the role alsoindirectly Pro Vides Superuser access to either the database or, if scoped tothe Admin database, the cluster.

1.3 Cluster Administration Roles

• Clusteradmin

Available only in the admin database, giving the user administrative permissions on all shard and replica set related functions.

Provides the greatest cluster-managementaccess. This role combines the privileges granted by the Clustermanager,clustermonitor, and hostmanager roles. Additionally, the role provides thedropdatabase action.

Have the following permissions:

Addshard,closealldatabases,connpoolstats,connpoolsync,_cpuprofilerstart _cpuprofilerstop,cursorinfo,diaglogging,dropdatabase Enablesharding,flushrouterconfig,fsync,db.fsyncunlock () Getcmdlineopts,getlog,getparameter,getshardmap,getshardversion Hostinfo,db.currentop (), Db.killop (), listdatabases,listshards Logrotate,movechunk,moveprimary,netstat,removeshard,unsetsharding Repairdatabase,replsetfreeze,replsetgetstatus,replsetinitiate Replsetmaintenance,replsetreconfig,replsetstepdown,replsetsyncfrom Resync,serverstatus,setparameter,setshardversion,shardcollection Shardingstate,shutdown,splitchunk,splitvector,split,top,touch

• Clustermanager

Provides management and monitoring Actionson the cluster. A user with this role can access the Config and localdatabases, which is used in sharding and replication, respectively.

• Clustermonitor

Provides read-only access to monitoringtools, such as the MongoDB Cloud Manager and Ops Manager Monitoring agent.

• Hostmanager

Provides the ability to monitor and manageservers.

1.4 Backup and Restoration Roles

• Backup

Provides privileges needed to back up data. This role provides sufficient privileges to use the MongoDB Cloud managerbackup agent, Ops Manager backup agent, or to use Mongodump.

• Restore

Provides privileges needed to restore Datawith mongorestore without the--oplogreplay option or without System.profilecoll Ection data.

1.5 All-database Roles

• Readanydatabase

Available only in the admin database, giving users read access to all databases

Provides the same read-only permissions Asread, except it applies to all but the local and config databases in thecluster. The role also provides the listdatabases action on the cluster as awhole.

• Readwriteanydatabase

Available only in the admin database, giving users read and write access to all databases

Provides the same read and writepermissions as ReadWrite, except it applies to all but the local and configdatabases in th E cluster. The role also provides the ListDatabases action onthe cluster as a whole.

• Useradminanydatabase

only available in the admin database, giving users useradmin permissions for all databases

Provides the same access to useradministration operations as Useradmin, except it applies to all but the Localand config D Atabases in the cluster.

Since the Useradminanydatabase role allowsusers to grant any privilege to any user, including themselves, the role Alsoind Irectly provides superuser access.

• Dbadminanydatabase

Available only in the admin database, giving the user dbAdmin permissions for all databases .

Provides the same access to databaseadministration operations as DbAdmin, except it applies to all but the Localand config Databases in the cluster. The role also provides the listdatabasesaction on the cluster as a whole.

1.6 Superuser Roles

• Root

Available only in the admin database. Super account, Super privilege

Provides access to the operations and allthe resources of the Readwriteanydatabase, Dbadminanydatabase,useradminanydataba SE, clusteradmin, restore, and backup combined.

Specific permissions can be found in:

Https://docs.mongodb.com/manual/reference/built-in-roles/#read

This article is from the "Old scholar" blog, please make sure to keep this source http://showing.blog.51cto.com/11976328/1905159

MongoDB User and Rights Management (i): Role description