0


Following question Mongodb sharded cluster backup user issue
I have a sharded mongodb cluster, with 4 shards, and I'm required to stop the mongod service on each shard, and start it not as a part of a shared cluster, but as a standalone with no authentication.

Today, each shard is configured with the options:

shardsvr=true
keyFile=/etc/mongodb.key

If i comment out these 2 options, will I be able to start the service as standalone with no auth?

Moreover, is there any possible impact on the data/configuration once i finish what I need to do and uncomment the both configuration options?

Thanks in advance

Improve this question

1 Answer 1

Reset to default
2

If you comment out keyFile (assuming you have not specified auth explicitly) you will turn off authentication. Basically keyFile implies auth but not the other way around.

When you comment out shardsvr, the port will change from 27018 to the default port number - 27017. That is actually a good thing. When you take a node out of a replica set or a sharded cluster you want to change the port so that the rest of the set/cluster does not attempt to continue to communicate with the node you are working on. Then, once you restore the original configuration, it will rejoin the set and cluster as normal.

Although the port will change when you do this, I tend to prefer explicitly specifying the port number to use for maintenance (30000 is my preference) rather than rely on default settings. Also, I tend to have plenty of instances running on my hosts, so 27017 may well already be in use.

Once you have made your changes, all you have to do to restore the node in question is restart and switch back to your original settings. This should be a relatively quick maintenance, so you should not have to worry about a node going stale (can be a concern with prolonged work).

Improve this answer
5
  • Hi Adam, thank you again for your help. I've encountered a small issue and hoping you might have an idea. I've followed the steps, commented out both shardsvr and keyFile. logged in and created an admin user with the role: UserAdminAnyDatabase. after I stopped the service, uncommented the shardsvr and keyFile, and started the server again. I'm still not able to connect using the user I've just created. "> show collections Sun Jun 22 07:23:51.699 error: { "$err" : "not authorized for query on admin.system.namespaces", "code" : 16550 } at src/mongo/shell/query.js:128"
    – Meny Issakov
    Commented Jun 22, 2014 at 7:26
  • First, hopefully you don't have a typo - it's a lower case U - userAdminAnyDatabase. Second, the userAdminAnyDatabase role does not give you permissions to show collections (requires read privileges) or anything else really besides add/modify other users. It's this ability that makes it a de facto super user account, it can change any user (including itself) to have any privilege, but you still have to grant them or they are not present. Basically, you need to create another user with the appropriate roles to read (or readWrite etc.) the appropriate databases
    – Adam C
    Commented Jun 22, 2014 at 13:04
  • Hi, it was indeed a type, but I see your point. I went ahead and created another user with readWriteAnyDatabase privilege. I re-enabled the 2 options in the config and restarted the service. I now tried running: mongodump --port 27018 -o /mnt/backup -d <db> -c <collection>-u backup -p backup And got error 18: auth error.
    – Meny Issakov
    Commented Jun 22, 2014 at 13:15
  • That's basically the error you get when you have the username/password incorrect. Try connecting with the mongo shell, authenticating with that user and then trying to do a find etc. on that collection first to make sure it is working. Also, if you added the user to the admin database, which I think you have, then you have to authenticate against admin first, the other databases have no idea about those credentials.
    – Adam C
    Commented Jun 23, 2014 at 0:05
  • You're right! I didn't add the authenticationDatabase flag out. once I've added it to the command, it works great.! Thanks a lot for your help!
    – Meny Issakov
    Commented Jun 23, 2014 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.