0

I'm setting up a sharded cluster. I've enabled TLS and added certificates to each server in my shards/config replica sets and also my mongos instance. But is it still possible to connect to the mongos instance using username/password?

This is my mongos config:

systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongos.log

net:
  tls:
    mode: requireTLS
    CAFile: /etc/ssl/root-ca.pem
    certificateKeyFile: /etc/ssl/192.168.1.67.pem
  bindIp: 127.0.0.1,192.168.1.67

sharding:
  configDB: config/192.168.1.69:27017

security:
  clusterAuthMode: x509

processManagement:
  fork: true
  • Yes, your cluster is still public, e.i. you can connect without any password. You have to set security.authorization=true to enable authentication. With your settings you just protected the internal communication between mongos/config/shard servers. – Wernfried Domscheit Feb 4 at 11:48
  • That does not seem to be the case, when I try to connect to mongos through mongo 192.168.1.67 I get this error: DBClientConnection failed to receive message from 192.168.1.67:27017 - HostUnreachable: Connection closed by peer And in my mongos logs I get Error receiving request from client: SSLHandshakeFailed: The server is configured to only allow SSL connections. Ending connection from 192.168.1.67:43604 (connection id: 219) – Thiatt Feb 4 at 13:13
  • Also security.authorization is not a valid option for mongos: Unrecognized option: security.authorization try 'mongos --help' for more information – Thiatt Feb 4 at 13:15
  • I also get the same Connection closed by peer message if I try to mongo to any of the servers (config/shards) in the cluster without TLS options – Thiatt Feb 4 at 13:18
  • security.authorization is not set for mongos (but security.keyFile must be provided). It must be enabled on config/shards. The mongos does not authenticate anything, it asks the config for user authentication when you connect to it. – Wernfried Domscheit Feb 4 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.