如何启动支持身份验证的 Mongo 守护进程

如何启动支持身份验证的 Mongo 守护进程

我想使用 Mongo init 脚本启动支持身份验证的 MongoDB 守护进程:

sudo /etc/init.d/mongod start

我还将数据库用户添加到数据库以进行身份​​验证。我正在使用两个文件:(/etc/init.d/mongod用于初始化)和/etc/mongod.conf(用于配置)。

#mongod.conf:
dbpath=/var/lib/mongodb
logappend=true
port = 27017 
auth = true

非守护进程方法使用以下--auth标志正确启动进程:

mongod --auth

fork 可以工作,但是它不使用初始化脚本:

mongod --fork --auth --logpath /var/log/mongod.log

阅读所有文档和相关文章,似乎没有人有一个可行的解决方案来获得身份验证支持

service mongod start

链接:

更新:我重新安装了 Debian/Mongo,并能够在 conf 文件中使用service mongod startauth = true我可能在初始安装/配置期间损坏了某些东西。

答案1

我刚刚使用全新安装的 Debian 7 和全新安装的 MongoDB 对此进行了测试。我首先添加了一个用户 (adam),然后编辑文件/etc/mongod.conf以取消注释该auth = true行。然后我发出命令service mongod restart并尝试以用户身份登录,并成功 - 我也尝试了错误的凭据并失败了。因此,身份验证似乎运行良好,使用配置文件指定启用身份验证没有明显的问题。

因此,有几个问题:

  • 您如何测试身份验证是否已启用?
  • 您的配置文件中是否有多行包含 auth/noauth 语句?

作为参考,以下是我根据 shell 等的反馈进行的大部分测试。

首先,安装并设置初始用户:

root@deb7:~# apt-get install mongodb-org
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following extra packages will be installed:
  mongodb-org-mongos mongodb-org-server mongodb-org-shell mongodb-org-tools
The following NEW packages will be installed:
  mongodb-org mongodb-org-mongos mongodb-org-server mongodb-org-shell
  mongodb-org-tools
0 upgraded, 5 newly installed, 0 to remove and 20 not upgraded.
Need to get 114 MB of archives.
After this operation, 287 MB of additional disk space will be used.
Do you want to continue [Y/n]? 
** SNIP  for brevity** 
Setting up mongodb-org-shell (2.6.1) ...
Setting up mongodb-org-server (2.6.1) ...
Adding system user `mongodb' (UID 104) ...
Adding new user `mongodb' (UID 104) with group `nogroup' ...
Not creating home directory `/home/mongodb'.
Adding group `mongodb' (GID 107) ...
Done.
Adding user `mongodb' to group `mongodb' ...
Adding user mongodb to group mongodb
Done.
[ ok ] Starting database: mongod.
Setting up mongodb-org-mongos (2.6.1) ...
Setting up mongodb-org-tools (2.6.1) ...
Setting up mongodb-org (2.6.1) ...
root@deb7:~# mongo
MongoDB shell version: 2.6.1
connecting to: test
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
    http://docs.mongodb.org/
Questions? Try the support group
    http://groups.google.com/group/mongodb-user
> use admin
switched to db admin
> db.createUser(
...   {
...     user: "adam",
...     pwd: "password123",
...     roles:
...     [
...       {
...         role: "userAdminAnyDatabase",
...         db: "admin"
...       }
...     ]
...   }
... )                           
Successfully added user: {
    "user" : "adam",
    "roles" : [
        {
            "role" : "userAdminAnyDatabase",
            "db" : "admin"
        }
    ]
}

接下来,我编辑了/etc/mongod.conf文件并删除了#注释掉的内容auth = true(我没有做其他更改)。我保存了该文件,然后重新启动了服务。接下来,我与我添加的用户建立连接并验证我是否拥有正确的权限:

root@deb7:~# vim /etc/mongod.conf 
root@deb7:~# service mongod restart
[ ok ] Restarting database: mongod.
root@deb7:~# mongo -u adam -p password123 --authenticationDatabase admin
MongoDB shell version: 2.6.1
connecting to: test
Error while trying to show server startup warnings: not authorized on admin to execute command { getLog: "startupWarnings" }

如您所见,我添加的用户没有查看启动警告的权限,但为了确保万无一失,我检查了权限:

> use admin
switched to db admin
> db.runCommand(   {     usersInfo:"adam",     showPrivileges:true   } )
{
    "users" : [
        {
            "_id" : "admin.adam",
            "user" : "adam",
            "db" : "admin",
            "roles" : [
                {
                    "role" : "userAdminAnyDatabase",
                    "db" : "admin"
                }
            ],
            "inheritedRoles" : [
                {
                    "role" : "userAdminAnyDatabase",
                    "db" : "admin"
                }
            ],
            "inheritedPrivileges" : [
                {
                    "resource" : {
                        "db" : "",
                        "collection" : ""
                    },
                    "actions" : [
                        "changeCustomData",
                        "changePassword",
                        "createRole",
                        "createUser",
                        "dropRole",
                        "dropUser",
                        "grantRole",
                        "revokeRole",
                        "viewRole",
                        "viewUser"
                    ]
                },
                {
                    "resource" : {
                        "cluster" : true
                    },
                    "actions" : [
                        "authSchemaUpgrade",
                        "invalidateUserCache",
                        "listDatabases"
                    ]
                },
                {
                    "resource" : {
                        "db" : "",
                        "collection" : "system.users"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                },
                {
                    "resource" : {
                        "db" : "admin",
                        "collection" : "system.users"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                },
                {
                    "resource" : {
                        "db" : "admin",
                        "collection" : "system.roles"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                },
                {
                    "resource" : {
                        "db" : "admin",
                        "collection" : "system.version"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                },
                {
                    "resource" : {
                        "db" : "admin",
                        "collection" : "system.new_users"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                },
                {
                    "resource" : {
                        "db" : "admin",
                        "collection" : "system.backup_users"
                    },
                    "actions" : [
                        "collStats",
                        "dbHash",
                        "dbStats",
                        "find",
                        "killCursors",
                        "planCacheRead"
                    ]
                }
            ]
        }
    ],
    "ok" : 1
}                                        

为了完整起见,以下是一次身份验证失败:

root@deb7:~# mongo -u root -p 12345678 --authenticationDatabase admin
MongoDB shell version: 2.6.1
connecting to: test
2014-05-11T18:04:39.793+0100 Error: 18 { ok: 0.0, errmsg: "auth failed", code: 18 } at src/mongo/shell/db.js:1210
exception: login failed   

答案2

编辑 /etc/mongod.conf 并添加如下行:

对于 mongo <3.0

auth=true

然后:

service mongod restart

对于 mongo 3.x,将其添加到配置中

security:
  authorization: "enabled"

答案3

这对我有用(使用 mongo 3.2):编辑 /etc/mongod.conf 并添加:

安全:授权:已启用

与其他答案类似,但没有“启用”的引号

相关内容