1

i have created users in mongodb . one user among them is admin. but when i do $mongo it is allowing me to connect to mongo shell with out me specifiying user and password. what should i do to prevent access to mongo shell for all with out user login? please help

1
  • yes i am root. i want to disable shell access to anonymous users. i mean they should connect to shell only if they are admin or they are users created by admin May 24, 2021 at 2:48

2 Answers 2

4

There is no access control enabled with MongoDB by default, so this is something you'll need to configure separately. Fortunately, it's not too difficult thanks to the well-written MongoDB Manual.

Here is the gist:

  1. Start MongoDB without access control (which I believe you've already done)
  2. Connect to the instance (which you've stated you've already done)
  3. Create an administrator account:
    use admin
    db.createUser(
      {
        user: "adminny",
        pwd: "superSecretPassword!123",
        roles: [ { role: "dbOwner", db: "admin" } ]
      }
    )
    
  4. Re-start the MongoDB instance with access control.
    mongod --auth --port 27017 --dbpath /data/db1
    
    Note the --auth option in the startup.
  5. Authenticate as the admin account:
    mongo --port 27017 -u "adminny" -p "superSecretPassword!123" --authenticationDatabase "admin"
    

Important Note About Roles

There are several roles that are available, and choosing the wrong one can result in unnecessary frustration.

Role Detail
root This would be a root-level role, allowing the creation of user accounts, databases, and all administration-level actions one might need to do.
dbAdmin Provides the ability to perform administrative tasks such as schema-related tasks, indexing, and gathering statistics. This role does not grant privileges for user and role management.
dbOwner The database owner can perform any administrative action on the database. This role combines the privileges granted by the readWrite, dbAdmin and userAdmin roles.
userAdmin Provides the ability to create and modify roles and users on the current database. Since the userAdmin role allows users to grant any privilege to any user, including themselves, the role also indirectly provides superuser access to either the database or, if scoped to the admin database, the cluster.
userAdminAnyDatabase Provides the same access to user administration operations as userAdmin on all databases except local and config.
readWrite Provides all the privileges of the read role plus ability to modify data on all non-system collections and the system.js collection.

You can read more about each of the Built-In Roles in the MongoDB Manual, which is very approachable.

1
1

Apart the answer from @matigo, it should be noted that you can always connect to MongoDB even without credentials.

However, without valid credentials you are just connected, i.e. you cannot execute any command apart from nonhazardous commands like db.help(), db.listCommands(), db.version(), db.getMongo(), etc.

I have no idea why it is implemented like this. Perhaps due to the fact that you can run MongoDB even without authentication.

Or the reason is this: When you connect with connection string like "mongodb://username:password@hostname:27017/test?authSource=admin" then the credentials might be visible as clear text, for example with tcpdump or ps (see How does curl protect a password from appearing in ps output?) . For sure you can retrieve the current password in clear text by db.getMongo()._connectionInfo.connectionString

A more secure method would be this:

mongosh "mongodb://hostname:27017/test"
db.getSiblingDB('admin').auth("username", "password");

Update:

My first statement is not correct. You can enforce authentication, i.e. prevent connections without credentials when you force TLS and use x.509 Certificates to Authenticate Clients. Configuration would be this:

net:
  port: 27017
  tls:
    mode: requireTLS
    certificateKeyFile: <Certificate>
    CAFile: <CA-File>
    allowConnectionsWithoutCertificates: false
    allowInvalidCertificates: false
    
security:
  authorization: enabled

When you try to connect without credentials, i.e. without a client certificate, then connection is closed immediately:

mongosh  --quiet --tlsUseSystemCA "mongodb://localhost:27017/admin" --eval "db.getMongo()"
MongoServerSelectionError: connection <monitor> to 127.0.0.1:27017 closed
4
  • thankyou very much May 31, 2021 at 3:18
  • Thank you so much! This little bit of information is imho not highlighted very well in the documentation, and is not behavior that I would expect. So I've been debugging and researching for quite a while now trying to find out why I could still anonymously connect even though my user got created correctly, until I found your answer. Is there a reason for this? Even if they can't do anything, it seems weird to let anonymous users even connect, even if your only worry is keeping the amount of active connections down.
    – Christian
    Feb 1, 2023 at 15:37
  • 1
    @Christian see my update Feb 1, 2023 at 17:02
  • @WernfriedDomscheit thanks a lot! I don't have much experience with Mongo, and some of its ways are still a mystery to me.
    – Christian
    Feb 2, 2023 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.