1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
| ---创建管理用户
use admin
db.createUser(
{
user: "admin", //用户名
pwd: "admin123", //密码
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] //权限
}
)
db.createUser({
user: "<name>",
pwd: passwordPrompt(), // Or "<cleartext password>"
customData: { <any information> },
roles: [
{ role: "<role>", db: "<database>" } | "<role>",
...
],
authenticationRestrictions: [
{
clientSource: ["<IP>" | "<CIDR range>", ...],
serverAddress: ["<IP>" | "<CIDR range>", ...]
},
...
],
mechanisms: [ "<SCRAM-SHA-1|SCRAM-SHA-256>", ... ],
passwordDigestor: "<server|client>"
})
user文档字段介绍：
user字段，为新用户的名字；
pwd字段，用户的密码；
cusomData字段，为任意内容，例如可以为用户全名介绍；
roles字段，指定用户的角色，可以用一个空数组给新用户设定空角色；
在roles字段,可以指定内置角色和用户定义的角色。
MongoDB内置角色有如下：
数据库用户角色：read、readWrite;
数据库管理角色：dbAdmin、dbOwner、userAdmin；
集群管理角色：clusterAdmin、clusterManager、clusterMonitor、hostManager；
备份恢复角色：backup、restore；
所有数据库角色：readAnyDatabase、readWriteAnyDatabase、userAdminAnyDatabase、dbAdminAnyDatabase
超级用户角色：root
// 这里还有几个角色间接或直接提供了系统超级用户的访问（dbOwner 、userAdmin、userAdminAnyDatabase）
内部角色：__system
---创建用户
> db.createUser({user:'admin', pwd:'admin', roles:[{role:'userAdminAnyDatabase', db:'admin'}]})
Successfully added user: {
"user" : "admin",
"roles" : [
{
"role" : "userAdminAnyDatabase",
"db" : "admin"
}
]
}
---密码安全创建，隐藏密码明文显示
db.createUser({
user:'admin',
pwd: passwordPrompt(),
roles: [{role:'userAdminAnyDatabase', db:'admin'}]
})
---查看用户
> show tables
system.users
system.version
> db.system.users.find()
{ "_id" : "admin.admin", "userId" : UUID("b1ab097f-9529-4529-8c00-bb68196f45a1"), "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "c4hGe+qnYR8+ik9dLGvAbw==", "storedKey" : "4MpXzwRfpNSketCneHywv4lFVXg=", "serverKey" : "CuQ0I8bUBRZq5HoqZZo/A72OFD4=" }, "SCRAM-SHA-256" : { "iterationCount" : 15000, "salt" : "gBG6Q2kc/jzYJFB0QQMAYgpQY1PMAvK6NdzvCQ==", "storedKey" : "phSxuVeYCX7+V4u+wT/fT/pfbVsA1ikJbwsm2mKzhTM=", "serverKey" : "c/OTe1V4RWRyuNulGeW0eTQanskI9OFxzPwdS2qwpfU=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
>
---添加权限认证
vim /etc/mogod.conf
security:
authorization: enabled //添加权限设置
如果没有使用/etc/mongod.conf参数启动mongoDB,而是在命令行启动mongoDB，则在命令行加入--auth参数即可:
[mongod@mongodb ~]$ mongod --auth --dbpath /data/mongodb
[mongod@mongodb ~]$ mongod --auth --dbpath /data/mongodb --logpath /usr/local/mongodb/mongod.log --fork
---重启mongodb
systemctl restart mongod
---登录
mongo -u accountAdmin01 -p yourpassward --authenticationDatabase products
[mongod@test ~]$ mongo -u admin -p admin --host 192.168.1.112 --authenticationDatabase admin
[mongod@test ~]$ mongo -u admin -p admin --host 192.168.1.112 admin
[mongod@test ~]$ mongo -u admin -p admin 192.168.1.112/admin
> show databases
admin 0.000GB
config 0.000GB
local 0.000GB
mydb 0.000GB
> use mydb
switched to db mydb
> show tables
dep
orders
user
> db.user.find()
Error: error: {
"ok" : 0,
"errmsg" : "not authorized on mydb to execute command { find: \"user\", filter: {}, lsid: { id: UUID(\"49bb9445-8cc7-4785-896b-ccb8a61d9250\") }, $db: \"mydb\" }",
"code" : 13,
"codeName" : "Unauthorized"
}
---命令行不使用密码，需要连接后进行校验db.auth('admin','admin')
[mongod@mongodb ~]$ mongosh admin
Current Mongosh Log ID: 6617d234ce397bea4e7b2da8
Connecting to: mongodb://127.0.0.1:27017/admin?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+2.2.2
Using MongoDB: 6.0.14
Using Mongosh: 2.2.2
For mongosh info see: https://docs.mongodb.com/mongodb-shell/
Deprecation warnings:
- Using mongosh on the current operating system is deprecated, and support may be removed in a future release.
See https://www.mongodb.com/docs/mongodb-shell/install/#supported-operating-systems for documentation on supported platforms.
admin> show tables
MongoServerError[Unauthorized]: command listCollections requires authentication
admin> db.auth('admin','admin')
{ ok: 1 }
admin> show tables
system.users
system.version
|
