disable anonymous access to MongoDB

Question

I have installed MongoDB on Windows 2012 Server and running it on windows service.

In order to protect it from anonymous log-ins, I followed below steps to enable authenticate and disable anonymous access

Create the Administrator Credentials and then Enable Authentication

1. Start the mongod or mongos instance without the auth or keyFilesetting.
2. Create the administrator user as described in Create a User Administrator.
3. Re-start the mongod or mongos instance with the auth or keyFile setting.

According to documentation, by running this shell command

db.auth(<username>,<password>)

it should turn on authorization and restarting the instance it should disable anonymous access.

I am not sure what 3rd step is meant, I stopped MongoDB service and restarted it. But I can still do a anonymous Log-in to the remote MongoDB

How can I disable anonymous access to MongoDB?

Update

Executing db.serverCmdLineOpts()

/* 0 */ {     "argv" : [          "c:\\Program Files\\mongodb\\bin\\mongod.exe",          "--directoryperdb",          "--dbpath",          "c:\\mongodb\\data",          "--logpath",          "c:\\mongodb\\log\\mongodb_master.log",          "--logappend",          "--rest",          "--service"     ],     "parsed" : {         "dbpath" : "c:\\mongodb\\data",         "directoryperdb" : true,         "logappend" : true,         "logpath" : "c:\\mongodb\\log\\mongodb_master.log",         "rest" : true,         "service" : true     },     "ok" : 1 } 

This means I don't have auth key. How can i set auth key there?

Answer 1

To fully disable anonymous authentication you need to ensure that you:

1) Add an administrative user to the admin database.

Until the first admin user is created, by default there is a localhost bypass that allows you to login anonymously and set up that first user.

To check you have at least one user in your admin database, run:

db.getSiblingDB('admin').system.users.find() 

2) Start your MongoDB server with auth enabled (standalone server) or keyFile enabled (replica set).

The keyFile option implies auth, and is used for internal authentication between replica set nodes.

To check the configuration settings for a running MongoDB instance, you can refer to the output of db.serverCmdLineOpts() in a mongo shell.

If the options have been changed from the default they should show up in the parsed section of the output. That is, one of these should return true:

db.serverCmdLineOpts().parsed.auth db.serverCmdLineOpts().parsed.keyFile