JIYIK CN >

This MongoDB article will teach you how to properly configure the most basic security feature: protecting MongoDB with a username and password by creating an authentication user when accessing MongoDB remotely.

As you know, MongoDB is described as a NoSQL database that does not follow any relational database structure; instead, it stores data in JSON documents.

When you install MongoDB, MongoDB remote connection security does not have any authentication enabled, which means anyone with your HOST IP can quickly access your MongoDB service and perform CRUD operations without any MongoDB authentication, which is not a secure way to globally integrate a mongod database.

Furthermore, having no authentication means inviting everyone into your database, confiscating everything, and potentially ransoming your data.

This MongoDB article will show you how to secure MongoDB authentication so that only users with MongoDB authentication credentials can access the database.

Topics covered in this MongoDB article are:

• Enabling secure authentication on MongoDB
  1. Start MongoDB without authentication
  2. Connect to the server using the MongoDB shell
  3. Create User Administrator
  4. Enable authentication in the mongod configuration file
  5. Connect and authenticate as user admin
  6. Create additional users

Enabling secure authentication on MongoDB

This MongoDB article applies only to self-managed MongoDB servers. All MongoDB as a Service providers come with authentication pre-enabled.

Start MongoDB without Authentication

Open a shell and run the MongoDB client. This is easy because it is the default behavior of MongoDB.

$ mongo

Connect to the server using MongoDB Shell

$ mongo mongodb://<host>:<port>

The port number will probably be 27017, but you can always change it to another port number for increased security.

Create User Administrator

Change to the admin database:

> use admin

You will need to create a user with the userAdminAnyDatabase role, which allows you to create other users on any existing database. The following example will create the admin123 user with the password pass123.

> db.createUser(
  {
    user: "admin123",
    pwd: "pass123",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Then disconnect from the mongo shell using Ctrl+D.

Enable authentication in the mongod configuration file

Edit mongod.conf using your favorite editor and enable authorization.

$ sudo vi /etc/mongod.conf

Open /etc/mongod.conf using any code editor and search for the following lines.

security:
    authorization: "disabled"

In the Security section, remove any #, change Authorization to Enabled, and add it if it's missing. It should look like this:

security:
  authorization: "enabled"

If you cannot find mongod.conf or it is named mongodb.conf, then you are using an outdated and broken version of MongoDB.

In this case, you might want to consider upgrading to a newer version of MongoDB. However, if you don't care, do the following:

$ sudo vi /etc/mongodb.conf

Find auth, delete it #and make sure it is set to true. It should look like this:

auth = true

After changing disabled to enabled, you will need to save the file and restart mongod.

$ sudo service mongodb restart

All clients connecting to this server must authenticate themselves as valid users, and they can only perform actions determined by the roles assigned to them.

Connect and authenticate as user admin

$ mongo mongodb://<host>:<port>> db.auth("admin123", "pass123")
1

Users can also use mongo mongodb://superadmin:thepianohasbeendrinking@<host>:<port>Connect and authenticate in one step. However, this option is not recommended because it makes your credentials visible in your terminal history and can be read by any program on your computer.

Create additional users

The following operation adds the user admin456 to the test database, where the user has the read and write roles.

> use test
> db.createUser(
  {
    user: "admin456",
    pwd: "xyz123",
    roles: [ { role: "readWrite", db: "test" } ]
  }
)

Press Enter and mongo will respond Successfully added user: ... Then type exit or use CTRL+C.