MongoDb 本机删除密码的方法

Terminal Inflection

LINUX ESOTERICA, FIXES AND RANTS

• About
• Errors Resolved
• Linux
• Recommended Books
• Who Am I?

AboutErrors Resolved
Linux
Recommended Books
Who Am I?

Mongo
DB: forcing removal of the admin user

 Database Add
comments

Jun062012

There are many occasions where you get locked out of a Mongo DB database. It could be that the admin password is unknown, or that the only admin user that exists is “read-only” (something that Mongo permits you to do). Fortunately, it’s fairly straightforward
to remove the admin database safely and recreate the admin user.

Mongo DB has an idiomatic, not to mention pragmatic approach to user authorization. Access to the database is simplified, and not particular granular, with the idea that access control should be passed more to the connecting application itself. Thus, the default
access control is to have no users at all. You need to create an “admin” user account if you want one. Nothing, however enforces this.

One creates an admin user by creating a user on the “admin” database, after logging in to Mongo:

  # mongo localhost
MongoDB shell version: 2.0.2
connecting to: localhost/test
  > use admin
switched to db admin
  >  db.addUser("admin","Password")

And that’s it.

Once this user exists, then every time you login to the database, you need to authenticate, like this:

  # mongo localhost
MongoDB shell version: 2.0.2
connecting to: localhost/test
  > use admin
switched to db admin
  mongo> db.auth("admin","Password")

Failure to authenticate will allow you your connection, but no access to any data. Once again, it’s the fact of the existence of the admin user which enforces access control, as well as the following option in the Mongo DB config file:

  auth=true

Solution

This solution will focus on removal of the admin user in a replica set, because it’s slightly more complicated, and slightly more interesting. If you’re just running a single node, the procedure is considerably easier. Just ignore the cluster steps.

Stop all Mongo processes running in the replica set. These will probably be running with the command line or config file option of “replSet”. Check by running “ps” or checking the /etc/mongod.conf file.

When no Mongo replicas are running, perform the following procedure on each node in turn. You’ll need to bring the Mongo process up at one point, but it is vital that only one replica is running at any one time, otherwise the configuration will get resynchronised
from another node, and you don’t want that. You want it changed.

On each node

Change to the mongo directory where the data files reside, possibly /var/lib/mongo but specified in the configuration file by the dbPath parameter.

  # cd /var/lib/mongo

Move the admin.* files somewhere else to back them up.

  # mv /admin.* /tmp

It’s the simple. Deleting these datafiles will have removed the admin credentials from the database.

Start the mongo replica daemon on this single node. Depending on your distribution and how it’s configured, it’s probably something like this:

  # /etc/init.d/mongod start
  # mongo localhost
MongoDB shell version: 2.0.2
connecting to: localhost/test
  > use admin
switched to db admin
  > db.addUser("admin","password")

At this point, the admin datafiles should have been recreated. Check that the credentials work:

  > db.auth("admin","password")
1

If this returns the numeral “1″, then the login is successful. However, if this is a cluster, the node you’re on may have been marked as stale. To check and fix:

  > db.system.users.find()
error: { "$err" : "not master and slaveok=false", "code" : 13435 }
  > rs.slaveOk()
not master and slaveok=false

The rs.slaveOk() command will allow you to query normally from the secondary:

  SECONDARY> db.system.users.find()
{ "_id" : ObjectId("4fc4972525a7b704e9a3a09e"), "user" : "admin", "readOnly" : false, "pwd" : "2f1bffb1d28a2cca21679103652b1040" }

Now stop mongo, and repeat the above procedure on the other nodes:

  # /etc/init.d/mongod stop

When you have updated the admin password on all mongod replicas, restart all nodes in the replica set.

Now, you should find that all nodes have admin user accounts, and that you can use these to authenticate against each one.

---

Matt
Parsons is a freelance Linux specialist who has designed, built and supported Unix and Linux systems in the finance, telecommunications and media industries. 



He lives and works in London.

---

Posted
by Matt
Parsons at 10:44 am Tagged
with: mongo

One Response to “Mongo DB: forcing removal of the admin user”

1. sarat says:

   March 25, 2013 at 1:50 am

   Thank you so much. This was very helpful.

   Reply

Leave a Reply

Name

E-mail

URI

Your Comment

You may use these HTML tags and attributes: <a
href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Notify
me of follow-up comments by email.

Notify
me of new posts by email.

Mongo DB Backups with AMANDA

Recent Posts

• Extract
  all sender email addresses from a mailbox with Python
• Intercepting
  the STDIN and STDOUT of a process with strace
• Bash:
  having the last word
• Directory
  tree diff with filename exclusions
• Parse
  a shell config file in Perl
• Mongo
  DB Backups with AMANDA
• Visualizing
  Puppet dependencies
• Remove
  duplicate lines in a file without sorting

Categories

• CentOS
• Database
• Desktop
• Errors
• how to
• LDAP
• Monitoring
• Networking
• Perl
• Puppet
• Python
• Quick & Dirty
• Security
• Shell
• Ubuntu
• Uncategorized
• Virtualization
• Web

Technical Notebook

• Linux
• Solaris
• HP/UX
• Storage
• Oracle
• Perl

Blogroll

• nixCraft
• Tuxers

Tags

apache automation awkbash booting centos datedebug disk documentationfedora getopts grub hack icingaiptables ldap linux log lvm menumongo monitoring nagios networknetworking nfs perl puppetrecovery scripting scriptssecurity select selinuxshell SSH strace tip ubuntuvirtualization

Make a donation

Buy me a beer?

Recommended Reading

Archives

• June 2013
• May 2013
• March 2013
• January 2013
• November 2012
• October 2012
• August 2012
• June 2012
• May 2012
• April 2012
• March 2012
• February 2012
• September 2011
• March 2011
• February 2011

Follow

 

© 2012 Terminal Inflection

Suffusion theme by Sayontan Sinha

Switch to our mobile site

连接：

http://terminalinflection.com/mongo-db-force-admin-removal/