We have installed MongoDB in AWS and it is running in without Authentication mode. But we want to run MongoDB instance in authentication mode. We have added the line security:
authorization: "enabled" in mongod.conf file . But still we are able to connect our database without any credentials.
You are able to login because of localhost exception, you can login in DB to create users, as you haven't created any yet. As mentioned in mongodb site.
You can create users either before or after enabling access control.
If you enable access control before creating any user, MongoDB
provides a localhost exception which allows you to create a user
administrator in the admin database. Once created, you must
authenticate as the user administrator to create additional users as
needed.
After it you should create Admin user with role userAdminAnyDatabase, and you will be able to create this user even mongod is started with --auth or not. you can create this user by below command.
use admin
db.createUser(
{
user: "myAdmin",
pwd: "123adc",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
And then create other users, for more detail you can go to another answer given by me.
https://stackoverflow.com/a/40058794/3879440
Related
I'm trying to add an admin user in Mongo, but I'm having trouble.
I already have auth = true commented out inside /etc/mongodb.conf.
When I run Mongo, I run these commands in order:
mongo
use admin
db.createUser({user:"admin",pwd:"password",roles:["root"]});
When I do so, I encounter the following error:
2020-10-11T04:50:50.714+0000 E QUERY [thread1] Error: couldn't add user: there are
no users authenticated :
_getErrorWithCode#src/mongo/shell/utils.js:25:13
DB.prototype.createUser#src/mongo/shell/db.js:1437:15
#(shell):1:1
I'm not sure exactly how to create an admin user if I have to log in as an admin user to do so. Any help is appreciated!
You don't have to disable authentication. With authentication enabled you can still logon to your MonogDB without username/password. However, as soon as you create the first user with userAdmin or userAdminAnyDatabase role the access control becomes active and you have to authenticate.
This behavior is called Localhost Exception
Is this the first user to try to create? Perhaps another admin user already exist. See also How do I create a the first mongodb user with authorization enabled?
I just gave up and started over with a new database, after exporting the old one as a backup.
For creating a user you will have to have a user in admin database first. So while creating user you need to provide db name and role both. Try creating user with below syntax.
use admin
db.createUser(
{
user: "myUserAdmin",
pwd: "password"
roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
}
)
Reference-
https://docs.mongodb.com/manual/tutorial/enable-authentication/
I have an ec2 instance with mongodb 3.2.0 installed. I have a user with admin access. I can connect with user and perform operation remotely. But any one can connect the database test from remote if he knows the ip like mongo 11.11.11.11. Although he will not able to make any operations, but I want to restrict this access so that only user with credentials can connect to server.
first you need to create users and grant roles to those users, for example:
use admin
db.createUser(
{
user: "myUserAdmin",
pwd: "abc123",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
then you need to start your server with the --auth parameter
mongod --auth
More Information here
I'm trying to connect from a java application to a mongodb database in openshift and I'm having some trouble with roles and actions allowed.
I run the rch port-forward command like so:
rhc port-forward -a test
it all goes great and I'm able to connect to the database using:
mongo admin -u admin -p '*******' --host 127.0.0.1 --port 44506
and I can execute commands like:
> use test
> show databases
But if i connect directly to my database using:
mongo test -u admin -p '*******' --host 127.0.0.1 --port 44506
I'm unable to run the show databases command
listDatabases failed:{ "ok" : 0, "errmsg" : "unauthorized" } at src/mongo/shell/mongo.js:47
How can i give action listDatabases to this user in this database?
I found this page in the mongodb documentation http://docs.mongodb.org/manual/reference/privilege-actions/#security-user-actions
Which talks about Diagnostic Actions but does not mention how to give such action to a user.
Thanks for the help.
As mentioned by wdberkeley, you have to have a user in the admin database with the ability to list databases.
To do this, you first have to create a very minimal "role" for this user allowing them to list databases, and then create a user with both this role and the role for reading and writing your other database:
use admin
db.runCommand({ createRole: "listDatabases",
privileges: [
{ resource: { cluster : true }, actions: ["listDatabases"]}
],
roles: []
})
db.createUser({
user: "<userName>",
pwd: "<passwd>",
roles: [
{ role: "readWrite", db: "test" },
{ role: "listDatabases", db: "admin" }
]
})
The MongoDB documentation has references for both createRole and createUser, if you want to learn more about these commands.
You're logging in as two different users. Users are scoped by namespace, so user John who lives in test is not the same as user John who lives in admin, though both Johns may have rights in the test database. I think this much you may already understand, but I wanted to clarify it just in case.
I don't believe you can give a user scoped to a non-admin database the listDatabases action in a privilege because the listDatabases action must go with the cluster resource (listDatabases is a cluster-wide sort of operation), and a privilege with a cluster resource can only be scoped to a role on the admin database. Cutting out the jargon of MongoDB's authorization model, a non-admin database user can't use listDatabases because it's a cluster-wide operation and only admin database users should be able to do cluster-wide things.
Just want to add the approach mentioned by i80and works on MongoDB 3.2.3
create custom role that contain listDatabase and specify cluster:true, I did it when specify resource as db, it doesn't work
grant this role to user
Note: make sure you are connected to the correct db when performing security task because you will need to be authenticated using this specific db where the user is created
I've created two users, who I thought were userAdmins. Unfortunately, when I login with them, I get permission denied for everything. If I login locally without providing a username or password, I get permission denied for everything. What can I do?
The users were created using the following commands
use admin
db.createUser(
{
user: "Nikhil",
pwd: "wouldntyouliketoknow",
roles: ["userAdminAnyDatabase" ]
}
)
Does userAdminAnyDatabase not mean what I think it means?
I'm using that you've got authorization security enabled for this to be happening. Why don't you just set security.authorization to disabled and restart mongod?
http://docs.mongodb.org/manual/reference/configuration-options/
As far as the command you issued it looks to be incorrect, should be something like this:
use admin
db.createUser(
{
user: "Nikhil",
pwd: "wouldntyouliketoknow",
roles:
[
{
role: "userAdminAnyDatabase",
db: "admin"
}
]
}
)
Note that you have to pass in a document with both the role and the db into the call.
Best starting point is here: http://docs.mongodb.org/manual/tutorial/enable-authentication/
This user is limited to the userAdmin role on all databases. If you want to perform additional actions you'll need to either grant yourself additional roles or create a new user who has them:
userAdminAnyDatabase
Provides the same access to user administration operations as userAdmin, except it applies to all databases in the cluster. The role also provides the following actions on the cluster as a whole:
authSchemaUpgrade
invalidateUserCache
listDatabases
The role also provides the following actions on the admin.system.users and admin.system.roles collections on the admin database, and on legacy system.users collections from versions of MongoDB prior to 2.6:
collStats
dbHash
dbStats
find
killCursors
planCacheRead
The userAdminAnyDatabase role does not restrict the permissions that a user can grant. As a result, userAdminAnyDatabase users can grant themselves privileges in excess of their current privileges and even can grant themselves all privileges, even though the role does not explicitly authorize privileges beyond user administration. This role is effectively a MongoDB system superuser.
http://docs.mongodb.org/manual/reference/built-in-roles/#built-in-roles
You can simply restart your MongoD without the auth options and it should happily allow you to login and do any operations.
Alternatively you can also enable the bypass for localhost authentication and connect from the same host where you the MongoD is running. You can find more information about it at http://docs.mongodb.org/manual/core/authentication/#localhost-exception
The above mentioned steps may have different behaviour based on version of MongoDB you are using and I would suggest looking up version specific documentation at the mentioned website.
I have a fresh MongoDB 2.4.7 installation. I run commands below in first run:
db.getSiblingDB('admin').addUser({
user: 'root',
pwd: 'root',
roles:['userAdminAnyDatabase', 'dbAdminAnyDatabase']
});
After restarting mongod using --auth, running db.auth('root', 'root') on any dbs fails including admin db.
How can i fix it to have a super user (root access) and add other users for dbs?
You need to authenticate against the admin database and the MongoDB documentation recommend to use this user only to create new users and give appropriated permissions. But if you want to have a super user, also add the role readWriteAnyDatabase.