28

I'm was playing around with permissions and locked myself out of Mongo database. I'm pretty sure I did this by trying to explicitly add access to a database but instead I overwrote only allowing permission to the database. So I'm effectively locked out of my Mongo database and everything I read tells me how to create a super user if I have the add user privilege. Right now I don't think I have any users that have that privilege. Is there a way to enter the database as all access? I own the server and have root access.

migrated from stackoverflow.com Apr 11 '14 at 5:51

This question came from our site for professional and enthusiast programmers.

36

If you have locked yourself out then you need to do the following:

  1. Stop your MongoDB instance
  2. Remove the --auth and/or --keyfile options from your MongoDB config to disable authentication
  3. Start the instance without authentication
  4. Edit the users as needed
  5. Restart the instance with authentication enabled
  • Removing auth was not enough indeed, thanks! – Andrei Oct 18 '17 at 16:03
10

I had a similar issue when I created a user without adding a superuser first. The following steps helped solve the problem:

  1. Open the MongoDB configuration file using sudo (sudo vi mongodb.conf).
    The file can be found in /etc/ folder.
  2. Comment "auth = true".
  3. Stop the MongoDB service (sudo service mongod stop)
  4. Start the MongoDB service (sudo service mongod start)
  5. Then create "root" superuser using the below command:

    use admin
    
    db.createUser({user:"admin",pwd:"password",roles:[{role:"root",db:"admin"}]});
    

    For reference https://docs.mongodb.com/manual/reference/built-in-roles/#superuser-roles

  6. Go back and uncomment "auth=true". Stop and Start/Restart the mongodb service.

  • I can't thank you enough. I've been stuck trying to figure this out when I uploaded the project to the dev server. Thank you so much! :) – Woppi Feb 8 '18 at 7:39
  • Ditto. Server error messages spectacularly unhelpful on this. Thank you! – Tom Mar 29 '18 at 7:09
7

If you use a replica set with a keyfile

Security between members of the replica set using Internal Authentication

Keyfile is used for auth in replication.

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>

You can use this command to login as a admin to mongod:

mongo -u __system -p "$(tr -d '\011-\015\040' < path-to-keyfile)" --authenticationDatabase local

Afterword you are able to create or modify your admin user.

Internal Role

__system MongoDB assigns this role to user objects that represent cluster members, such as replica set members and mongos instances. The role entitles its holder to take any action against any object in the database.

Do not assign this role to user objects representing applications or human administrators, other than in exceptional circumstances.

  • Where did you find this information? – octohedron Mar 24 at 10:53
2

Check the answers to this question, they might help

https://stackoverflow.com/questions/20117104/mongodb-root-user

Basically if you still have access to the server, you may be able to access the Admin database.

There's more in this page http://docs.mongodb.org/v2.4/reference/user-privileges/

Note that 2.6 version changes how this works completely. For 2.6 you'll need to spend more time with http://docs.mongodb.org/manual/security/

  • 1
    As mentioned in the post, that's the only info I've been able to find. I don't have permissions to do that – Tony Apr 11 '14 at 3:40
1

You have to stop Mongo, remove the admin files, then start Mongo

sudo service mongod stop
mv /data/admin.* .
sudo service mongod start
  • 2
    This is destroying the administrative users database and allowing access via the "localHostExcetption" it is not a good way to administer users when you have a problem. – daveh Apr 16 '14 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.