mongodb安全

Posted 2020-10-28 Qiao_Zhi

 1.流程:

　　(1)创建超级管理员

　　(2)修改配置文件，验证身份登录

　　(3)重启服务

　　(4)使用超级管理员登录

　　(5)创建普通用户

　　(6)使用普通用户登录对应的数据库

 

 

 

 

mongodb数据库角色:

 

 

1创建用户:(只要指明角色和授予的数据库)

 

创建用户:(注意切换到admin数据库:)

> use admin
switched to db admin
> db.createUser({"user":"root",pwd:"123456",roles:[{role:"root",db:"admin"}]})
Successfully added user: {
        "user" : "root",
        "roles" : [
                {
                        "role" : "root",
                        "db" : "admin"
                }
        ]
}

 

 

 

 2.修改配置文件，启动验证身份:

•  linux下面修改/etc/mongod.conf (注意后面有空格)

 

重启服务即可

 

 

• windows下面:  在启动mongod的时候后面携带--auth 参数，其中参数有很多，在最后会附上启动参数。

mongod --auth

 

　　如果需要制定数据路径:

mongod --auth --dbpath c:\\data\\db

 

 

　　因此可以将上面命令写入一bat脚本。(前提是将mongod的目录配置到环境变量path)

 

例如我的一个bat脚本:(我的安装目录是E:\\mongodb\\mongodb-win32-x86_64-enterprise-windows-64-3.6.3\\bin)

e:
cd E:\\mongodb\\mongodb-win32-x86_64-enterprise-windows-64-3.6.3\\bin
mongod.exe --auth --dbpath c:\\data\\db
pause

 

 

 3.登录数据库:(需要制定数据库和密码)

 直接登录:

mongo -u root -p 123456 --authenticationDatabase admin

 

　　这是以管理员身份登录，登录之后可以对任何数据库进行操作

 

因此将上面命令也可以写成一个脚本:

e:
cd E:\\mongodb\\mongodb-win32-x86_64-enterprise-windows-64-3.6.3\\bin
mongod.exe --auth --dbpath c:\\data\\db
pause

 

 

 

4.实际开发中是超级管理员创建一普通账户并给其分配对应的数据库，因此此用户只能操作其对应的数据库

•  创建普通用户(对mydb数据库具有读写权限，账号密码都是user)

db.createUser({
    "user":"user",
    "pwd":"user",
    roles:[{
        "role":"readWrite",
        "db":"mydb"
        }]
    })

 

 

 

 

•  重启服务之后测试:

C:\\Users\\liqiang>mongo -u user -p user --authenticationDatabase admin　　#普通用户登录admin数据库报错
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27017
MongoDB server version: 3.6.3
2018-03-26T22:32:07.191+0800 E QUERY    [thread1] Error: Authentication failed.
:
DB.prototype._authOrThrow@src/mongo/shell/db.js:1608:20
@(auth):6:1
@(auth):1:2
exception: login failed

C:\\Users\\liqiang>mongo -u user -p user --authenticationDatabase mydb　　#普通用户登录分配给他的mydb数据库正常
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27017
MongoDB server version: 3.6.3

 

 

 

MongoDB Enterprise > db
admin
MongoDB Enterprise > use mydb　　#访问admin数据库报错
switched to db mydb
MongoDB Enterprise > show tables   #访问mydb正常
mydb
MongoDB Enterprise >

 

 

 

 

 

 

附一些mongod启动参数:

C:\\Users\\liqiang>mongod/?
Invalid command: /?
Options:

General options:
  -h [ --help ]                         show this usage information
  --version                             show version information
  -f [ --config ] arg                   configuration file specifying
                                        additional options
  -v [ --verbose ] [=arg(=v)]           be more verbose (include multiple times
                                        for more verbosity e.g. -vvvvv)
  --quiet                               quieter output
  --port arg                            specify port number - 27017 by default
  --bind_ip arg                         comma separated list of ip addresses to
                                        listen on - localhost by default
  --bind_ip_all                         bind to all ip addresses
  --ipv6                                enable IPv6 support (disabled by
                                        default)
  --listenBacklog arg (=2147483647)     set socket listen backlog size
  --maxConns arg                        max number of simultaneous connections
                                        - 1000000 by default
  --logpath arg                         log file to send write to instead of
                                        stdout - has to be a file, not
                                        directory
  --logappend                           append to logpath instead of
                                        over-writing
  --logRotate arg                       set the log rotation behavior
                                        (rename|reopen)
  --timeStampFormat arg                 Desired format for timestamps in log
                                        messages. One of ctime, iso8601-utc or
                                        iso8601-local
  --redactClientLogData                 Redact client data written to the
                                        diagnostics log
  --pidfilepath arg                     full path to pidfile (if not set, no
                                        pidfile is created)
  --timeZoneInfo arg                    full path to time zone info directory,
                                        e.g. /usr/share/zoneinfo
  --keyFile arg                         private key for cluster authentication
  --noauth                              run without security
  --setParameter arg                    Set a configurable parameter
  --transitionToAuth                    For rolling access control upgrade.
                                        Attempt to authenticate over outgoing
                                        connections and proceed regardless of
                                        success. Accept incoming connections
                                        with or without authentication.
  --clusterAuthMode arg                 Authentication mode used for cluster
                                        authentication. Alternatives are
                                        (keyFile|sendKeyFile|sendX509|x509)
  --networkMessageCompressors [=arg(=disabled)] (=snappy)
                                        Comma-separated list of compressors to
                                        use for network messages
  --auth                                run with security
  --clusterIpSourceWhitelist arg        Network CIDR specification of permitted
                                        origin for `__system` access.
  --slowms arg (=100)                   value of slow for profile and console
                                        log
  --slowOpSampleRate arg (=1)           fraction of slow ops to include in the
                                        profile and console log
  --profile arg                         0=off 1=slow, 2=all
  --cpu                                 periodically show cpu and iowait
                                        utilization
  --sysinfo                             print some diagnostic system
                                        information
  --noIndexBuildRetry                   don\'t retry any index builds that were
                                        interrupted by shutdown
  --noscripting                         disable scripting engine
  --notablescan                         do not allow table scans

Windows Service Control Manager options:
  --install                             install Windows service
  --remove                              remove Windows service
  --reinstall                           reinstall Windows service (equivalent
                                        to --remove followed by --install)
  --serviceName arg                     Windows service name
  --serviceDisplayName arg              Windows service display name
  --serviceDescription arg              Windows service description
  --serviceUser arg                     account for service execution
  --servicePassword arg                 password used to authenticate
                                        serviceUser

Replication options:
  --oplogSize arg                       size to use (in MB) for replication op
                                        log. default is 5% of disk space (i.e.
                                        large is good)

Master/slave options (old; use replica sets instead):
  --master                              master mode
  --slave                               slave mode
  --source arg                          when slave: specify master as
                                        <server:port>
  --only arg                            when slave: specify a single database
                                        to replicate
  --slavedelay arg                      specify delay (in seconds) to be used
                                        when applying master ops to slave
  --autoresync                          automatically resync if slave data is
                                        stale

Replica set options:
  --replSet arg                         arg is <setname>[/<optionalseedhostlist
                                        >]
  --replIndexPrefetch arg               specify index prefetching behavior (if
                                        secondary) [none|_id_only|all]
  --enableMajorityReadConcern [=arg(=1)] (=1)
                                        enables majority readConcern

Sharding options:
  --configsvr                           declare this is a config db of a
                                        cluster; default port 27019; default
                                        dir /data/configdb
  --shardsvr                            declare this is a shard db of a
                                        cluster; default port 27018

SSL options:
  --sslOnNormalPorts                    use ssl on configured ports
  --sslMode arg                         set the SSL operation mode
                                        (disabled|allowSSL|preferSSL|requireSSL
                                        )
  --sslPEMKeyFile arg                   PEM file for ssl
  --sslPEMKeyPassword arg               PEM file password
  --sslClusterFile arg                  Key file for internal SSL
                                        authentication
  --sslClusterPassword arg              Internal authentication key file
                                        password
  --sslCAFile arg                       Certificate Authority file for SSL
  --sslCRLFile arg                      Certificate Revocation List file for
                                        SSL
  --sslDisabledProtocols arg            Comma separated list of TLS protocols
                                        to disable [TLS1_0,TLS1_1,TLS1_2]
  --sslWeakCertificateValidation        allow client to connect without
                                        presenting a certificate
  --sslAllowConnectionsWithoutCertificates
                                        allow client to connect without
                                        presenting a certificate
  --sslAllowInvalidHostnames            Allow server certificates to provide
                                        non-matching hostnames
  --sslAllowInvalidCertificates         allow connections to servers with
                                        invalid certificates
  --sslFIPSMode                         activate FIPS 140-2 mode at startup

Storage options:
  --storageEngine arg                   what storage engine to use - defaults
                                        to wiredTiger if no data files present
  --dbpath arg                          directory for datafiles - defaults to
                                        \\data\\db\\ which is C:\\data\\db\\ based on
                                        the current working drive
  --directoryperdb                      each database will be stored in a
                                        separate directory
  --noprealloc                          disable data file preallocation - will
                                        often hurt performance
  --nssize arg (=16)                    .ns file size (in MB) for new databases
  --quota                               limits each database to a certain
                                        number of files (8 default)
  --quotaFiles arg                      number of files allowed per db, implies
                                        --quota
  --smallfiles                          use a smaller default file size
  --syncdelay arg (=60)                 seconds between disk syncs (0=never,
                                        but not recommended)
  --upgrade                             upgrade db if needed
  --repair                              run repair on all dbs
  --repairpath arg                      root directory for repair files -
                                        defaults to dbpath
  --journal                             enable journaling
  --nojournal                           disable journaling (journaling is on by
                                        default for 64 bit)
  --journalOptions arg                  journal diagnostic options
  --journalCommitInterval arg           how often to group/batch commit (ms)

Auditing Options:
  --auditDestination arg                Destination of audit log output.
                                        (console/syslog/file)
  --auditFormat arg                     Format of the audit log, if logging to
                                        a file.  (BSON/JSON)
  --auditPath arg                       full filespec for audit log file
  --auditFilter arg                     filter spec to screen audit records

Kerberos Options:
  --sspiHostnameCanonicalization arg (=none)
                                        DNS resolution strategy to use for
                                        hostname canonicalization. May be one
                                        of: {none, forward, forwardAndReverse}

SNMP Module Options:
  --snmp-subagent                       run snmp subagent
  --snmp-master                         run snmp as master

Encryption at rest options:
  --enableEncryption                    Enable encryption at rest
  --encryptionKeyFile arg               File path for encryption key file
  --encryptionCipherMode arg            Cipher mode to use for encryption at
                                        rest
  --kmipRotateMasterKey                 Rotate master encryption key
  --kmipKeyIdentifier arg               KMIP unique identifier for existing key
                                        to use
  --kmipServerName arg                  KMIP server host name
  --kmipPort arg                        KMIP server port (defaults to 5696)
  --kmipClientCertificateFile arg       Client certificate for authenticating
                                        to KMIP server
  --kmipClientCertificatePassword arg   Client certificate for authenticating
                                        Mongo to KMIP server
  --kmipServerCAFile arg                CA File for validating connection to
                                        KMIP server

LDAP Module Options:
  --ldapServers arg                     Comma separated list of LDAP servers on
                                        format  host:port
  --ldapTransportSecurity arg (=tls)    Transport security used between MongoDB
                                        and remote LDAP server(none|tls)
  --ldapBindWithOSDefaults              Peform queries with the service
                                        account\'s username and password
  --ldapBindMethod arg (=simple)        Authentication scheme to use while
                                        connecting to LDAP. This may either be
                                        \'sasl\' or \'simple\'
  --ldapBindSaslMechanisms arg (=DIGEST-MD5)
                                        Comma separated list of SASL mechanisms
                                        to use while binding to the LDAP server
  --ldapTimeoutMS arg (=10000)          Timeout for LDAP queries (ms)
  --ldapQueryUser arg                   LDAP entity to bind with to perform
                                        queries
  --ldapQueryPassword arg               Password to use while binding to the
                                        LDAP server to perform queries
  --ldapUserToDNMapping arg (=[{match: "(.+)", substitution: "{0}"}])
                                        Tranformation from MongoDB users to
                                        LDAP user DNs
  --ldapAuthzQueryTemplate arg          Relative LDAP query URL which will be
                                        queried against the host to acquire
                                        LDAP groups. The token {USER} will be
                                        replaced with the mapped username

WiredTiger options:
  --wiredTigerCacheSizeGB arg           maximum amount of memory to allocate
                                        for cache; defaults to 1/2 of physical
                                        RAM
  --wiredTigerJournalCompressor arg (=snappy)
                                        use a compressor for log records
                                        [none|snappy|zlib]
  --wiredTigerDirectoryForIndexes       Put indexes and data in different
                                        directories
  --wiredTigerCollectionBlockCompressor arg (=snappy)
                                        block compression algorithm for
                                        collection data [none|snappy|zlib]
  --wiredTigerIndexPrefixCompression arg (=1)
                                        use prefix compression on row-store
                                        leaf pages

InMemory options:
  --inMemorySizeGB arg                  maximum amount of memory to allocate
                                        for InMemory data; defaults to 50% of
                                        physical RAM less 1GB

 

 

附一些mongo的参数:

C:\\Users\\liqiang>mongo -help
MongoDB shell version v3.6.3
usage: mongo [options] [db address] [file names (ending in .js)]
db address can be:
  foo                   foo database on local machine
  192.168.0.5/foo       foo database on 192.168.0.5 machine
  192.168.0.5:9999/foo  foo database on 192.168.0.5 machine on port 9999
Options:
  --shell                               run the shell after executing files
  --nodb                                don\'t connect to mongod on startup - no
                                        \'db address\' arg expected
  --norc                                will not run the ".mongorc.js" file on
                                        start up
  --quiet                               be less chatty
  --port arg                            port to connect to
  --host arg                            server to connect to
  --eval arg                            evaluate javascript
  -h [ --help ]                         show this usage information
  --version                             show version information
  --verbose                             increase verbosity
  --ipv6                                enable IPv6 support (disabled by
                                        default)
  --disableJavaScriptJIT                disable the Javascript Just In Time
                                        compiler
  --disableJavaScriptProtection         allow automatic JavaScript function
                                        marshalling
  --ssl                                 use SSL for all connections
  --sslCAFile arg                       Certificate Authority file for SSL
  --sslPEMKeyFile arg                   PEM certificate/key file for SSL
  --sslPEMKeyPassword arg               password for key in PEM file for SSL
  --sslCRLFile arg                      Certificate Revocation List file for
                                        SSL
  --sslAllowInvalidHostnames            allow connections to servers with
                                        non-matching hostnames
  --sslAllowInvalidCertificates         allow connections to servers with
                                        invalid certificates
  --sslFIPSMode                         activate FIPS 140-2 mode at startup
  --retryWrites                         automatically retry write operations
                                        upon transient network errors
  --jsHeapLimitMB arg                   set the js scope\'s heap size limit

Authentication Options:
  -u [ --username ] arg                 username for authentication
  -p [ --password ] arg                 password for authentication
  --authenticationDatabase arg          user source (defaults to dbname)
  --authenticationMechanism arg         authentication mechanism
  --gssapiServiceName arg (=mongodb)    Service name to use when authenticating
                                        using GSSAPI/Kerberos
  --gssapiHostName arg                  Remote host name to use for purpose of
                                        GSSAPI/Kerberos authentication

Kerberos Options:
  --sspiHostnameCanonicalization arg (=none)
                                        DNS resolution strategy to use for
                                        hostname canonicalization. May be one
                                        of: {none, forward, forwardAndReverse}

file names: a list of files to run. files have to end in .js and will exit after
 unless --shell is specified