MongoDB study note (2): security configurations - Setup username and password, Bind interface and Iptables (on Ubuntu 16.04/mongoDB 3.4)

Setting up username and password

First, check your /etc/mongod.conf to confirm it is not in the auth mode. Add comment symbol '#' of the following code and restart mongod service:

#security:
  #authorization: enabled
sudo service mongod restart

Then, Connect to local mongodb:

mongo --port 27017

Switch to admin database:

use admin

Create admin user:

db.createUser({ user: "admin", pwd: "<your password>", roles: [{ role: "userAdminAnyDatabase", db: "admin" }] })

Grant Roles:

db.grantRolesToUser('admin',[{ role: "root", db: "admin" }])

Check if successfully added (should return 1):

db.auth("admin", "<your password>")

Exit mongo client:

exit

Enable the auth mode in your /etc/mongod.conf by activating the following lines and then restart the service:

security:
  authorization: enabled
sudo service mongod restart

Go back to mongo shell, and switch to admin and authenticate:

use admin db.auth("admin", "<your password>")

Switch to your database and create an user:

use <yourdatabase> db.createUser({ user: "<youruser>", pwd: "<yourpassword>", roles: [{ role: "dbOwner", db: "<yourdatabase>" }] })
You may need other types of role. Please check this page: Built-In Roles

Final step, now check the results:

db.auth("<youruser>", "<yourpassword>") show collections

You may connect to your database by using the following connection string from your application:

mongodb://<youruser>:<yourpassword>@localhost/<yourdatabase>

Interface binding

To setup the interface and port for mongodb, we need to use the 'net' field and subfield - 'port' (mongodb's default port is 27017) and 'bindIp' in /etc/mongod.conf . For example, our server intranet ip (private ip) is 192.168.1.100 and internet ip (public ip) is 34.177.10.33 . We can do the following settings for different purposes.

Only allow access from local machine

net:
  port:27017
  bingIp:127.0.0.1

Allow access from local and intranet

net:
  port:27017
  bingIp:127.0.0.1,192.168.1.100

Allow access from local, intranet, and internet. And set port to 27016

net:
  port:27016
  bingIp:127.0.0.1,192.168.1.100,34.177.10.33

All access allowed

net:
  port:27017
  bingIp:0.0.0.0
Please remember to restart the service after these modifications on mongod.conf

Iptables settings

We can use iptables to allow the request from some specific IPs. Please refer to the following examples: (mongodb port is 27017)

Any connections can connect to 27017

iptables -A INPUT -p tcp --dport 27017 -j ACCEPT

Only certain IPs can connect to 27017

iptables -A INPUT -s -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT