MongoDB Create Database Username Password to Secure Data

Introduction

As long as the Mongodb database port is open on your server any computer can connect to your database and modify, read, or delete your MongoDB data. This article is about MongoDB creating a database username and password which will allow you to secure your data.

Mongodb Enable Authentication

MongoDB is directly connected by default, no authentication is required. If the current computer can access the public network and ignore the open state of the Mongodb port (the default is 27017), Mongodb creates a security risk and can be used to invade the database.

Read Also: Learn How to secure MongoDB Community Version Using Authentication (https://kb.objectrocket.com/mongo-db/learn-how-to-secure-mongodb-community-version-using-authentication-part-3-489)

If you need to use security authentication for your MongoDB database, you must use auth to enable security auditing. Only users with database authentication can read, write, and verify account security.

How to Create Database in MongoDB?

The MongoDB syntax for creating a database is as follows:

use DATABASE_NAME

If the database does not exist, create a database, otherwise switch to the specified database.

Example: In the following example, we created the database Objectrocket:

> use objectrocket
switched to db objectrocket
> db
objectrocket
>

If you want to see all the databases, you can use the show dbs command:

> show dbs
admin   0.000GB
config  0.000GB
local   0.000GB
>

As you can see, the newly created Objectrocket database is not included in the list of databases. To show it, we need to put some data in the objectrocket database.

> db.objectrocket.insert({"name":" objectrocket  Tutorial"})
WriteResult({ "nInserted" : 1 })
> show dbs
admin   0.000GB
config  0.000GB
local   0.000GB
objectrocket  0.000GB

The default database in MongoDB is test. If you do not create a new database, the collection is stored in a test database.

Note: In MongoDB, collections are created only after inserting content! That is, after creating a collection (data table), a document (record) is inserted and actually a collection is created.

MongoDB Create Database Username Password

In this section I will guide you through creating a database username and password so that you can protect your data. Here are the steps to take for creating username and password.

Vulnerable Environment

  • Run Mongodb with Mongod standard command
  • Access to the device is possible via the public network.
  • Open the port of Mongodb in the public network

Security Risk

  • Database privacy leak
  • Database deleted
  • The database is slow

Solutions

  • Prohibit public network access to Mongodb port
  • Network configuration – Because network configuration varies from person to person, it must be configured for the actual environment and no redundancy is required. On the following aspects it may be prohibited.
    • Disable port forwarding in the router
    • Iptables Firewall forbidden access Verify how the port can be accessed Run the external network from the machine’s command line
      telnet your.machine.open.ip 27017

Verify how the port can be accessed

Run the external network from the machine’s command line:

telnet your.machine.open.ip 27017

Enable Verification

Create a user administrator account Current database version: Mongodb 3.4 Start database with Mongod New terminal:

mongod --port 27017 --dbpath /data/db1

By default, parameters can be added. If custom parameters exist, they must be added.

In another terminal, run the following command.

mongo --port 27017

use admin

db.createUser(
  {
    user: "admin",
    pwd: "Password",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

The administrator was created successfully and now has a user administrator. Username: admin Password: password Then disconnect the Mongodb connection, and close the database. You can do this by hitting Cmd-C on Mac or Ctrl-C on Windows.

Mongodb user verification login

Run Mongodb with access control In a new terminal run:

mongod --auth --port 27017 --dbpath /data/db1

Now there are two ways to verify the identity of the user. The first way is similar to MySql. The second one is to specify the username, password, and database name when the client connects.

mongo --port 27017 -u "admin" -p "password" --authenticationDatabase "admin"

After the client connects, verify it again.

mongo --port 27017

use admin
db.auth("admin", "password")

// Output 1 means successful verification

How to create a simple user?

Let’s continue on with this article about Mongodb creating database username and password and let’s take one step more to understand how to create a simple user. This process is similar to creating an administrator account, but the role is different.

use foo

db.createUser(
  {
    user: "simpleUser",
    pwd: "simplePass",
    roles: [ { role: "readWrite", db: "foo" },
             { role: "read", db: "bar" } ]
  }
)

Now we have a simple user Username: simpleUser Password: simplePass Permissions: read and write database foo, read-only database bar.

Please Note: Using foo means that the user is created in the foo library. Therefore, the foo library must verify the identity, ie the user’s information follows the database. Although the simpleUser named above has permission to read the bar library, it must first authenticate in the foo library. Direct access leads to a validation error.

use foo
db.auth("simpleUser", "simplePass")

use bar
show collections

Another thing to keep in mind is that, by default, the connection method still has super permissions when there are no users in the administration library, even if users are created in other databases.

MongoDB Database Roles

Built-in roles

Database user role: read, readWrite Database management roles: dbOwner, dbAdmin, userAdmin Cluster management roles: clusterManager ,clusterAdmin, hostManager , clusterMonitor Backup recovery role: restore, backup All database roles: readWriteAnyDatabase , readAnyDatabase, dbAdminAnyDatabase , userAdminAnyDatabase Superuser role: root // There are several roles that provide indirect or direct access to the system superuser (userAdmin, dbOwner, userAdminAnyDatabase) Internal role: system

Role descriptions

Read: Allow users to read the specified database. readWrite: Allow the user to read and write to the specified database userAdmin: Allows users to write to the system. users collection. You can create, delete, and manage users in the specified database. clusterAdmin: Available only in the administrator database, which gives the user administrator rights to all shards and replication set related functions. dbAdmin: This allows the users to run administrative functions in a specified database, such as, creating an index, viewing statistics , deleting, , or accessing system profile. readAnyDatabase: is only available in the administrator database and give the user read access to all databases. userAdminAnyDatabase: is only available in the Administrator database and give all databases userAdmin permissions. readWriteAnyDatabase: is only available in the administrator database and give the user read and write permissions to all databases. dbAdminAnyDatabase: is only available in the administrator database and give the user dbAdmin rights for all databases. Root: This is only accessible in the admin database. Super account, great resolution

Conclusion

When using the database, we must be aware of security risks. Due to the default configuration of Mongodb, the database is at risk of intrusion and must be prevented by creating database usernames and passwords. If you’re worried that your database security is not configured properly please reach out to us at Object Rocket and your data will be in safe hands.

Pilot the ObjectRocket Platform Free!

Try Fully-Managed CockroachDB, Elasticsearch, MongoDB, PostgreSQL (Beta) or Redis.

Get Started

Keep in the know!

Subscribe to our emails and we’ll let you know what’s going on at ObjectRocket. We hate spam and make it easy to unsubscribe.