mongoDB添加用户认证及简单的配置说明

 一、添加用户：

1、开启安全认证之前，一定至少有个管理员帐号

2、admin数据库中的用户被视为超级用户（管理员）

3、在认证后，管理员可以读写所有的数据库，执行特定的管理命令

 

> use admin
switched to db admin
> db.addUser("lee1","lee1")
{
    "user" : "lee1",
    "readOnly" : false,
    "pwd" : "48117ef640dfd3e9097beda195584a95",
    "_id" : ObjectId("51610a3d16abc5abe0f29870")
}
> db.auth("lee1","lee1")
1
> db.system.users.find()
{ "_id" : ObjectId("51610168951f92160cfa5606"), "user" : "root", "readOnly" : false, "pwd" : "2a8025f0885adad5a8ce0044070032b3" }
{ "_id" : ObjectId("51610a3d16abc5abe0f29870"), "user" : "lee1", "readOnly" : false, "pwd" : "48117ef640dfd3e9097beda195584a95" }

4、为数据库添加一般用户：

添加readonly用户

 

> use lee
switched to db lee
> db.addUser("abc","abc",true)
{
    "_id" : ObjectId("51611f30681719f7936652a4"),
    "user" : "abc",
    "readOnly" : true,
    "pwd" : "2e110f3fd8e94613450bf5ffdba52fde"
}
>

切换至abc用户 试着插入数据：

 

> db.Collection.insert({"abcd" : 6})
unauthorized
>

没有插入权限

 

修改readonly用户为false

 

切换成任意一个lee数据库的readonly 为false的用户，修改abc权限

 

> db.addUser("abc","abc")
{
    "_id" : ObjectId("51611f30681719f7936652a4"),
    "user" : "abc",
    "readOnly" : false,
    "pwd" : "2e110f3fd8e94613450bf5ffdba52fde"
}

> db.system.users.find()
{ "_id" : ObjectId("5161073d3f34cd45bfba08fd"), "user" : "lee", "readOnly" : true, "pwd" : "bf721a4b0c32ef0a47c1a59d9e91eedb" }
{ "_id" : ObjectId("5161095f88729f73e1b0421f"), "user" : "lee1", "readOnly" : false, "pwd" : "48117ef640dfd3e9097beda195584a95" }
{ "_id" : ObjectId("51611f30681719f7936652a4"), "user" : "abc", "readOnly" : false, "pwd" : "2e110f3fd8e94613450bf5ffdba52fde" }

 

此时abc用户对lee数据库就有了写的权限

 

> db.Collection.insert({"abcd" : 6})
> db.Collection.find()
{ "_id" : ObjectId("516107033f34cd45bfba08fc"), "xxx" : 1 }
{ "_id" : ObjectId("516108d988729f73e1b0421e"), "xxxx" : 2 }
{ "_id" : ObjectId("5161098788729f73e1b04220"), "xxxxxxx" : 3 }
{ "_id" : ObjectId("516109c483fe317000baa6a3"), "lee1_xxx" : 4 }
{ "_id" : ObjectId("51611d31c04f755607a8ba0a"), "aaa" : 5 }
{ "_id" : ObjectId("5161211836fb8537e2c9faf7"), "abcd" : 6 }

 

管理员需要从admin数据库登录：

 

mongo 127.0.0.1/admin -uroot -proot

 

二、备份：

 

mongodump -h 127.0.0.1 -ulee1 -plee1 -d lee -o /tmp
connected to: 127.0.0.1
Sat Apr  6 23:21:01 DATABASE: lee    to     ./lee
Sat Apr  6 23:21:01     lee.Collection to ./lee/Collection.bson
Sat Apr  6 23:21:01          4 objects
Sat Apr  6 23:21:01     Metadata for lee.Collection to ./lee/Collection.metadata.json
Sat Apr  6 23:21:01     lee.system.users to ./lee/system.users.bson
Sat Apr  6 23:21:01          2 objects
Sat Apr  6 23:21:01     Metadata for lee.system.users to ./lee/system.users.metadata.json
命令说明：
-h dbhost
-u dbuser
-p pwd
-d dbname
-o output directory

三、恢复：

 

#mongorestore -uroot -proot -h127.0.0.1 --drop ./lee
connected to: 127.0.0.1
Sun Apr  7 15:15:00 ./lee/Collection.bson
Sun Apr  7 15:15:00     going into namespace [lee.Collection]
Sun Apr  7 15:15:00      dropping
4 objects found
Sun Apr  7 15:15:00     Creating index: { key: { _id: 1 }, ns: "lee.Collection", name: "_id_" }
Sun Apr  7 15:15:01 ./lee/system.users.bson
Sun Apr  7 15:15:01     going into namespace [lee.system.users]
2 objects found
Sun Apr  7 15:15:01     Creating index: { key: { _id: 1 }, ns: "lee.system.users", name: "_id_" }

 

命令说明：

--drop 在导入数据之前，先删除此集合中的数据

-d database to use （should have existed）

 

服务器断电或其他情况下导致的数据库不正常关闭，开启mongodb后的调试信息如下

 

MongoDB starting : pid=4479 port=27017 dbpath=/backup/mongo/data/ 64-bit host=lee1
Tue Apr  2 04:05:57 [initandlisten] db version v2.2.3, pdfile version 4.5
Tue Apr  2 04:05:57 [initandlisten] git version: f570771a5d8a3846eb7586eaffcf4c2f4a96bf08
Tue Apr  2 04:05:57 [initandlisten] build info: Linux ip-10-2-29-40 2.6.21.7-2.ec2.v1.2.fc8xen #1 SMP Fri Nov 20 17:48:28 EST 2009 x86_64 BOOST_LIB_VERSION=1_49
Tue Apr  2 04:05:57 [initandlisten] options: { bind_ip: "127.0.0.1,192.168.10.220", config: "/etc/mongodb.conf", dbpath: "/backup/mongo/data/", fork: "true", journal: "true", logappend: "true", logpath: "/backup/mongo/mongo.log", port: 27017, quiet: "true" }
Tue Apr  2 04:05:57 [initandlisten] journal dir=/backup/mongo/data/journal
Tue Apr  2 04:05:57 [initandlisten] recover begin
Tue Apr  2 04:05:57 [initandlisten] recover lsn: 115876
Tue Apr  2 04:05:57 [initandlisten] recover /backup/mongo/data/journal/j._0
Tue Apr  2 04:06:00 [initandlisten] recover cleaning up
Tue Apr  2 04:06:00 [initandlisten] removeJournalFiles
Tue Apr  2 04:06:03 [initandlisten] recover done
Tue Apr  2 04:06:03 [initandlisten] preallocating a journal file /backup/mongo/data/journal/prealloc.0
Tue Apr  2 04:06:06 [initandlisten]         325058560/1073741824    30%
Tue Apr  2 04:06:11 [initandlisten]         744488960/1073741824    69%
Tue Apr  2 04:06:14 [initandlisten]         912261120/1073741824    84%
Tue Apr  2 04:06:17 [initandlisten]         1027604480/1073741824   95%
Tue Apr  2 04:06:21 [initandlisten]         1069547520/1073741824   99%
Tue Apr  2 04:06:36 [initandlisten] query lee.system.namespaces query: { options.temp: { $in: [ true, 1 ] } } ntoreturn:0 ntoskip:0 nscanned:3 keyUpdates:0  nreturned:0 reslen:20 127ms
Tue Apr  2 04:06:38 [initandlisten] waiting for connections on port 27017

 

数据库会从日志中将尚未处理数据进行recover

 

 

四、配置文件：

 

###base##
dbpath = /backup/mongo/data/
pidfilepath = /backup/mongo/mongod.pid
port = 27017
fork = true
bind_ip = 127.0.0.1,192.168.10.220
quiet = true
logpath = /backup/mongo/mongo.log
logappend = true
journal = true
auth = true

 

配置文件格式

<option> = <value>

 

参数说明

dbpath mongod实例是数据目录的位置

pidfilepath  pid文件位置

port 监听端口 默认是27017

fork = true 启用后台模式

bind_ip 绑定地址

quiet = true 禁止输出日志文件中的所有条目，只显示重要条目

logpath 日志文件位置

logappend = true 新产生的日志内容追加而非覆盖

journal 启用日志  mongdb 64位版本默认情况是开启日志的，因此这个设置是多余的 

auth = true 开启认证 只有在admin数据库中有用户的情况下才会启用认证 

 

 

主从复制是MongoDB最为常用的复制方式 这种方式非常灵活  可用于备份 故障恢复 读扩展

 

##master##
master = true
##slave##
slave = true
source = source_ipaddress