MONGO DB

2 minute read

MONGO DB WALKTHROUGH FOR UBUNTU

cf : tuto Mongo DB / install cf : tuto Digital Ocean / install

INSTALL MONGO DB

install MongoDB package (-y == —yes == —assume-yes)

sudo apt update
sudo apt install -y mongodb

check service status

sudo systemctl status mongodb
mongo --eval 'db.runCommand({ connectionStatus: 1 })'

optionnel : stop/start/restart MongoDB service

  sudo systemctl stop mongodb
  sudo systemctl start mongodb
  sudo systemctl restart mongodb

By default, MongoDB is configured to start automatically with the server. If you wish to disable/enable the automatic startup, type:

sudo systemctl disable mongodb
sudo systemctl enable mongodb

UNINSTALL

  • cf : https://docs.mongodb.com/manual/tutorial/install-mongodb-on-ubuntu/
sudo systemctl stop mongodb
sudo apt-get purge mongodb-*
sudo rm -r /var/log/mongodb
sudo rm -r /var/lib/mongodb

optionnal : allow an external IP to connect to MongoDB’s ports

sudo ufw allow from YOUR.LOCAL.IP.ADDRESS/32 to any port 27017

add your server’s publicly-routable IP address to the mongod.conf file

sudo nano /etc/mongodb.conf

let this : restrict to local interface

remote connection to db are prohibited except via SSH tunnel

…

logappend=true

# bind_ip = 127.0.0.1
bind_ip = 127.0.0.1,YOUR.SERVER.IP.ADDRESS
# bind_ip = 0.0.0.0
#port = 27017
…

restart service

sudo systemctl restart mongodb

optional : enable automatically starting MongoDB when the system starts

sudo systemctl enable mongod
sudo systemctl stop mongod
sudo systemctl start mongod
sudo systemctl restart mongod
sudo systemctl status mongod

SECURE CONNEXION

cf : tuto Digital Ocean / secure connexion cf : tuto Mongo DB

run MongoDB

mongo

in mongo CLI

use admin

db.createUser({user:"AdminMongo",pwd:"A_MONGO_DB_ADMIN_PWD",roles:[{role:"userAdminAnyDatabase",db:"admin"}]})

db.createUser({user:"RootJpy",pwd:"A_MONGO_DB_ADMIN_PWD",roles:[{role:"root",db:"admin"}]})

Type ‘exit’ and press ENTER or use CTRL+C to leave the client.

cf : tuto mongo DB on Ubuntu

add —auth to service

sudo nano /lib/systemd/system/mongodb.service

correct/add this line

ExecStart=/usr/bin/mongod --auth --unixSocketPrefix=${SOCKETPATH} --config ${CONF} $DAEMON_OPTS

systemctl daemon-reload

OR

cf : tuto Digital Ocean / secure

enable security

sudo nano /etc/mongodb.conf

Turn on/off security. Off is currently the default

#noauth = true
auth = true

restart service

sudo systemctl restart mongodb
sudo systemctl status mongod

test access

mongo
show dbs

—> must show error like :

2019-01-18T22:07:43.656+0000 E QUERY    [thread1] Error: listDatabases failed:{
	"ok" : 0,
	"errmsg" : "not authorized on admin to execute command { listDatabases: 1.0, $db: \"admin\" }",
	"code" : 13,
	"codeName" : "Unauthorized"
} :

run mongo with admin user

mongo -u AdminMongo -p --authenticationDatabase admin

—> enter password : A_MONGO_DB_ADMIN_PWD

show dbs

test from local terminal

mongo -u AdminMongo -p --authenticationDatabase admin --host XXX.XXX.XXX.XX

create an user for solidata db —> this guy must be added in config_prod.py (secret) in solidata_backend

use solidata
db.createUser({user:"AdminDB",pwd:"A_MONGO_DB_USER_PWD",roles:[{role:"readWrite",db:"solidata"}]})

CONCLUSION

THAT WAY DB IS PROTECTED BY :

  • AdminDB + MANDATORY PWD TO CONNECT AND CREATE USERS
  • AdminDB USER + MANDATORY PWD TO CONNECT TO CB
  • SSH TUNNEL MANDATORY + PASSPHRASE TO CONNECT TO SERVER OR DB
  • UFW ONLY ALLOWS SERVER IP AND DEV IP TO ACCESS PORT 2017
  • no other way to connect ?…

You May Also Enjoy