Secure access to MongoDB finishing notes

MongoDB secure access will be controlled from the following three areas!

1. Bind IP Intranet address to access MongoDB service

2. Setting the Listening port

3. Use user name and password

Bind IP Intranet address to access MongoDB service

MongoDB can restrict access to only a specific IP, as long as it is added with a parameter bind_ip at startup, as follows:

Service-side Limit only 192.168.1.103 this IP can access MongoDB service

[Email protected] bin]#/mongod--bind_ip 192.168.1.103

Client access needs to explicitly specify the server IP, otherwise it will be error:

[Email protected] bin]#/mongo 192.168.1.1021.8.1192.168.1.103/Test>

Setting the Listening port
The official default listening port is 27017, for security reasons, generally modify this listening port, to avoid malicious connection attempts, as follows:

Change the service-side listening port to 28018

[Email protected] bin]#/mongod--bind_ip 192.168.1.103--port 28018

Client Access does not specify a port, will connect to the default port 27017, for this meeting error

[Email protected] bin]#./mongo 192.168.1.1021.8.1192.168.1.102/-15:55:51 error:couldn ' t connect to server 192.168.1.102 Shell/mongo.js:81exception:connect failed

So when a port is specified on the server, the client must explicitly specify the port to be able to access it properly

[Email protected] bin]#/mongo 192.168.1.102:280181.8.1192.168.1.102:28018/Test>

use user name and password
MongoDB default startup is not to verify the user name and password, after starting MongoDB, can be directly connected with MongoDB, to all the library has root permissions. So when you start specifying parameters, you can block client access and connections.

First, to enable the system's login verification module, simply specify the auth parameter at startup

[Email protected] bin]#/mongod--auth

Local Client connection look at the effect

It's strange why we've enabled the login verification module, but we didn't specify a user when we signed in, why would we still be able to log in? At first, MongoDB has a default admin database (which is empty by default), and Admin.system.users will save user information that is larger than the user's permissions set in other databases. Note: When no user is added in admin.system.users, even if the--auth parameter is added to MongoDB startup, if the user is added in addition to the admin database, no authentication can be used at this time until you know A user was added to the admin.system.users.

two ways to add users

establish the system root user

Add a new user root in the admin library:

[[email protected] bin]#./1.8.1connecting to:test> Db.adduser ("Root", "111") {"user": " Root ",false," pwd ":" E54950178e2fa777b1d174e9b106b6ab "}> Db.auth (" Root "," 111 ")1>

View Code

The local client connects, but does not specify the user, the result is as follows:

[Email protected] bin]#/1.8.1connecting to:test>16:36:52 uncaught exception : Error: {"$err": "Unauthorized db:test lock type:-1 client:127.0.0.1","code": 10057}>

View Code

Connected to the test library, but there is an exception to the further operation, it appears that MongoDB allows unauthorized connections, but cannot do anything.

The local client connection, specifying the user, results in the following:

[Email protected] bin]#/mongo-u root-1.8.1Enter password:connecting to:test> show Collecti Ons;system.indexessystem.users>

View Code

It appears that after the user name is specified, access to the database is normal.

establish a specified permission user

MongoDB also supports setting up users for a specific data, such as we set up a read-only user user_reader for the test library:

[Email protected] bin]#/mongo-u root-1.8.1Enter password:connecting to:test> show Collecti Ons;system.indexessystem.users> Use testswitched to DB testtrue) {"user": "User_ Reader ",true," pwd ":" 0809760bb61ee027199e513c5ecdedc6 "}>

View Code

The client uses this user to visit:

[Email protected] bin]#/mongo-u user_reader-1.8.1Enter password:connecting to:test> show C Ollections;system.indexessystem.users>

View Code

Secure access to MongoDB finishing notes