在 Ubuntu Server 20.04 上保护 MongoDB 5.0

在 Ubuntu Server 20.04 上保护 MongoDB 5.0

我在 Ubunutu 20.04 上全新安装了 MongDB 5.0,并且正在尝试配置基本根(管理员)用户访问控制根据文献当然,它在第一个命令上就不起作用。:-/

第一条指令说我需要mongod --port 27017 --dbpath /var/lib/mongodb以 mongodb 用户身份运行,在 Ubuntu 20.04 上默认情况下是mongdb

所以我已经运行了:

runuser -u mongodb -- "mongod --port 27017 --dbpath /var/lib/mongodb"(双引号)

-没有权限

runuser -u mongodb -- 'mongod --port 27017 --dbpath /var/lib/mongodb'(单引号)

-没有权限

runuser -u mongodb -- mongod --port 27017 --dbpath /var/lib/mongodb(无引号)

- 连接失败,输出如下:

{"t":{"$date":"2022-03-27T18:28:50.566+08:00"},"s":"I",  "c":"CONTROL",  "id":23285,   "ctx":"thread1","msg":"Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'"}
{"t":{"$date":"2022-03-27T18:28:50.567+08:00"},"s":"I",  "c":"NETWORK",  "id":4915701, "ctx":"thread1","msg":"Initialized wire specification","attr":{"spec":{"incomingExternalClient":{"minWireVersion":0,"maxWireVersion":13},"incomingInternalClient":{"minWireVersion":0,"maxWireVersion":13},"outgoing":{"minWireVersion":0,"maxWireVersion":13},"isInternalClient":true}}}
    {"t":{"$date":"2022-03-27T18:28:50.567+08:00"},"s":"W",  "c":"ASIO",     "id":22601,   "ctx":"thread1","msg":"No TransportLayer configured during NetworkInterface startup"}
    {"t":{"$date":"2022-03-27T18:28:50.568+08:00"},"s":"I",  "c":"NETWORK",  "id":4648601, "ctx":"thread1","msg":"Implicit TCP FastOpen unavailable. If TCP FastOpen is required, set tcpFastOpenServer, tcpFastOpenClient, and tcpFastOpenQueueSize."}
    {"t":{"$date":"2022-03-27T18:28:50.570+08:00"},"s":"W",  "c":"ASIO",     "id":22601,   "ctx":"thread1","msg":"No TransportLayer configured during NetworkInterface startup"}
    {"t":{"$date":"2022-03-27T18:28:50.570+08:00"},"s":"I",  "c":"REPL",     "id":5123008, "ctx":"thread1","msg":"Successfully registered PrimaryOnlyService","attr":{"service":"TenantMigrationDonorService","ns":"config.tenantMigrationDonors"}}
    {"t":{"$date":"2022-03-27T18:28:50.570+08:00"},"s":"I",  "c":"REPL",     "id":5123008, "ctx":"thread1","msg":"Successfully registered PrimaryOnlyService","attr":{"service":"TenantMigrationRecipientService","ns":"config.tenantMigrationRecipients"}}
    {"t":{"$date":"2022-03-27T18:28:50.570+08:00"},"s":"I",  "c":"CONTROL",  "id":5945603, "ctx":"thread1","msg":"Multi threading initialized"}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"I",  "c":"CONTROL",  "id":4615611, "ctx":"initandlisten","msg":"MongoDB starting","attr":{"pid":23994,"port":27017,"dbPath":"/var/lib/mongodb","architecture":"64-bit","host":"test.example.test"}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"I",  "c":"CONTROL",  "id":23403,   "ctx":"initandlisten","msg":"Build Info","attr":{"buildInfo":{"version":"5.0.6","gitVersion":"212a8dbb47f07427dae194a9c75baec1d81d9259","openSSLVersion":"OpenSSL 1.1.1f  31 Mar 2020","modules":[],"allocator":"tcmalloc","environment":{"distmod":"ubuntu2004","distarch":"x86_64","target_arch":"x86_64"}}}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"I",  "c":"CONTROL",  "id":51765,   "ctx":"initandlisten","msg":"Operating System","attr":{"os":{"name":"Ubuntu","version":"20.04"}}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"I",  "c":"CONTROL",  "id":21951,   "ctx":"initandlisten","msg":"Options set by command line","attr":{"options":{"net":{"port":27017},"storage":{"dbPath":"/var/lib/mongodb"}}}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"E",  "c":"NETWORK",  "id":23024,   "ctx":"initandlisten","msg":"Failed to unlink socket file","attr":{"path":"/tmp/mongodb-27017.sock","error":"Operation not permitted"}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"F",  "c":"-",        "id":23091,   "ctx":"initandlisten","msg":"Fatal assertion","attr":{"msgid":40486,"file":"src/mongo/transport/transport_layer_asio.cpp","line":989}}
    {"t":{"$date":"2022-03-27T18:28:50.571+08:00"},"s":"F",  "c":"-",        "id":23092,   "ctx":"initandlisten","msg":"\n\n***aborting after fassert() failure\n\n"}

关于我为什么会遇到上述失败,有什么想法吗?

更新:

凭着直觉,我运行了它chown mongodb:mongo /tmp/mongodb-27017.sock,从而解决了权限问题。

现在我得到:

{"t":{"$date":"2022-03-27T19:18:45.471+08:00"},"s":"I",  "c":"CONTROL",  "id":23285,   "ctx":"thread1","msg":"Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'"}
{"t":{"$date":"2022-03-27T19:18:45.473+08:00"},"s":"I",  "c":"NETWORK",  "id":4915701, "ctx":"thread1","msg":"Initialized wire specification","attr":{"spec":{"incomingExternalClient":{"minWireVersion":0,"maxWireVersion":13},"incomingInternalClient":{"minWireVersion":0,"maxWireVersion":13},"outgoing":{"minWireVersion":0,"maxWireVersion":13},"isInternalClient":true}}}
{"t":{"$date":"2022-03-27T19:18:45.473+08:00"},"s":"W",  "c":"ASIO",     "id":22601,   "ctx":"thread1","msg":"No TransportLayer configured during NetworkInterface startup"}
{"t":{"$date":"2022-03-27T19:18:45.474+08:00"},"s":"I",  "c":"NETWORK",  "id":4648601, "ctx":"thread1","msg":"Implicit TCP FastOpen unavailable. If TCP FastOpen is required, set tcpFastOpenServer, tcpFastOpenClient, and tcpFastOpenQueueSize."}
{"t":{"$date":"2022-03-27T19:18:45.475+08:00"},"s":"W",  "c":"ASIO",     "id":22601,   "ctx":"thread1","msg":"No TransportLayer configured during NetworkInterface startup"}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"REPL",     "id":5123008, "ctx":"thread1","msg":"Successfully registered PrimaryOnlyService","attr":{"service":"TenantMigrationDonorService","ns":"config.tenantMigrationDonors"}}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"REPL",     "id":5123008, "ctx":"thread1","msg":"Successfully registered PrimaryOnlyService","attr":{"service":"TenantMigrationRecipientService","ns":"config.tenantMigrationRecipients"}}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"CONTROL",  "id":5945603, "ctx":"thread1","msg":"Multi threading initialized"}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"CONTROL",  "id":4615611, "ctx":"initandlisten","msg":"MongoDB starting","attr":{"pid":48003,"port":27017,"dbPath":"/var/lib/mongodb","architecture":"64-bit","host":"test.pragmaticprodigy.test"}}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"CONTROL",  "id":23403,   "ctx":"initandlisten","msg":"Build Info","attr":{"buildInfo":{"version":"5.0.6","gitVersion":"212a8dbb47f07427dae194a9c75baec1d81d9259","openSSLVersion":"OpenSSL 1.1.1f  31 Mar 2020","modules":[],"allocator":"tcmalloc","environment":{"distmod":"ubuntu2004","distarch":"x86_64","target_arch":"x86_64"}}}}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"CONTROL",  "id":51765,   "ctx":"initandlisten","msg":"Operating System","attr":{"os":{"name":"Ubuntu","version":"20.04"}}}
{"t":{"$date":"2022-03-27T19:18:45.476+08:00"},"s":"I",  "c":"CONTROL",  "id":21951,   "ctx":"initandlisten","msg":"Options set by command line","attr":{"options":{"net":{"port":27017},"storage":{"dbPath":"/var/lib/mongodb"}}}}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"E",  "c":"CONTROL",  "id":20568,   "ctx":"initandlisten","msg":"Error setting up listener","attr":{"error":{"code":9001,"codeName":"SocketException","errmsg":"Address already in use"}}}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"REPL",     "id":4784900, "ctx":"initandlisten","msg":"Stepping down the ReplicationCoordinator for shutdown","attr":{"waitTimeMillis":15000}}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"COMMAND",  "id":4784901, "ctx":"initandlisten","msg":"Shutting down the MirrorMaestro"}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"SHARDING", "id":4784902, "ctx":"initandlisten","msg":"Shutting down the WaitForMajorityService"}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"NETWORK",  "id":4784905, "ctx":"initandlisten","msg":"Shutting down the global connection pool"}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"NETWORK",  "id":4784918, "ctx":"initandlisten","msg":"Shutting down the ReplicaSetMonitor"}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"SHARDING", "id":4784921, "ctx":"initandlisten","msg":"Shutting down the MigrationUtilExecutor"}
{"t":{"$date":"2022-03-27T19:18:45.478+08:00"},"s":"I",  "c":"ASIO",     "id":22582,   "ctx":"MigrationUtil-TaskExecutor","msg":"Killing all outstanding egress activity."}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"COMMAND",  "id":4784923, "ctx":"initandlisten","msg":"Shutting down the ServiceEntryPoint"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":4784925, "ctx":"initandlisten","msg":"Shutting down free monitoring"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":4784927, "ctx":"initandlisten","msg":"Shutting down the HealthLog"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":4784928, "ctx":"initandlisten","msg":"Shutting down the TTL monitor"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":4784929, "ctx":"initandlisten","msg":"Acquiring the global lock for shutdown"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"-",        "id":4784931, "ctx":"initandlisten","msg":"Dropping the scope cache for shutdown"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"FTDC",     "id":4784926, "ctx":"initandlisten","msg":"Shutting down full-time data capture"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":20565,   "ctx":"initandlisten","msg":"Now exiting"}
{"t":{"$date":"2022-03-27T19:18:45.479+08:00"},"s":"I",  "c":"CONTROL",  "id":23138,   "ctx":"initandlisten","msg":"Shutting down","attr":{"exitCode":48}}

已在使用的异常...嗯

答案1

对于像我一样只想保护您的 mongodb 管理员用户的其他完整 mongodb 新手,以便您可以实际遵循教程和课程,而不会让您的数据库被黑客入侵......这个答案适合您:

1.) 如果你无法通过运行以下命令获得与数据库的基本连接runuser -u mongodb -- mongod --port 27017 --dbpath /var/lib/mongodb

我上面的猜测是正确的,但不完整。您需要运行:

chown -R mongodb:mongodb /var/lib/mongodb

chown mongodb:mongodb /tmp/mongodb-27017.sock

来源: https://stackoverflow.com/a/61323247/5180608

从那里运行systemctl restart mongod

现在您应该能够执行mongosh --port 27017连接到 mongodb,然后按照这些说明完成设置管理员用户和密码。

https://www.mongodb.com/docs/manual/tutorial/configure-scram-client-authentication/

如果您有连接问题,您可能需要编辑/etc/mongod.conf

net:
  port: 27017
  bindIp: your-host-ip -OR- 127.0.0.1

从 5.0 bindIp 开始,必须是一个单一值。

相关内容