How to secure MongoDB with username and password

Question

I want to set up user name & password authentication for my MongoDB instance so that any remote access will ask for the user name & password. I tried the tutorial from the MongoDB site and did the following:

use admin 

db.addUser('theadmin', '12345'); 

db.auth('theadmin','12345');

After that, I exited and ran mongo again. And I don't need the password to access it. Even if I connect to the database remotely, I am not prompted for username & password.

Answer 1

To secure MongoDB with username and password you need to start mongod with the --auth option after setting up the user.

You need to start MongoDB without access control:-

mongod --dbpath /data/db

Then connect to the instance:-

mongo

After that create the user:-

use some_db 

db.createUser( 

   { 

    user: "myNormalUser", 

    pwd: "xyz123",

    roles: [ { role: "readWrite", db: "some_db" }, 

             { role: "read", db: "some_other_db" } ]

    } 

)

Answer 2

1. First start MongoDB without access control.

2. Then connect to the instance.

3. After that create the user.

4. Then stop the MongoDB instance and start it again with access control.

5. And at last, connect and authenticate as the user.