在 Mongo 数据库实例中为特定数据库创建只读用户

Question

I have created a user " mongo01testro " in the mongo01test database.

use mongo01test 
db.addUser( "mongo01testro", "pwd01", true );
db.system.users.find();
{ "_id" : ObjectId("53xyz"), "user" : "mongo01testro", "readOnly" : true, "pwd" : "b9eel61" }

When I logged in from another session as this newly created user, I am able to insert documents into the collection which is strange.

I am looking to do the following:

1. Create 2 separate users one for read only and one for read write for each database.
2. Create an admin user which have sysadmin/dba access to all the databases in MongoDB instance used for Backup/Recovery or admin purpose.

Please kindly help.

Regards, Parag

Answer 1

You forgot --auth to enable

Create Users

// ensure that we have new db, no roles, no users
use products
db.dropDatabase()

// create admin user
use products
db.createUser({
    "user": "prod-admin",
    "pwd": "prod-admin",
    "roles": [
        {"role": "clusterAdmin", "db": "admin" },
        {"role": "readAnyDatabase", "db": "admin" },
    "readWrite"
    ]},
    { "w": "majority" , "wtimeout": 5000 }
)

// login via admin acont in order to create readonly user
// mongo --username=prod-admin --password=prod-admin products
db.createUser({
    "user": "prod-r",
    "pwd": "prod-r",
    "roles": ["read"]
})

Enable auth:

sudo vim /etc/mongod.conf # edit file
    # Turn on/off security.  Off is currently the default
    #noauth = true
    auth = true
sudo service mongod restart # reload configuiration

Check write restriction:

# check if write operation for readonly user
$ mongo --username=prod-r --password=prod-r products
MongoDB shell version: 2.6.4
connecting to: products
> db.laptop.insert({"name": "HP"})
WriteResult({
    "writeError" : {
        "code" : 13,
        "errmsg" : "not authorized on products to execute command { insert: \"laptop\", documents: [ { _id: ObjectId('53ecb7115f0bfc61d8b1113e'), name: \"HP\" } ], ordered: true }"
    }
})

# check write operation for admin user
$ mongo --username=prod-admin --password=prod-admin products
MongoDB shell version: 2.6.4
connecting to: products
> db.laptop.insert({"name": "HP"})
WriteResult({ "nInserted" : 1 })

# check read operation for readonly user    
$ mongo --username=prod-r --password=prod-r products
MongoDB shell version: 2.6.4
connecting to: products
> db.laptop.findOne()
{ "_id" : ObjectId("53ecb54798da304f99625d05"), "name" : "HP" }

Answer 2

MongoDB changed the way it handles users in versions >= 2.2 and 2.6 and if you are updating mongodb you will have to Upgrade User Authorization Data to 2.6 Format .

In versions < 2.2 (legacy) you use the db.addUser(username, password, readOnly) function as @Hüseyin BABAL suggested. If you are using version > 2.2 or 2.6 you have a lot more control over what you can do with roles and privileges.

So assuming you use mongo v > 2.6 you can create something like:

use admin

db.createUser({
    user: "myUsername",
    pwd: "mypwd",
    roles: [{
        role: "userAdminAnyDatabase",
        db: "admin"
    }]
})

db.addUser({
    user: "username",
    pwd: "password",
    roles: [{
        role: "readWrite",
        db: "myDBName"
    }]
})

You can use the Build in Roles or you can even create custom roles .

So as you can see you clearly have a lot more options when using v > 2.6 when it comes to authentication and role management.

Answer 3

if the Access control is enabled on the MongoDB deployment, Then you should login by authenticating to the relevant database with admin user (or user with userAdmin role) which you want to control the access. to do that

mongo <db_name> -u <user_name> -p <user_password>

ex: mongo mongo01test -u admin -p admin_paaswrod

then execute the following query to create a read only user for current connected database,

db.createUser({user:"user_name",pwd:"password",roles:[{role:"read", db:"db_name"}]});

ex: db.createUser({user:"user_rd",pwd:"password",roles:[{role:"read", db:"mongo01test"}]});

create a user with both readWrite access ,

db.createUser({user:"user_name",pwd:"password",roles:[{role:"readWrite", db:"db_name"}]});

ex: db.createUser({user:"user_rw",pwd:"pass_rw",roles:[{role:"readWrite", db:"mongo01test"}]});

to create a user with admin privileges,

use admin;
db.createUser({user:"admin_user_name",pwd:"password", roles:[{role:"dbAdmin", db:"admin"},{role:"readWriteAnyDatabase", db:"admin"},{role:"backup", db:"admin"},{role:"restore", db:"admin"}]});

Answer 4

Here is my scneario;

// Create admin user
use admin
db.addUser('root', 'strong_password');

// Read only user
use dbforuser1
db.addUser('user1', 'user1_pass', true);

// Read / Write access
use dbforuser2
db.addUser('user2', 'user2_pass');

If you want to login to dbforuser1

use dbforuser1
db.auth('user1', 'user1_pass')