I know many guys are used to running MongoDB without authentication. If you try a Lynis or Nessus security audit, you’ll likely get a warning for “No MongoDB authorization“. Let’s cover how you can set authentication for a user/database in MongoDB.
You need a running MongoDB to use this guide, use any of below articles to install MongoDB server.
When mongod service is running, connect to it using the mongocommand line tool
# mongo --port 27017
MongoDB shell version v4.4.24
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("4956ab93-97c7-4252-bef8-411bf29ef6fc") }
MongoDB server version: 4.4.24
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
https://docs.mongodb.com/
Questions? Try the MongoDB Developer Community Forums
https://community.mongodb.com
---
The server generated these startup warnings when booting:
2023-01-25T13:24:21.234+00:00: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine. See http://dochub.mongodb.org/core/prodnotes-filesystem
2023-01-25T13:24:21.956+00:00: Access control is not enabled for the database. Read and write access to data and configuration is unrestricted
---
---
Enable MongoDB's free cloud-based monitoring service, which will then receive and display
metrics about your deployment (disk utilization, CPU, operation statistics, etc).
The monitoring data will be available on a MongoDB website with a unique URL accessible to you
and anyone you share the URL with. MongoDB may use this information to make product
improvements and to suggest MongoDB products and deployment options to you.
To enable free monitoring, run the following command: db.enableFreeMonitoring()
To permanently disable this reminder, run the following command: db.disableFreeMonitoring()
---
>
Then create the user account with “root” role to be the database admin.
> use testdb;
switched to db testdb
> db.createUser(
{
user: "dbadmin",
pwd: "StrongPassword",
roles: [ { role: "root", db: "admin" } ]
}
)
> exit
byeWhere:
- Username is dbadmin
- Password is StrongPassword
Open the file /etc/mongod.conf and enable authentication
$ sudo vim /etc/mongod.conf
security:
authorization: enabled
Restart MongoDB
sudo systemctl restart mongodTest by connecting to testdb as dbadmin user.
mongo --port 27017 -u "dbadmin" -p --authenticationDatabase "testdb"When asked for the password, enter the password you had set, in my case this is StrongPassword:
MongoDB shell version v4.4.24
Enter password: StrongPassword
connecting to: mongodb://127.0.0.1:27017/?authSource=testdb&compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("8438914a-a79c-42c6-8b20-388b0e366c1b") }
MongoDB server version: 4.4.24
---
The server generated these startup warnings when booting:
2023-08-23T13:19:17.309+00:00: /sys/kernel/mm/transparent_hugepage/enabled is 'always'. We suggest setting it to 'never'
2023-08-23T13:19:17.309+00:00: /sys/kernel/mm/transparent_hugepage/defrag is 'always'. We suggest setting it to 'never'
---
---
Enable MongoDB's free cloud-based monitoring service, which will then receive and display
metrics about your deployment (disk utilization, CPU, operation statistics, etc).
The monitoring data will be available on a MongoDB website with a unique URL accessible to you
and anyone you share the URL with. MongoDB may use this information to make product
improvements and to suggest MongoDB products and deployment options to you.
To enable free monitoring, run the following command: db.enableFreeMonitoring()
To permanently disable this reminder, run the following command: db.disableFreeMonitoring()
---
You now have a working MongoDB authentication for a user to access a specific database.
