MongoDB安全访问控制


  • 管理員

    一、概述

    有时候我们会看到有些服务器或者数据库被别人恶意攻击,会导致中毒或者资料被盗取所,以我们对自己的服务器和数据库的访问安全性控制就显得至关重要。

    今天我们来说说MongoDB的几点安全性访问控制,可以通过的IP、端口或者使用账户、密码登录,来提高我们数据库和服务器的安全性访问情况,主要是通过

    启动Mongod服务的时候,指定相关的参数,或者基于角色上读写或者管理权限上的控制,接下来让我们一起来看一下。

    二、指定相关参数

    1、--auth

    我们在启动mongodb服务的时候,可以添加--auth参数,MongoDB会验证客户端连接的账户和密码,

    以确定其是否有访问的权限。如果认证不通过,那么客户端不能访问MongoDB的数据库。

    我们来验证下,MongoDB默认是不开启账密验证的

    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/data/db
    [root@mongotest1 bin]# ./mongo
    MongoDB Enterprise > show dbs   //默认是可以查看到所有实例
    local       
    test       
    MongoDB Enterprise > use admin
    switched to db admin
    //切换到admin下创建dba用户
    MongoDB Enterprise > db.createUser({user:"dba",pwd:"dba",roles:[{role:"userAdminAnyDatabase",db:"admin"}]})
    Successfully added user: {
        "user" : "dba",
        "roles" : [
            {
                "role" : "userAdminAnyDatabase",
                "db" : "admin"
            }
        ]
    }
    //查看下刚刚有没有刚刚创建的用户
    MongoDB Enterprise > show users
    {
        "_id" : "admin.dba",
        "user" : "dba",
        "db" : "admin",
        "roles" : [
            {
                "role" : "userAdminAnyDatabase",
                "db" : "admin"
            }
        ]
    }
    或者使用这样的命令查看所
    MongoDB Enterprise > db.system.users.find()
    { "_id" : "admin.dba", "user" : "dba", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "qv2mpn/EzS7DjhwYPn0iJQ==", 
    "storedKey" : "FNwJUOCaOIeEBfJwuJPpx4nUs1k=", "serverKey" : "rXL2hql7dsxytS3G7aFxSob7ACs=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
    

    然后我们在重启服务,这次重新启动的时候要加上--auth参数

    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/data/db  --auth
    [root@mongotest1 bin]# ./mongo
    MongoDB Enterprise > use admin
    switched to db admin
    MongoDB Enterprise > show dbs   //添加上--auth参数后,没有进行验证查看数据库实例的时候直接报错没有执行的权限
    2018-05-30T11:02:02.277+0800 E QUERY    [thread1] Error: listDatabases failed:{
        "ok" : 0,
        "errmsg" : "not authorized on admin to execute command { listDatabases: 1.0 }",
        "code" : 13
    } :
    _getErrorWithCode@src/mongo/shell/utils.js:25:13
    Mongo.prototype.getDBs@src/mongo/shell/mongo.js:62:1
    shellHelper.show@src/mongo/shell/utils.js:761:19
    shellHelper@src/mongo/shell/utils.js:651:15
    @(shellhelp2):1:1
    //接着我们进行验证下后再查看实例
    MongoDB Enterprise > db.auth('dba','dba')  //1表示验证通过,0表示验证不通过(账密不匹配)
    1
    MongoDB Enterprise > show dbs  //验证通过后就能够正常查看到实例
    admin      
    local      
    test       
    

    2、--port 

    默认端口是27017,该参数指定Mongod对应的端口,如果指定端口后用其他端口是无法访问的

    //启动服务的时候指定端口28017
    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/date/db  --port 28017
    //然后我们再访问看看
    [root@mongotest1 bin]# ./mongo  //没有指定端口的时候,无法访问
    MongoDB shell version: 3.2.8
    connecting to: test
    2018-06-05T17:31:51.737+0800 W NETWORK  [thread1] Failed to connect to 127.0.0.1:27017, reason: errno:111 Connection refused
    2018-06-05T17:31:51.738+0800 E QUERY    [thread1] Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed :
    connect@src/mongo/shell/mongo.js:229:14
    @(connect):1:6
    exception: connect failed
    [root@mongotest1 bin]# ./mongo --port=28017    //指定28017端口后,可以正常访问
    MongoDB shell version: 3.2.8
    connecting to: 127.0.0.1:28017/test
    Server has startup warnings: 
    2018-06-05T17:26:59.313+0800 I CONTROL  [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
    2018-06-05T17:26:59.313+0800 I CONTROL  [initandlisten] 
    MongoDB Enterprise > show dbs
    local  0.000GB

    3、--bind_ip

    默认是没有IP管控的,该参数指定Mongod服务对应其他可以访问的IP,如果指定后只能是指定的IP才有访问权限

    //设置只有本地IP才能访问 127.0.0.1
    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/date/db  --bind_ip 127.0.0.1
    //使用另一个IP访问情况
    [root@mongodbtest2 bin]# ./mongo --bind_id IP1  //设置前是可以IP2是可以访问IP的
    Error parsing command line: unrecognised option '--bind_id'
    try './mongo --help' for more information
    [root@mongodbtest2 bin]# ./mongo 10.130.170.41
    MongoDB shell version: 3.2.8
    connecting to: IP1/test
    Server has startup warnings: 
    2018-06-06T15:32:54.546+0800 I CONTROL  [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
    2018-06-06T15:32:54.546+0800 I CONTROL  [initandlisten] 
    MongoDB Enterprise > show dbs
    local  0.000GB
    [root@mongodbtest2 bin]# ./mongo IP1  设置后IP2访问IP1就报错
    MongoDB shell version: 3.2.8
    connecting to: IP1/test
    2018-06-06T15:51:40.506+0800 W NETWORK  [thread1] Failed to connect to 10.130.170.41:27017, reason: errno:111 Connection refused
    2018-06-06T15:51:40.506+0800 E QUERY    [thread1] Error: couldn't connect to server 10.130.170.41:27017, connection attempt failed :
    connect@src/mongo/shell/mongo.js:231:14
    @(connect):1:6
    exception: connect failed

    可以添加多个IP访问,中间用逗号‘,’隔开,例如

    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/date/db  --bind_ip 127.0.0.1,IP2

    三、基于角色权限

    验证数据库用户角色:

    1、在test集合上创建只读和读写用户

    //只读用户 readonly
    MongoDB Enterprise > db.createUser({user:"readonly",pwd:"123",roles:[{role:"read",db:"test"}]})
    Successfully added user: {
        "user" : "readonly",
        "roles" : [
            {
                "role" : "read",
                "db" : "test"
            }
        ]
    }
    //读写用户  readwrite
    MongoDB Enterprise > db.createUser({user:"readwrite",pwd:"123123",roles:[{role:"readWrite",db:"test"}]})
    Successfully added user: {
        "user" : "readwrite",
        "roles" : [
            {
                "role" : "readWrite",
                "db" : "test"
            }
        ]
    }
    //查看用户
    MongoDB Enterprise > show users
    {
        "_id" : "test.readonly",
        "user" : "readonly",
        "db" : "test",
        "roles" : [
            {
                "role" : "read",
                "db" : "test"
            }
        ]
    }
    {
        "_id" : "test.readwrite",
        "user" : "readwrite",
        "db" : "test",
        "roles" : [
            {
                "role" : "readWrite",
                "db" : "test"
            }
        ]
    }

    2、重启mongod服务

    [root@mongotest1 bin]# ./mongod --dbpath /usr/local/mongodb/data/db --auth

    3、验证用户权限

    a.只读用户的权限

    MongoDB Enterprise > db.auth('readonly','123')
    1
    MongoDB Enterprise > db.mongo.insert({"no":"F2","name":"Lily"})  //写入数据报错
    WriteResult({
        "writeError" : {
            "code" : 13,
            "errmsg" : "not authorized on test to execute command { insert: \"mongo\", documents: [ { _id: ObjectId('5b17a675637751cda118430b'), no: \"F2\", name: \"Lily\" } ], ordered: true }"
        }
    })
    MongoDB Enterprise > db.mongodb.find()  //可以查看数据
    { "_id" : ObjectId("5b17a4be2d7daf7945717c22"), "no" : "F1", "name" : "Jack" }
    //从以上可以看出只读用户无法写入数据,但是可以查看集合的数据

    b.读写用户

    MongoDB Enterprise > db.auth('readwrite','123123')
    1
    MongoDB Enterprise > db.mongodb.insert("no":"F2","name":"Lily") //可以写入数据
    2018-06-06T17:18:25.698+0800 E QUERY    [thread1] SyntaxError: missing ) after argument list @(shell):1:22
    MongoDB Enterprise > db.mongodb.insert({"no":"F2","name":"Lily"})
    WriteResult({ "nInserted" : 1 })
    MongoDB Enterprise > db.mongodb.find()  //同时也可以查看
    { "_id" : ObjectId("5b17a4be2d7daf7945717c22"), "no" : "F1", "name" : "Jack" }
    { "_id" : ObjectId("5b17a6f1637751cda118430c"), "no" : "F2", "name" : "Lily" }
    //从上可以看出,读写用户既可以查看集合的数据也可以写入数据

    四、总结

    管理员可以管理所有数据库,但是不能直接管理其他数据库,要先在admin数据库认证后才可以,要注意的是,

    MongoDB默认是没有管理员账号,所以要先添加管理员账号,再开启权限认证。所以,基于安全性的考虑,访问权限的控制还是


登录后回复
 

与 萌阔论坛 的连接断开,我们正在尝试重连,请耐心等待