mongoDB 3.0 安全权限访问控制
2016-02-24 11:46
736 查看
首先,不使用 –auth 参数,启动mongoDB:
mongodb-linux-i686-3.0.0/bin/mongod -f mongodb-linux-i686-3.0.0/mongodb.conf此时你 showdbs 会看到只有一个local数据库,那个所谓的admin是不存在的。mongoDB 没有炒鸡无敌用户root,只有能管理用户的用户 userAdminAnyDatabase。打开 mongo shell:
mongodb-linux-i686-3.0.0/bin/mongo添加管理用户:
use admin db.createUser( { user: "buru", pwd: "12345678", roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] } )roles 中的 db 参数是必须的,不然会报错:Error:couldn’t add user: Missing expected field “db”。另外,有很多文章记录的是使用 db.addUser(…) 方法,这个方法是旧版的,3.0中已经不存在,详见:http://docs.mongodb.org/manual/reference/method/js-user-management。切换到admin下,查看刚才创建的用户:
show users 或 db.system.users.find()
{ "_id" : "admin.buru", "user" : "buru", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "gwVwuA/dXvxgSHavEnlyvA==", "storedKey" : "l2QEVTEujpkCuqDEKqfIWbSv4ms=", "serverKey" : "M1ofNKXg2sNCsFrBJbX4pXbSgvg=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }怎么关闭mongoDB?千万不要 kill -9 pid,可以 kill -2 pid 或 db.shutdownServer()下面使用 –auth 参数,重新启动 mongoDB:
mongodb-linux-i686-3.0.0/bin/mongod --auth -f mongodb-linux-i686-3.0.0/mongodb.conf再次打开 mongoshell:
mongodb-linux-i686-3.0.0/bin/mongouse admindb.auth("buru","12345678") #认证,返回1表示成功或mongodb-linux-i686-3.0.0/bin/mongo -u buru -p 12345678 --authenticationDatabase admin此时
show collections报错
2015-03-17T10:15:56.011+0800 E QUERY Error: listCollections failed: {"ok" : 0,"errmsg" : "not authorized on admin to execute command { listCollections: 1.0 }","code" : 13}at Error (<anonymous>)at DB._getCollectionInfosCommand (src/mongo/shell/db.js:643:15)at DB.getCollectionInfos (src/mongo/shell/db.js:655:20)at DB.getCollectionNames (src/mongo/shell/db.js:666:17)at shellHelper.show (src/mongo/shell/utils.js:625:12)at shellHelper (src/mongo/shell/utils.js:524:36)at (shellhelp2):1:1 at src/mongo/shell/db.js:643因为,用户buru只有用户管理的权限。下面创建用户,用户都跟着库走,创建的用户都是
use tianhedb.createUser({user: "bao",pwd: "12345678",roles: [{ role: "readWrite", db: "tianhe" },{ role: "read", db: "tianhe2" }]})查看刚刚创建的用户。
show users{"_id" : "tianhe.bao","user" : "bao","db" : "tianhe","roles" : [{"role" : "readWrite","db" : "tianhe"},{"role" : "read","db" : "tianhe2"}]}查看整个mongoDB全部的用户:
use admindb.system.users.find(){ "_id" : "admin.buru", "user" : "buru", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "gwVwuA/dXvxgSHavEnlyvA==", "storedKey" : "l2QEVTEujpkCuqDEKqfIWbSv4ms=", "serverKey" : "M1ofNKXg2sNCsFrBJbX4pXbSgvg=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }{ "_id" : "tianhe.bao", "user" : "bao", "db" : "tianhe", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "//xy1V1fbqEHC1gzQqZHGQ==", "storedKey" : "ZS/o54zzl/FdcXLQJ98KdAVTfF0=", "serverKey" : "iIpNYz2Gk8KhyK3zgz6muBt0PI4=" } }, "roles" : [ { "role" : "readWrite", "db" : "tianhe" }, { "role" : "read", "db" : "tianhe2" } ] }创建完毕,验证一下:
use burushow collections2015-03-17T10:30:06.461+0800 E QUERY Error: listCollections failed: {"ok" : 0,"errmsg" : "not authorized on buru to execute command { listCollections: 1.0 }","code" : 13}at Error (<anonymous>)at DB._getCollectionInfosCommand (src/mongo/shell/db.js:643:15)at DB.getCollectionInfos (src/mongo/shell/db.js:655:20)at DB.getCollectionNames (src/mongo/shell/db.js:666:17)at shellHelper.show (src/mongo/shell/utils.js:625:12)at shellHelper (src/mongo/shell/utils.js:524:36)at (shellhelp2):1:1 at src/mongo/shell/db.js:643`显然没权限,先auth:
db.auth("bao","12345678")1show collectionsnewssystem.indexeswahaha完毕!
相关文章推荐
- mongodb 添加用户及权限设置详解
- mongodb复制集配置
- NoSQL Manager for MongoDB 连接 3.0 授权的数据库
- “永久”使用 NoSQL Manager for MongoDB
- 造轮子:MongoDB安装、CURD操作、使用场景分析
- mongodb 学习记录
- laravel mongodb 扩展
- MongoDB 3.0安全权限访问控制
- Mongodb数据更新命令(update、save)
- mongodb的内存总结
- mongodb搭建过程(服务搭建)
- MongoDB win7 32位 安装配置
- 禁用springboot中对mongodb的autoConfiguration
- MongoDB 3.0新增特性一览
- Ubuntu安装MongoDB和PHP扩展
- mongodb在secondary不能直接获取primary的信息解决方法
- linux系统下mongodb安装出现的问题
- Node.js + Mongodb 建站学习历程1
- MongoDB 操作记录
- MongoDB mongo shell,常用的操作命令,GUI客户端