MongoDB3.0.x版本用户授权配置(单机环境)

时间:2021-06-01 08:42:16

      MongoDB数据库默认情况下是没有做权限控制的,只要能够连接所开放的端口就能进行访问,而且拥有root级别的权限;对于生产环境而言是极不安全的,所以需要建立用户,进行授权控制。

  • 单机环境下的用户授权模块配置:

MongoDB的社区版本中有两个模块可以控制用户的访问:

--auth: 在mongod启动项中加入--auth,mongodb启动后,就可以完成授权模块的启用); PS:虽然auth模块启用后本机还能否登陆到数据库,但是不具备增删改查的权限了,所以启动auth模块之前就应该创建一个超级用户 --keyFile <file>: 主要用于分片集群与副本集相互之间的授权使用,在单机情况下只要用到auth,如果是在集群(分片+副本集)环境下,就必须要用到该参数; security.authorization: 在MongoDB 2.6版本开始,mongod/mongos的启动配置文件增加了YAML格式的写法,功能更auth是一样的,后面的操作中,都是采用该格式 security.keyFile: 格式与security.authorization相同,功能与--keyFile相同。
  • 首先验证下非配置认证模块的访问:

[root@fo169 bin]# ./mongo
MongoDB shell version: 3.0.7
connecting to: test
Server has startup warnings:
2015-10-29T15:12:14.257+0800 I CONTROL [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
2015-10-29T15:12:14.257+0800 I CONTROL [initandlisten]
> show dbs
local 0.000GB

 在没有配置的情况下,登录到数据库后,可以做任何操作。

  • 配置认证模块及重启服务: 

编写了一个启动配置文件:mongodb.conf(文件中标红部分就为auth的授权模块)

[root@fo169 bin]# cat mongodb.conf 
systemLog:
destination: file
path: "/data/auth/log/mongod.log"
logAppend: true
storage:
journal:
enabled: true
dbPath: "/data/auth/db"
directoryPerDB: true
engine: wiredTiger
wiredTiger:
engineConfig:
cacheSizeGB: 4
directoryForIndexes: true
journalCompressor: zlib
collectionConfig:
blockCompressor: zlib
indexConfig:
prefixCompression: true
net:
port: 27017
processManagement:
fork: true
security:
authorization: enabled
  • 创建授权用户(超级管理员): 

MongoDB在V3.0版本之后内置了root 角色,也就是结合了readWriteAnyDatabase、dbAdminAnyDatabase、userAdminAnyDatabase、clusterAdmin4个角色权限,类似于ORACLE的sysdba角色,但是MongoDB的超级管理员用户名称是可以随便定义的:

[root@fo169 bin]# ./mongo
MongoDB shell version:
3.0.7
connecting to: test
Server has startup warnings:
2015-10-30T16:24:36.127+0800 I CONTROL [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
2015-10-30T16:24:36.127+0800 I CONTROL [initandlisten]
> use admin
switched to db admin
> db.createUser(
... {
... user: "ljaiadmin",
... pwd: "123456",
... roles: [ { role: "root", db: "admin"
} ]
... }
... )

Successfully added user: {
"user" : "ljaiadmin",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
]
}

这样就创建好一个ljaiadmin的超级管理员用户,创建全局用户或者超级用户,需要在MongoDB的admin数据库中创建(在其他库也可以创建,但是没有该角色功能),重启完mongod进程后,接下来做一下权限的验证:

[root@fo169 bin]# ./mongo
MongoDB shell version:
3.0.7
connecting to: test
> show dbs (注:此时查看已提示没有授权执行listDatabases命令了)
2015-10-30T16:41:31.131+0800 E QUERY Error: listDatabases failed:{
"ok" : 0,
"errmsg" : "not authorized on admin to execute command { listDatabases: 1.0 }",
"code" : 13
}
at Error (
<anonymous>)
at Mongo.getDBs (src
/mongo/shell/mongo.js:47:15)
at shellHelper.show (src
/mongo/shell/utils.js:630:33)
at shellHelper (src
/mongo/shell/utils.js:524:36)
at (shellhelp2):
1:1 at src/mongo/shell/mongo.js:47
> use admin
switched to db admin
> db.auth('ljaiadmin','123456') (注:切换到admin用户进行授权验证)
1
> show dbs (注:验证完成后,就可以读写等操作)
admin
0.000GB
local
0.000GB
test100
0.000GB
test2
0.000GB
> use test2
switched to db test2
> show tables
test
test2
> db.test2.find()
{
"_id" : ObjectId("5632cf116207909a76446af7"), "name" : "1" }
> db.test2.drop()
true
> db.dropDatabase()
{
"dropped" : "test2", "ok" : 1 }
> show dbs
admin
0.000GB
local
0.000GB
test100
0.000GB
> use test100
switched to db test100
> db.test111.insert({"test":"test"})
WriteResult({
"nInserted" : 1 })
> db.test111.find()
{
"_id" : ObjectId("56332db373f771b3d95638bb"), "test" : "test" }
> use admin
switched to db admin
> show users
{
"_id" : "admin.ljaiadmin",
"user" : "ljaiadmin",
"db" : "admin",
"roles" : [
{
"role" : "root",
"db" : "admin"
}
]
}
>
  • 创建普通用户

用可以对test123数据库读写的rwtest123用户为例:

> use test123
switched to db test123
> db.createUser(
... {
... user: "rwtest123",
... pwd: "123456",
... roles: [ { role: "readWrite", db: "test123"
} ]
... }
... )

Successfully added user: {
"user" : "rwtest123",
"roles" : [
{
"role" : "readWrite",
"db" : "test123"
}
]
}

#所建的rwtest123用户可以在test123数据库中进行增删改查操作,但是其他操作就不行了
>db.auth('rwtest123','123456')
switched to db test123
> db.test123.insert({"test":"test"})
WriteResult({
"nInserted" : 1 })
> db.test123.find()
{
"_id" : ObjectId("563332ebc8a59ae4fe96bbf5"), "test" : "test" }
> db.test123.drop()
true
> use test100
switched to db test100
> db.test100.find()
Error: error: {
"$err" : "not authorized for query on test100.test100", "code" : 13 }
>
  • 配置参考:

 MongoDB数据库的用户权限控制权限还是比较多的,有系统自带的,已经定义好的角色,也可以自己定义角色权限,需要根据业务需要进行权限分配:

自带角色的说明(一般内置的角色基本上就可以满足生产环境需求了):

https://docs.mongodb.org/manual/core/security-built-in-roles/

用户自行定义角色的说明:

https://docs.mongodb.org/manual/core/security-user-defined-roles/

用户管理配置的说明

https://docs.mongodb.org/manual/reference/method/#user-management-methods