mongodb logpath folder permission change - mongodb

I need some advice on MongoDB Log path permission. Currently, I have 755 permission
on /var/log/mongodb . Our internal auditing will not allow having 755 permission on base folder /var/log..
When i change it to 640, my Mongod process failing with permission error even though my /var/log/MongoDB has 755 privilege.
Again I switch back /var/log to 755 I can able to start my mongod process. is it known behavior.
Kindly advice I need to give a rationale for possible mitigation to get overriding approval

You can have 640 for /var/log and 755 for /var/log/mongod.log. But you have to start mongod as a root user.

Related

MongoDB docker error: Failed to open /var/log/mongodb/mongod.log

I am trying to run a docker instance and keep coming across this server.
Here is what I get after trying to setup the instance:
Starting instance ... done
Attaching to instance
instance | {"t":{"$date":"2020-12-08T14:06:42.033Z"},"s":"F", "c":"CONTROL", "id":20574, "ctx":"main","msg":"Error during global initialization","attr":{"error":{"code":38,"codeName":"FileNotOpen","errmsg":"Failed to open /var/log/mongodb/mongod.log"}}}
instance exited with code 1
The file permissions are:
$ ls -l /var/log/mongodb/mongod.log
-rwxr-xr-x 1 mongodb mongodb 0 Dec 8 19:32 /var/log/mongodb/mongod.log
What else I've tried:
Shutting down and removing all containers and removing the build-cache
Removing all .sock files from /var/lib/mongodb
uninstalling and reinstalling docker.
Checking if the ports on my .conf file are unoccupied.
Adding user mongodb as owner and group to both the lib and log mongodb folders.
I am not sure anymore where this issue is coming from.
Would like to have some alternate solutions to this.
I had the same issue. I think the permission could be wrong for the folder. Try setting the permission 777 for log and data
If your mongodb was working well & suddenly it stopped working, then it can possible be an error related to permission. Below commands can be used to get back mongodb into running state -
check the permission of /var/lib/mongodb & /var/log/mongodb & match it with the official installtion guide.
try to make permission as same as guided by the official site.
If you are unable to resolve it that way or want a quick fix, you can do the following. it will definitely resolve the issue -
sudo chmod 777 -R /var/log/mongodb // not good from safety perspective.
sudo chmod 777 -R /var/lib/mongodb // not good from safety perspective.
sudo rm -rf /tmp/mongod-*.sock
and them you can simply restart the server & check the status with below commands -
sudo service mongod restart
sudo service mongod status
or
sudo systemctl restart mongod
sudo systemctl status mongod
If this answer works for you, please vote it.

mongodb 3.4.3 Permission denied wiredtiger_kv_engine.cpp 267 error with ubuntu 16

I'm having problems lauching mongod as a service:
How is it possible that it works when I do sudo mongod -f /etc/mongod.conf but when launching it with sudo service mongod start I get an error in the log
Assertion: 28595:13: Permission denied src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp 267
I'm running mongodb on ubuntu 16
I followed exactly the instructions in the mongodb documentation for installation of that version, so is this a bug? Any suggestions how to solve this are appreciated.
Additional information:
The mongodb service startup script looks like this and runs it as user mongodb, could this be connected to the error?
lib/systemd/system/mongodb.service:
[Unit]
Description=MongoDB Database Service
Wants=network.target
After=network.target
[Service]
ExecStart=/usr/bin/mongod --config /etc/mongod.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
User=mongodb
Group=mongodb
StandardOutput=syslog
StandardError=syslog
[Install]
WantedBy=multi-user.target
I'm having problems lauching mongod as a service: How is it possible that it works when I do sudo mongod -f /etc/mongod.conf but when launching it with sudo service mongod start I get an error in the log
The sudo command starts mongod with root permissions (aka superuser access). If you run mongod as a service the user and group are configured in the service definition (mongodb for both in your example).
There is no need to run the mongod process as the root user, and this is strongly discouraged as per the common security practice of Principle of least privilege.
If you want to test a configuration from the command-line, you could use sudo to run with a specified user instead of the default (root) user.
For example:
sudo -u mongodb mongod -f /etc/mongod.conf
In general, it's best to use a service configuration rather than running mongod manually. With manual invocation you will also have to remember to include parameters like the config file path (as there is no default config path). Without a configuration file, mongod also uses default options such as a dbPath of /data/db.
Assertion: 28595:13: Permission denied src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp 267
The likely cause of your permission errors is having previously started mongod as the root user. Some directories and files may now be owned by the root user, so the mongodb user cannot access those. Your specific error relates to accessing files in the data directory (i.e. the configured storage.dbPath in mongod.conf).
Assuming you haven't changed the default paths in your mongod.conf file, you should be able to recursively adjust permissions to match what the mongod.service definition expects.
First, ensure you have stopped your mongod instance if it is currently running.
Then, recursively adjust permissions to the expected user and group:
# storage.dbPath
sudo chown -R mongodb:mongodb /var/lib/mongodb
# systemLog.path
sudo chown -R mongodb:mongodb /var/log/mongodb
Now you should be able to start mongod as a service. If the service fails to start, there should be further detail in the mongod log file (assuming the log file is writable by the mongodb service user).
Have same problem.
What been in /var/log/mongodb/mongod.log:
2017-05-13T13:46:41.152+0700 E STORAGE [initandlisten] WiredTiger error (13) [1494658001:152518][15821:0x7fb843803cc0], connection: /var/lib/mongodb/journal/WiredTigerPreplog.0000000002: file-remove: unlink: Permission denied
2017-05-13T13:46:41.159+0700 I - [initandlisten] Assertion: 28595:13: Permission denied src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp 267
So wee see that something can't remove file "WiredTigerPreplog.0000000002" in /var/lib/mongodb/journal/
So id just gave permissions, i just did:
sudo chmod 764 /var/lib/mongodb/journal/
If not help, try:
sudo chown -R mongodb:mongodb /var/lib/mongodb/ && sudo chmod 764 /var/lib/mongodb/journal/
There are three set-ups that triggers this kind of problem :
MongoDB installation is configured to create database files at a given path and this path does not exist on your current system. This path is called dbpath in mongo.
In your case, check if /data/db exist. If it doesn't or if it is empty, mongod is trying the wrong dbpath. You need to find it, it's usually under /var/lib/mongodb.
Once you found it there's two thing you can do. First, copy all the file from there to /data/db. Second, change your dbpath under the mongod.conf file, which is located (in linux) at /etc/mongod.conf. Make sure to start mongod with the --config specifying the configuration file.
MongoDB does not have the permission to read one or more files or directories corresponding to its dbpath.
chown mongodb:mongodb dbpath -R.
MongoDB is missing WiredTiger.wt . This can happen if you remove files under the dbpath or if there's a device failure. We do it for testing a recovery strategy for example.
If you're sure dbpath is correct and that there's no instance of WiredTiger.wt there. Your database is broken. There are no ways to ensure integrity if you lose this file. Reinstall mongodb by :
sudo apt-get purge mongodb-org*
sudo rm -r dbpath
sudo apt-get install mongodb-org
Edit :
Or copy dbpath from one of your replicas.
I had same problem in my mongod.log:
2021-09-16T16:06:43.782+0200 F STORAGE [initandlisten] Reason: 13: Permission denied
2021-09-16T16:06:43.782+0200 F - [initandlisten] Fatal Assertion 28595 at src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp 789
So I looked in my dbPath folder (specified in mongodb config file /etc/mongod.conf, section storage:dbPath) and found that same file was owned by root:
WiredTiger.turtle
WiredTigerLAS.wt
journal/WiredTigerLog.0000000112
From dbPath folder, using the command below, I change owner and group to mongodb:
sudo chown mongodb:mongodb WiredTiger.turtle WiredTigerLAS.wt journal/WiredTigerLog.0000000112
After this, I can start mongodb server as
"service mongod start"
and check its status as
"service mongod status" with output:
mongod.service - MongoDB Database Server
Loaded: loaded (/lib/systemd/system/mongod.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2021-09-16 16:19:47 CEST; 54min ago
Docs: https://docs.mongodb.org/manual
Main PID: 8459 (mongod)
CGroup: /system.slice/mongod.service
└─8459 /usr/bin/mongod --config /etc/mongod.conf
Sep 16 16:19:47 svi5-ubu16 systemd[1]: Started MongoDB Database Server.
Note that above commands are working as normal user, not as root.
My configuration: Ubuntu 16.04.2 LTS, MongoDB shell version v4.2.1.
Other file or folder owned by mongodb (user and group):
/var/log/mongodb
/var/lib/mongodb
/tmp/mongodb-27028.sock
I spent a lot of time in solving this issue, thank you very match to every one has posted here and guided me to solution.
I wish append a comment to the previous answer, but unfortunately I cannot yet.
I completely agree with the explanation of Stennie. It is exactly what was happened to me.
I've always run mongod as a service but today, because some changes that I've made, I've tried to run the process using sudo mongod --auth --dbpath /data/mongodb/.. to test authorizations and db changing location.
After that the mongod service didn't run anymore, due to this permissions problem.
I've to say that the command sudo chown -R mongodb:mongodb /data/mongodb/ didn't immediately fix the problem as expected. I've had to reboot several times, remove the mongod.lock file under /data/mongodb/, reissue the sudo chown command again.. and finally everything gone well.
I have a similar issue but with custom log path and data dir. updating the owner and group access to them did not fix the issue for running as a service
updating the group and owner to mongodb:mongodb works on running mongod by itself as stated earlier
sudo -u mongodb mongod -f /etc/mongod.conf
or
sudo mongod -f /etc/mongod.conf
If you find yourself with the same problem on CentOS, but the permissions look correct, it could be because of SELinux policies. On my system, MongoDB files use a specific SELinux context. The mongod server failed to start, outputting the same permissions errors, until I corrected the SELinux contexts.
If it doesn't exist, create the MongoDB data folder (either /var/lib/mongo or /var/lib/mongodb, check your /etc/mongod.conf file):
$ mkdir -p /var/lib/mongodb
Then try to restore the SELinux contexts:
$ restorecon -v /var/lib/mongodb
$ restorecon -v /var/lib/mongodb/*
If that still doesn't work, try to apply the contexts directly:
$ chcon system_u:object_r:mongod_var_lib_t:s0 /var/lib/mongodb
$ chcon system_u:object_r:mongod_var_lib_t:s0 /var/lib/mongodb/*
Verify the contexts are correct:
$ ls -lZ -d /var/lib/mongodb
drwxr-xr-x. mongod mongod system_u:object_r:mongod_var_lib_t:s0 /var/lib/mongodb
sudo chmod -R 666 /var/lib/mongodb
is another solution...

Installing Mongo and chown /data/db yields "illegal user name" error

I'm installing MongoDB for a Node / Express tutorial and upon creation of the /data/db folder and the following command:
sudo chown 'id -u' /data/db
I received the following error:
chown: id -u: illegal user name
You can look for the current username and then try setting the permissions.
$ whoami
username
$ sudo chown username /data/db
Hope that helps.
The reason this failed is because your syntax was wrong and you misinterpreted the quoting from the source where you found it. You need to use a quote like this to execute the id command:
chown `id -u` /data/db
See the difference?
Also you seem to have arrived here at a misconception of how to install mongodb, and possibly have gone for a build from a tarball. The /data/db path is not required, it's just the default location.
But you generally can get a package install for your system:
http://docs.mongodb.org/manual/tutorial/install-mongodb-on-ubuntu/
http://docs.mongodb.org/manual/tutorial/install-mongodb-on-os-x/
These will typically lay out an installation with a directory structure appropriate to your system conventions, and create a mongodb user under which the mongod process runs, with all appropriate permissions. They typically have a config file that you can set options in as well. The process is also typically set-up as a "service", so you don't need to manually invoke it each time you want to use.
You can specify the --dbpath option on startup or within a config file section, which of course is loaded by the --config option.
At any rate you should generally run mongod processes as their own user (not root) using the options and permissions on data and logging directories set for that user.

Mongo insecure world dir

I'm extremely new to using terminal commands. I'm trying to run an app locally on my Mac and i'm having difficulty with that so I'm trying to pick through the possible issues. The first one is the when using the mongod command I get an error of the flowing
/usr/local/bin/mongod:3: warning: Insecure world writable dir /usr/local in PATH, mode 040777
all output going to: /usr/local/var/log/mongodb/mongo.log
Does this seem to be a problem or erroneous?
Having /usr/local world writable is never a good idea. Normal permissions only allow the superuser (root) to write to these system directories.
To bring you back closer to the default run:
sudo chmod 755 /usr/local
Furthermore you might want to clear the world writable bit on every subdir and file by running:
sudo chmod -R o-w /usr/local
This will mean you have to either start mongod as root or change the database path to somewhere you can write (for example in your homedir).
I run mongod on my developer machine using the following command:
mongod --bind_ip 127.0.0.1 --dbpath ~/mongo -v --profile 2
This means the following:
--bind_ip 127.0.0.1 make sure others in your network can't access your database
--dbpath ~/mongo save database files in your home dir in the directory mongo
-v show queries that are being executed
--profile 2 shows performance and profile information on queries
You should run mongod -h to see all available options.

Php Setting File permissions for OrangeHrm in Ubuntu system

I am trying to deploy OrangeHrm in Ubuntu Server but getting the following errors..
Component Status
PHP version OK (ver 5.3.3)
MySQL Client OK (ver 5.1.52)
MySQL Server OK (ver 5.1.52)
MySQL InnoDB Support Enabled
Write Permissions for "lib/confs" Not Writeable*
Write Permissions for "lib/logs" Not Writeable*
Write Permissions for "symfony/config" Not Writeable*
Write Permissions for "symfony/apps/orangehrm/config" Not Writeable*
Write Permissions for "symfony/cache" Not Writeable*
Write Permissions for "symfony/log" Not Writeable*
Maximum Session Idle Time before Timeout OK
Register Globals turned-off OK
Memory allocated for PHP script OK
Web server allows .htaccess files OK
* Web server requires write privilege to the following directory
I have changed the file accessing permission as
"sudo chmod 777 orangehrm" and the folder is in 777 mode, still the errors exist.
Thanks..
For me it helped to change the the owner of the corresponding directory to www-data:
Go to the directory your web page data is in (usually /var/www/YOUR_SITE_NAME): cd /var/www/YOUR_SITE_NAME
Change the owner to www-data: sudo chown -R www-data . Alternatively, you can change the group, too e.g. to you username's group, in order to be able to access the files from you account: sudo chown -R www-data:YOUR_USERNAME . Note that in both cases the dot at the end of the command is part of the command!
You shouldn't be setting all folders to 777 for a web facing site. Run something like the following from your orangehrm folder;
sudo chmod 760 lib/confs lib/logs symfony/config symfony/apps/orangehrm/config symfony/cache symfony/log
That will give you read/write/execute for the owner and then read/write for the group and then no permissions for all others.
Then make sure the owner of the orangehrm folder is your web user ie, www-data
I would suggest confirming the permissions for those folders with the orangehrm forum.
ie, http://forum.orangehrm.com/viewtopic.php?f=14&t=2531&p=3452&hilit=chmod&sid=e53a96e31a32ce4cbfa7998f43fdfc95#p3452
you should include -R in your command, like :
sudo chmod -R 777 orangehrm