Like in a certain way in MySQL.
CREATE 'dbuser'@'10.1.0.1' identitifed by 'password';
GRANT USAGE on *.* to 'dbuser'@'10.1.0.1';
We are not using any mongodb tools except for Robo
When you create a user then you can specify Authentication Restrictions
Would be like this:
use admin
db.createUser(
{
user: "dbuser",
pwd: "password"
roles: [ { role: "readWrite", db: "reporting" } ],
authenticationRestrictions: [ {
clientSource: ["192.0.2.0"],
serverAddress: ["198.51.100.0"]
} ]
}
)
But for me it is not clear, if you are looking for this.
-
Hi Wenfried. Considering the reporting machine is the clientSource(192.0.2.0) How can I restrict this 192.0.2.0 from using any other user apart from dbuser? Like the mongo user that our app is using. – JRA Jan 26 at 8:49
-
I don't think you can do it. If someone has other credentials (e.g. let's say admin user) then he can connect to your DB. Actually you cannot prevent the user to use any other client (e.g. the mongo shell) for connection. You cannot force him to use only your application. – Wernfried Domscheit Jan 26 at 10:05
-
@Wenfried like for example i have a user with clientSource: ["10.1.0.0/16", "127.0.0.1"] cant I restrict 1 IP from 10.1.0.0/16? Lets say 10.1.0.23 – JRA Jan 27 at 6:12
-
I thought of a workaround like indicating all IP within the CIDR block of 10.1.0.0/16 but it is messy. – JRA Jan 27 at 6:25
-
@JRA
clientSourcerestrictions can be an array of IP addresses and/or CIDR ranges, so you can set up appropriate restrctions per MongoDB user. To prevent 192.0.2.0 from authenticating with any credentials other thandbuser, you would make sure this IP isn't included in theclientSourceaddresses or ranges for other users. Where possible I would also limit guest access to interacting via an API rather than providing direct access to your MongoDB deployment. – Stennie Feb 1 at 0:53
In mongodb config file, you should specify bind_address value to your desired ip.
-
2I cannot see that parameter in the documentation, and even if it exists, it will contain the server's IP address, not the client's. – Laurenz Albe Jan 26 at 8:08
-
i think this is not it. i dont want to bind_address to a specific IP. I just want to know if there can be restriction to a specific mongodb user to a certain IP. The scenario is this: we have a guest VM where the users can extract data. that VM's vnet is within our Production VNET. now the risk is if the guest user somehow able to know the mongodb credentials of our app's mongodb. Then the data is exposed and can be manipulated. In MySQL, even if that guest user was able to connect on our Prod VM, by executing "GRANT USAGE app_user@10.1.0.1;" he wont see anything on the Database. – JRA Jan 26 at 8:27
