导读 | mongodb 3.0 访问控制改了很多,需要你老老实实的去看文档去验证,谷歌百度出来的多半就是错误的。 还需要注意这个参数authenticationmechanisms。 |
为了兼用2.6版本,我直接指定下面的参数:
setparameter: authenticationmechanisms: mongodb-cr
下面看看如何创建访问控制权限
不使用 —auth 参数,启动 mongodb
mongodb-linux-i686-3.0.0/bin/mongod -f mongodb-linux-i686-3.0.0/mongodb.conf
此时你 show dbs 会看到只有一个local数据库,那个所谓的*****是不存在的。
mongodb 没有超级无敌用户root,只有能管理用户的用户 user*****anydatabase。
use ***** db.createuser( { user: "buru", pwd: "12345678", roles: [ { role: "user*****anydatabase", db: "*****" } ] } )
roles 中的 db 参数是必须的,不然会报错:error: couldn’t add user: missing expected field “db”。另外,有很多文章记录的是使用 db.adduser(…) 方法,这个方法是旧版的,3.0中已经不存在,详见:http://docs.mongodb.org/manual/reference/method/js-user-management。
切换到*****下,查看刚才创建的用户:
show users 或 db.system.users.find() { "_id" : "*****.buru", "user" : "buru", "db" : "*****", "credentials" : { "scram-sha-1" : { "iterationcount" : 10000, "salt" : "gwvwua/dxvxgshavenlyva==", "storedkey" : "l2qevteujpkcuqdekqfiwbsv4ms=", "serverkey" : "m1ofnkxg2sncsfrbjbx4pxbsgvg=" } }, "roles" : [ { "role" : "user*****anydatabase", "db" : "*****" } ] }
怎么关闭 mongodb?千万不要 kill -9 pid,可以 kill -2 pid 或 db.shutdownserver()
下面使用 —auth 参 数,重新启动 mongodb:
mongodb-linux-i686-3.0.0/bin/mongod --auth -f mongodb-linux-i686-3.0.0/mongodb.conf mongodb-linux-i686-3.0.0/bin/mongo use ***** db.auth("buru","12345678") #认证,返回1表示成功 或 mongodb-linux-i686-3.0.0/bin/mongo -u buru -p 12345678 --authenticationdatabase *****
此时?show collections 报错
2015-03-17t10:15:56.011 0800 e query error: listcollections failed: { "ok" : 0, "errmsg" : "not authorized on ***** to execute command { listcollections: 1.0 }", "code" : 13 } at error () at db._getcollectioninfoscommand (src/mongo/shell/db.js:643:15) at db.getcollectioninfos (src/mongo/shell/db.js:655:20) at db.getcollectionnames (src/mongo/shell/db.js:666:17) at shellhelper.show (src/mongo/shell/utils.js:625:12) at shellhelper (src/mongo/shell/utils.js:524:36) at (shellhelp2):1:1 at src/mongo/shell/db.js:643
因为,用户buru只有用户管理的权限。
下面创建用户,用户都跟着库走,创建的用户都是
use tianhe db.createuser( { user: "bao", pwd: "12345678", roles: [ { role: "readwrite", db: "tianhe" }, { role: "read", db: "tianhe2" } ] } )
查看刚刚创建的用户。
show users { "_id" : "tianhe.bao", "user" : "bao", "db" : "tianhe", "roles" : [ { "role" : "readwrite", "db" : "tianhe" }, { "role" : "read", "db" : "tianhe2" } ] }
查看整个mongodb全部的用户:
use ***** db.system.users.find() { "_id" : "*****.buru", "user" : "buru", "db" : "*****", "credentials" : { "scram-sha-1" : { "iterationcount" : 10000, "salt" : "gwvwua/dxvxgshavenlyva==", "storedkey" : "l2qevteujpkcuqdekqfiwbsv4ms=", "serverkey" : "m1ofnkxg2sncsfrbjbx4pxbsgvg=" } }, "roles" : [ { "role" : "user*****anydatabase", "db" : "*****" } ] } { "_id" : "tianhe.bao", "user" : "bao", "db" : "tianhe", "credentials" : { "scram-sha-1" : { "iterationcount" : 10000, "salt" : "//xy1v1fbqehc1gzqqzhgq==", "storedkey" : "zs/o54zzl/fdcxlqj98kdavtff0=", "serverkey" : "iipnyz2g**khyk3zgz6mubt0pi4=" } }, "roles" : [ { "role" : "readwrite", "db" : "tianhe" }, { "role" : "read", "db" : "tianhe2" } ] }
创建完毕,验证一下:
use buru show collections 2015-03-17t10:30:06.461 0800 e query error: listcollections failed: { "ok" : 0, "errmsg" : "not authorized on buru to execute command { listcollections: 1.0 }", "code" : 13 } at error () at db._getcollectioninfoscommand (src/mongo/shell/db.js:643:15) at db.getcollectioninfos (src/mongo/shell/db.js:655:20) at db.getcollectionnames (src/mongo/shell/db.js:666:17) at shellhelper.show (src/mongo/shell/utils.js:625:12) at shellhelper (src/mongo/shell/utils.js:524:36) at (shellhelp2):1:1 at src/mongo/shell/db.js:643
显然没权限,先auth:
db.auth("bao","12345678") show collections news system.indexes wahaha
mongo shell:http://docs.mongodb.org/v2.2/tutorial/getting-started-with-the-mongo-shell
enable access control:http://docs.mongodb.org/manual/tutorial/enable-authentication
add a user to a database:http://docs.mongodb.org/manual/tutorial/add-user-to-database
user methods:http://docs.mongodb.org/manual/reference/method/js-user-management
role methods:http://docs.mongodb.org/manual/reference/method/js-role-managementmongodb?3.0 authentication:http://ibruce.info/2015/03/03/mongodb3-auth/