0

Like in a certain way in MySQL.

CREATE 'dbuser'@'10.1.0.1' identitifed by 'password';

GRANT USAGE on *.* to 'dbuser'@'10.1.0.1';

We are not using any mongodb tools except for Robo

1

When you create a user then you can specify Authentication Restrictions

Would be like this:

use admin
db.createUser(
   {
     user: "dbuser",
     pwd: "password"
     roles: [ { role: "readWrite", db: "reporting" } ],
     authenticationRestrictions: [ {
        clientSource: ["192.0.2.0"],
        serverAddress: ["198.51.100.0"]
     } ]
   }
)

But for me it is not clear, if you are looking for this.

5
  • Hi Wenfried. Considering the reporting machine is the clientSource(192.0.2.0) How can I restrict this 192.0.2.0 from using any other user apart from dbuser? Like the mongo user that our app is using. – JRA Jan 26 at 8:49
  • I don't think you can do it. If someone has other credentials (e.g. let's say admin user) then he can connect to your DB. Actually you cannot prevent the user to use any other client (e.g. the mongo shell) for connection. You cannot force him to use only your application. – Wernfried Domscheit Jan 26 at 10:05
  • @Wenfried like for example i have a user with clientSource: ["10.1.0.0/16", "127.0.0.1"] cant I restrict 1 IP from 10.1.0.0/16? Lets say 10.1.0.23 – JRA Jan 27 at 6:12
  • I thought of a workaround like indicating all IP within the CIDR block of 10.1.0.0/16 but it is messy. – JRA Jan 27 at 6:25
  • @JRA clientSource restrictions can be an array of IP addresses and/or CIDR ranges, so you can set up appropriate restrctions per MongoDB user. To prevent 192.0.2.0 from authenticating with any credentials other than dbuser, you would make sure this IP isn't included in the clientSource addresses or ranges for other users. Where possible I would also limit guest access to interacting via an API rather than providing direct access to your MongoDB deployment. – Stennie Feb 1 at 0:53
-2

In mongodb config file, you should specify bind_address value to your desired ip.

2
  • 2
    I cannot see that parameter in the documentation, and even if it exists, it will contain the server's IP address, not the client's. – Laurenz Albe Jan 26 at 8:08
  • i think this is not it. i dont want to bind_address to a specific IP. I just want to know if there can be restriction to a specific mongodb user to a certain IP. The scenario is this: we have a guest VM where the users can extract data. that VM's vnet is within our Production VNET. now the risk is if the guest user somehow able to know the mongodb credentials of our app's mongodb. Then the data is exposed and can be manipulated. In MySQL, even if that guest user was able to connect on our Prod VM, by executing "GRANT USAGE app_user@10.1.0.1;" he wont see anything on the Database. – JRA Jan 26 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.