MongoDB 基础 -安全性-（权限操做）

和其余全部数据库同样，权限的管理都差很少同样。mongodb存储全部的用户信息在admin 数据库的集合system.users中，保存用户名、密码和数据库信息。mongodb默认不启用受权认证，只要能链接到该服务器，就可链接到mongod。若要启用安全认证，须要更改配置文件参数auth。

 https://docs.mongodb.com/manual/reference/method/db.dropAllUsers/

https://docs.mongodb.com/v2.6/tutorial/add-user-to-database/

如下测试理解

 

查看数据库：

 

> show dbs

发现 admin 居然没有！~

 

 

找了很久，找不到相关说明，因而直接建立用户admin

 

use admin


db.createUser(
  {
    user: "admin",
    pwd: "admin",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

成功建立，再查询admin中的集合，有数据了！

 

 

> show collections
system.indexes
system.users
system.version

查看3个集合的信息：

 

 

> db.system.users.find();
{ "_id" : "admin.admin", "user" : "admin", "db" : "admin", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "cFISfpbm04pmIFpqiL340g==", "storedKey" : "WG1DSEEEHUZUBjsjsnEA4RFVY2M=", "serverKey" : "9Lm+IX6l9kfaE/4C25/ghsQpDkE=" } }, "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] }
>
> db.system.indexes.find();
{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" : "admin.system.version" }
{ "v" : 1, "key" : { "_id" : 1 }, "name" : "_id_", "ns" : "admin.system.users" }
{ "v" : 1, "unique" : true, "key" : { "user" : 1, "db" : 1 }, "name" : "user_1_db_1", "ns" : "admin.system.users" }
>
> db.system.version.find();
{ "_id" : "authSchema", "currentVersion" : 5 }
>

如今启用 auth：
[root@localhost ~]# vi /etc/mongod.conf

 

 

auth=true

重启 mongod 服务：

 

[root@localhost ~]# service mongod restart

 

直接默认登陆，查看集合，发现无权操做了：

[root@localhost ~]# mongo

 

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
> show dbs
2015-05-09T21:57:03.176-0700 E QUERY    Error: listDatabases failed:{
    "ok" : 0,
    "errmsg" : "not authorized on admin to execute command { listDatabases: 1.0 }",
    "code" : 13
}
    at Error (<anonymous>)
    at Mongo.getDBs (src/mongo/shell/mongo.js:47:15)
    at shellHelper.show (src/mongo/shell/utils.js:630:33)
    at shellHelper (src/mongo/shell/utils.js:524:36)
    at (shellhelp2):1:1 at src/mongo/shell/mongo.js:47
>

 

刚才在数据库 admin 建立了一个帐户 admin ，先到数据admin进来链接（其余db则失败）：

 

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
>
> db.auth("admin","admin")
Error: 18 Authentication failed.
0
> use mydb
switched to db mydb
> db.auth("admin","admin")
Error: 18 Authentication failed.
0
> use admin
switched to db admin
> db.auth("admin","admin")
1
>

db.auth("admin","admin") 返回值为1，说明登陆成功！~db.auth("admin","admin") 记录是不存在的，执行完后这一行在shell中不会记录历史。

 

 

因此如今建立另外一个用户"myuser"

 

db.createUser(
  {
    user: "myuser",
    pwd: "myuser",
    roles: [ { role: "readWrite", db: "mydb" } ]
  }
)

也能够增删角色：

 

 

#授予角色：db.grantRolesToUser( "userName" , [ { role: "<role>", db: "<database>" } ])

db.grantRolesToUser( "myuser" , [ { role: "dbOwner", db: "mydb" } ])


#取消角色：db.grantRolesToUser( "userName" , [ { role: "<role>", db: "<database>" } ])

db.revokeRolesFromUser( "myuser" , [ { role: "readWrite", db: "mydb" } ])

由于在admin数据库建立的，只能在 admin 数据库中登陆：

 

 

> db.auth("myuser","myuser")
Error: 18 Authentication failed.
0
>
> db
mydb
> use admin
switched to db admin
> db.auth("myuser","myuser");
1
>

此时是能够切换到所在的数据库进行相关操做：

 

 

> use mydb
switched to db mydb
>
> db.tab.save({"id":999});
WriteResult({ "nInserted" : 1 })
>
> db.tab.find({"id":999});
{ "_id" : ObjectId("554ef5ac1b590330c00c7d02"), "id" : 999 }
>
> show collections
system.indexes
tab
>

在建立用户时能够在其数据库中建立，这样不用每次都进入admin数据库登陆后再切换。如在数据库"mydb"建立用户"userkk"。

 

 

use admin

db.auth("admin","admin")

use mydb

db.createUser(
  {
    user: "userkk",
    pwd: "userkk",
    roles: [ { role: "dbOwner", db: "mydb" } ]
  }
)

db.auth("userkk","userkk")

 

------------------------------------------------------------------------------------------------------------------

                                                      华丽分割

------------------------------------------------------------------------------------------------------------------

 

如今受权测试：

 

#先访问到admin数据库

 

use admin

db.auth("admin","admin")

 

 

#切换到 mydb ，在数据库 mydb 中建立角色
#roles: 建立角色"testRole"在数据库 "mydb" 中
#privileges: 该角色可查看"find"数据库"mydb"的全部集合
#db.dropRole("testRole")

use mydb

db.createRole({
 role: "testRole",
 privileges: [{ resource: { db: "mydb", collection: "" }, actions: [ "find" ] }],
 roles: []
})

#在admin数据库生成集合system.roles。查看角色。

 

> use admin
switched to db admin
>
> show collections
system.indexes
system.roles
system.users
system.version
>
> db.system.roles.find();
{ "_id" : "mydb.testRole", "role" : "testRole", "db" : "mydb", "privileges" : [ { "resource" : { "db" : "mydb", "collection" : "" }, "actions" : [ "find" ] } ], "roles" : [ ] }
>

#回到mydb，在数据库mydb中建立用户并授予角色"testRole"
#db.dropUser("userkk")

 

 

use mydb

db.createUser(
  {
    user: "userkk",
    pwd: "userkk",
    roles: [ { role: "testRole", db: "mydb" } ]
  }
)

退出mongodb，从新登陆进行操做。发现只能使用find
>exit

 

 

[root@localhost ~]# mongo
MongoDB shell version: 3.0.2
connecting to: test
> use mydb
switched to db mydb
>
> db.auth("userkk","userkk")
1
>
> db.tab.find({"id":999})
{ "_id" : ObjectId("554ef5ac1b590330c00c7d02"), "id" : 999 }
>
> db.tab.insert({"id":1000})
WriteResult({
    "writeError" : {
        "code" : 13,
        "errmsg" : "not authorized on mydb to execute command { insert: \"tab\", documents: [ { _id: ObjectId('554f145cdf782b42499d80e5'), id: 1000.0 } ], ordered: true }"
    }
})
>

给角色 "testRole"  添加3个 “Privileges”权限： "update", "insert", "remove"。再从新操做。

 

 

use admin

db.auth("admin","admin")

use mydb

#添加Privileges给角色
db.grantPrivilegesToRole("testRole",
 [{ resource: { db: "mydb", collection: "" },actions: [ "update", "insert", "remove" ]}
])


exit #退出mongodb从新登陆


use mydb

db.auth("userkk","userkk")


#增删数据能够操做了！~
db.tab.insert({"id":1000})
db.tab.find({"id":1000})
db.tab.remove({"id":1000})


#此时admin的角色记录为：
> db.system.roles.find();
{ "_id" : "mydb.testRole", "role" : "testRole", "db" : "mydb", "privileges" : [ { "resource" : { "db" : "mydb", "collection" : "" }, "actions" : [ "find", "insert", "remove", "update" ] } ], "roles" : [ ] }
>

#更改角色 roles，把roles值所有更新。一样Privileges也能够更新替换！~

 

 

use admin

db.auth("admin","admin")

use mydb

db.updateRole("testRole",{ roles:[{ role: "readWrite",db: "mydb"}]},{ w:"majority" })

db.auth("userkk","userkk")

show dbs

 

 

关于角色，参考官方文档提取总结以下：

 

角色分类	角色	权限及角色 （本文大小写可能有些变化，使用时请参考官方文档）
Database User Roles	read	CollStats,dbHash,dbStats,find,killCursors,listIndexes,listCollections
	readWrite	CollStats,ConvertToCapped,CreateCollection,DbHash,DbStats, DropCollection,CreateIndex,DropIndex,Emptycapped,Find, Insert,KillCursors,ListIndexes,ListCollections,Remove, RenameCollectionSameDB,update
Database Administration Roles	dbAdmin	collStats,dbHash,dbStats,find,killCursors,listIndexes,listCollections, dropCollection 和 createCollection 在 system.profile
	dbOwner	角色：readWrite, dbAdmin,userAdmin
	userAdmin	ChangeCustomData,ChangePassword,CreateRole,CreateUser, DropRole,DropUser,GrantRole,RevokeRole,ViewRole,viewUser
Cluster Administration Roles	clusterAdmin	角色：clusterManager, clusterMonitor, hostManager
	clusterManager	AddShard,ApplicationMessage,CleanupOrphaned,FlushRouterConfig, ListShards,RemoveShard,ReplSetConfigure,ReplSetGetStatus, ReplSetStateChange,Resync,   EnableSharding,MoveChunk,SplitChunk,splitVector
	clusterMonitor	connPoolStats,cursorInfo,getCmdLineOpts,getLog,getParameter, getShardMap,hostInfo,inprog,listDatabases,listShards,netstat, replSetGetStatus,serverStatus,shardingState,top   collStats,dbStats,getShardVersion
	hostManager	applicationMessage,closeAllDatabases,connPoolSync,cpuProfiler, diagLogging,flushRouterConfig,fsync,invalidateUserCache,killop, logRotate,resync,setParameter,shutdown,touch,unlock
Backup and Restoration Roles	backup	提供在admin数据库mms.backup文档中insert,update权限 列出全部数据库：listDatabases 列出全部集合索引：listIndexes   对如下提供查询操做：find *非系统集合 *系统集合：system.indexes, system.namespaces, system.js *集合：admin.system.users 和 admin.system.roles
	restore	非系统集合、system.js，admin.system.users 和 admin.system.roles 及2.6 版本的system.users提供如下权限： collMod,createCollection,createIndex,dropCollection,insert   列出全部数据库：listDatabases system.users ：find,remove,update
All-Database Roles	readAnyDatabase	提供全部数据库中只读权限：read 列出集群全部数据库：listDatabases
	readWriteAnyDatabase	提供全部数据库读写权限：readWrite 列出集群全部数据库：listDatabases
	userAdminAnyDatabase	提供全部用户数据管理权限：userAdmin Cluster：authSchemaUpgrade,invalidateUserCache,listDatabases admin.system.users和admin.system.roles： collStats,dbHash,dbStats,find,killCursors,planCacheRead createIndex,dropIndex
	dbAdminAnyDatabase	提供全部数据库管理员权限：dbAdmin 列出集群全部数据库：listDatabases
Superuser Roles	root	角色：dbOwner，userAdmin，userAdminAnyDatabase readWriteAnyDatabase, dbAdminAnyDatabase, userAdminAnyDatabase，clusterAdmin
Internal Role	__system	集群中对任何数据库采起任何操做

 

 

 

参考：mongo Shell Methods  ， Built-In Roles，Security Methods in the mongo Shell