mongoDB安全认证

mongoDB的用户

• 为了更安全的访问mongodb，需要访问者提供用户名和密码，于是需要在mongodb中创建用户
• 采用了角色-用户-数据库的安全管理方式
• 常用系统角色如下：
  • root：只在admin数据库中可用，超级账号，超级权限
  • Read：允许用户读取指定数据库
  • readWrite：允许用户读写指定数据库

查看当前数据库的用户

进入某个数据库，show users

#查看admin下的user>use admin> show users{"_id" : "admin.admin","user" : "admin","db" : "admin","roles" : [{"role" : "root","db" : "admin"}]}

查看所有的用户

所有用户存放在admin下的system.users中。

#需要创建用户，才有system.users表 >use admin> show collectionssystem.userssystem.version> db.system.users.find().pretty(){    "_id" : "admin.admin",    "user" : "admin",    "db" : "admin",    "credentials" : {        "SCRAM-SHA-1" : {            "iterationCount" : 10000,            "salt" : "Y6bNta3VDUJqk4xjQ0Vl2Q==",            "storedKey" : "qEmqVlt9RrhCI7YlVbFexFD/KRY=",            "serverKey" : "VW8aXgrus5gnIS91ctZtPkQ5Zbw="        }    },    "roles" : [        {            "role" : "root",            "db" : "admin"        }    ]}{    "_id" : "student.student",    "user" : "student",    "db" : "student",    "credentials" : {        "SCRAM-SHA-1" : {            "iterationCount" : 10000,            "salt" : "r/47HvEW/Zl3DVABKhqkRw==",            "storedKey" : "XpU9+rFnY9GNvHCPHehUJd0sOEY=",            "serverKey" : "V5FhopPRzL5/l7daXcxYFhQp73g="        }    },    "roles" : [        {            "role" : "read",            "db" : "student"        }    ]}{    "_id" : "student.studentW",    "user" : "studentW",    "db" : "student",    "credentials" : {        "SCRAM-SHA-1" : {            "iterationCount" : 10000,            "salt" : "ida3QywWsTAhjCd+cLOfvA==",            "storedKey" : "+YOrrJus5SCPZQ4zYxWXjMs/agA=",            "serverKey" : "o/mXTlmQW6umnRhNUHSTDBUiccM="        }    },    "roles" : [        {            "role" : "readWrite",            "db" : "student"        }    ]}

创建超级管理用户

#进入admin数据库> use adminswitched to db admin> show collectionssystem.version> db.createUser({... user:'admin',... pwd:'123',... roles:[{role:'root',db:'admin'}]... })Successfully added user: {"user" : "admin","roles" : [{"role" : "root","db" : "admin"}]}> show users{"_id" : "admin.admin","user" : "admin","db" : "admin","roles" : [{"role" : "root","db" : "admin"}]}

创建只读用户

#进入student数据库，创建一个只对student有读权限的用户> use studentswitched to db student> db.createUser({... user:'student',... pwd:'123',... roles:[{role:'read',db:'student'}]... })Successfully added user: {"user" : "student","roles" : [{"role" : "read","db" : "student"}]}> show users{"_id" : "student.student","user" : "student","db" : "student","roles" : [{"role" : "read","db" : "student"}]}

创建读写用户

#进入student数据库，创建一个只对student读写权限的用户>use studet> db.createUser({... user:'studentW',... pwd:'123',... roles:[{role:'readWrite',db:'student'}]... })Successfully added user: {"user" : "studentW","roles" : [{"role" : "readWrite","db" : "student"}]}

启用安全认证

• 修改配置文件,启用身份验证

  sudo vi /etc/mongodb.conf#添加auth = true

• 重启服务

  sudo service mongod stopsudo service mongod start

• 终端连接

  #mongo --help#管理员mongo -u 'admin' -p '123' --authenticationDatabase 'admin'#普通用户mongo -u student -p 123 --authenticationDatabase student

• 认证失败

  MongoDB shell version v3.4.0connecting to: mongodb://127.0.0.1:27017MongoDB server version: 3.4.02017-09-14T15:43:52.639+0800 E QUERY    [main] Error: Authentication failed. :DB.prototype._authOrThrow@src/mongo/shell/db.js:1459:20@(auth):6:1@(auth):1:2exception: login failed

用户管理

• 修改用户：可以修改pwd、roles属性

  use studentdb.updateUser(    'student',    {pwd:'12345'},    {roles:[{role:'read',db:'student'}]})

• 删除用户
  

  use studentdb.dropUser('student')