2

We're using a simple python script to backup our mongodb cluster. the script connects to each mongod instance via ssh, and performs mongodump, all without requiring user/pass

ever since we started using the mms monitoring agent, and thus creating an administrative user on each shard for the mms agent to connect to, we're not able to use the mongodump without credentials.

out problem is that all our users are configured on the mongos instances and not directly on the shards, so we cannot perform the mongodump.

One last thing, Is it possible to disable authentication for a specific shard in order to create/remove users from it?

do you have any ideas?

1

1 Answer 1

3

Once you add a user to the individual shards, which you indicate you have done for MMS, you must then have valid credentials to connect for any purpose, including mongodump. Up until you added that user for MMS, the shards were running with authentication enabled but with no users populated (this only happens if all your users are in the admin database ans using delegated auth for other databases, otherwise with 2.4 and below you would have at least one shard with users for each database - 2.6+ changes this behavior) and so you were able to connect without credentials.

Essentially this is a loophole left open so that you don't accidentally lock yourself out of your instances when you turn on auth with no users (and one that would probably have stopped working at some point as default security is tightened anyway).

The bottom line is that you will need to add a user for use with mongodump, and it's a good idea to do so anyway rather than allowing non-authenticated users free access to your instances. If you are running 2.6 or later, then the built in backup role exists precisely for this purpose, if you are on 2.4 or earlier, then the description for that role gives you a great outline of what is needed to backup successfully (and in particular if you want to backup the users themselves).

3
  • Thanks Adam, I was suspecting that, but wasn't able to find anything to support it. I do have one problem though. We decided to stop using the mms, so I've started to delete the mms user from the shards. so far I've deleted it from 2 shards. (logged in as mms, and deleted the user). so I cannot log in to these shards with the mms user. Is there a way to log into it? (localhost exception maybe?) Thanks in advance! Jun 17, 2014 at 12:05
  • And even worse, on the shards that has the mms user, it's not db admin, so it cannot create users. any idea how to get our of this issue? Jun 17, 2014 at 12:24
  • The easiest thing to do is to restart each replica set member without authentication, add the user(s) you need, then restart with your original configuration. If you do secondaries first, then step down the primary and do that last you can complete it without significant down time.
    – Adam C
    Jun 17, 2014 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.