--- title: Installing and Securing MongoDB® on Ubuntu description: This tutorial explains in 3 steps how to install and secure MongoDB® on Ubuntu Linux tags: database mysql mongoDB UFW bindIP products: - instances dates: validation: 2025-03-27 posted: 2022-03-01 validation_frequency: 12 difficulty: beginner usecase: - deploy-external-software ecosystem: - third-party --- import Requirements from '@macros/iam/requirements.mdx' [MongoDB](https://www.mongodb.com/) is a document-oriented database, available for free as an open-source solution. Renowned for its scalability, robustness, reliability, and user-friendly nature, it is one of the premier choices among NoSQL database engines. Diverging from traditional relational databases, MongoDB® users no longer need an intricate predefined schema before adding data. This flexibility stems from its ability to modify schemas at any point in time. Embracing the NoSQL philosophy, it employs JSON-like documents for data storage, allowing the insertion of diverse and arbitrary data. Powerful [General Purpose Instance](/instances/reference-content/general-purpose/) comes with the compute and storage capabilities you need to run your MongoDB® Instance smoothly. We recommend you follow this tutorial using a [General Purposeance](/instances/reference-content/choosing-instance-type/). - A Scaleway account logged into the [console](https://console.scaleway.com) - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - An [SSH key](/organizations-and-projects/how-to/create-ssh-key/) - An [Instance](/instances/how-to/create-an-instance/) running on Ubuntu Noble Numbat (24.04) or later - `sudo` privileges or access to the root user ## Setting up MongoDB ### Adding MongoDB® repository Always use the official MongoDB `mongodb-org` packages, to make sure you have the latest, up-to-date major and minor MongoDB releases. 1. [Connect to your Instance](/instances/how-to/connect-to-instance/) via SSH. ``` ssh root@your.instance.ip.address ``` If you do not know your server IP, you can list your existing servers using the [Scaleway CLI](https://github.com/scaleway/scaleway-cli#scaleway-cli-v2) `scw instance server list`. If you use the root user, you can remove the `sudo` before each command. 2. Update the Ubuntu package manager. ``` apt update ``` 3. Upgrade the Ubuntu packages already installed. ``` apt upgrade ``` 4. Import the key for the official MongoDB® repository (Ubuntu ensures the authenticity of software packages by verifying that they are signed with GPG keys.). ``` curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \ sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg \ --dearmor ``` The command above should respond with an `OK`. 5. Add the MongoDB® repository details so that Ubuntu's `apt` command-line tool will know where to download the packages. Execute the following command to create a list file for MongoDB. ``` echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list ``` If you are running a different version of Ubuntu Linux, the command above may differ. Check the [official documentation](https://www.mongodb.com/docs/manual/tutorial/install-mongodb-on-ubuntu/#install-mongodb-community-edition) for more information. 6. Update the packages list: ``` apt update ``` ### Installing MongoDB 1. Install the `mongodb-org` meta-package, which includes the daemon, configuration, and init scripts, shell, and management tools on the server. ``` apt install mongodb-org ``` 2. Press enter or type `Y` to proceed when prompted. Once the installation is completed, start the MongoDB® daemon. ``` systemctl start mongod.service ``` 3. Verify that the service has started properly. ``` systemctl status mongod.service ``` An output similar to the following displays. ``` ● mongod.service - MongoDB Database Server Loaded: loaded (/usr/lib/systemd/system/mongod.service; disabled; preset: > Active: active (running) since Mon 2024-09-16 09:36:51 UTC; 12s ago Docs: https://docs.mongodb.org/manual Main PID: 3664 (mongod) Memory: 72.9M (peak: 73.4M) CPU: 505ms CGroup: /system.slice/mongod.service └─3664 /usr/bin/mongod --config /etc/mongod.conf ``` Type `q` to exit. 4. Ensure that it restarts automatically at each boot: ``` systemctl enable mongod.service ``` ``` Created symlink from /etc/systemd/system/multi-user.target.wants/mongod.service to /lib/systemd/system/mongod.service. ``` ### Securing MongoDB The default installation of MongoDB is vulnerable because no authentication is required to interact with the database. Any user can create and destroy databases, as well as read from and write to their contents by default. To secure MongoDB, you must create an administrative user and enable authentication. 1. Connect to the [Mongo shell](https://docs.mongodb.com/mongodb-shell/) to add a new user. ``` mongosh ``` ``` Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6 Using MongoDB: 7.0.0 Using Mongosh: 1.10.6 For mongosh info see: https://docs.mongodb.com/mongodb-shell/ ``` You can choose any preferred name for the administrative user since the privilege level is assigned from the role of `userAdminAnyDatabase`. The `admin` database designates where the credentials are stored. You can learn more about authentication in the [MongoDB® Security Authentication section](https://docs.mongodb.com/manual/core/authentication/). 2. Set the username of your choice and pick your own secure password, then substitute them in the command below: ``` use admin db.createUser( { user: "AdminOce", pwd: "PWD2018AdminOce", roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] } ) ``` The command above returns: ``` { ok: 1 } ``` 3. Type `exit` and press ENTER or use `CTRL+C` to leave the client. ``` admin> exit ``` ### Enabling authentication To enforce authentication, you must enable authentication and restart the MongoDB daemon. 1. Open the configuration file. ``` nano /etc/mongod.conf ``` 2. Remove the hash in front of `security` to enable the section, then, add `authorization: "enabled"` (indented with two spaces) on the following line as shown below: ``` security: authorization: "enabled" ``` 3. Restart the daemon. ``` systemctl restart mongod.service ``` 4. Check the status to verify that the service has rebooted. ``` systemctl status mongod ``` ``` ● mongod.service - MongoDB® Database Server Loaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese> Active: active (running) since Tue 2022-03-01 10:43:45 UTC; 2s ago Docs: https://docs.mongodb.org/manual Main PID: 21449 (mongod) Memory: 153.2M CGroup: /system.slice/mongod.service └─21449 /usr/bin/mongod --config /etc/mongod.conf ``` ``` systemctl status mongod.service ``` ``` ● mongod.service - MongoDB® Database Server Loaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese> Active: active (running) since Tue 2022-03-01 10:43:45 UTC; 2s ago Docs: https://docs.mongodb.org/manual Main PID: 21449 (mongod) Memory: 153.2M CGroup: /system.slice/mongod.service └─21449 /usr/bin/mongod --config /etc/mongod.conf ``` Press `q` to exit. 5. Ensure that the daemon restarts automatically at boot. ``` systemctl enable mongod ``` ``` systemctl enable mongod.service ``` ``` Jun 27 15:36:34 mongoDB systemd[1]: Started High-performance, schema-free document-oriented database. ``` ### Testing authentication 1. Connect without credentials to verify that actions are restricted. ``` mongosh ``` The following output displays. ``` Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6 Using MongoDB: 7.0.0 Using Mongosh: 1.10.6 For mongosh info see: https://docs.mongodb.com/mongodb-shell/ test> ``` You are now connected to the `test` database. 2. Test that the access is restricted with the `show dbs` command. ``` show dbs ``` The following output displays. ``` MongoServerError: command listDatabases requires authentication ``` Type `exit` or press `CTRL+C` to exit. ### Verifying the administrative user's access 1. Connect as an administrator with the `-u` option to supply a username and `-p` to be prompted for a password. Supply the database where you stored the user's authentication credentials with the `--authenticationDatabase` option. ``` mongosh -u AdminOce -p --authenticationDatabase admin ``` 3. Enter your password. The shell displays. 2. Run the `show dbs` command to make sure you are logged in properly. ``` show dbs ``` The following output displays. ``` admin 135 kB config 61.4 kB local 73.7 kB ``` Type `exit` or press `CTRL+C` to exit. ## Configuring remote access (optional) ### Enabling UFW Uncomplicated Firewall (UFW), is a front-end to iptables. Its main goal is to make managing your firewall drop-dead simple and to provide an easy-to-use interface. If UFW is already installed on your computer, go directly to step 5. 1. Install UFW. ``` apt install ufw ``` 2. Check UFW status. ``` ufw status ``` 3. Enable UFW, as it may be inactive. ``` ufw enable ``` 4. Ensure to allow SSH. ``` ufw allow OpenSSH ``` 5. Rerun the UFW status command. ``` ufw status ``` An output similar to the following displays. ``` Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6) ``` 6. Allow access to the default MongoDB® port `27017` but restrict that access to a specific host. ``` ufw allow from client_ip_address to any port 27017 ``` 7. Re-run this command using the IP address for each additional client that needs access. To double-check the rule, run `ufw status` again: ``` ufw status ``` An output similar to the following displays. ``` To Action From -- ------ ---- OpenSSH ALLOW Anywhere 27017 ALLOW client_ip_address OpenSSH (v6) ALLOW Anywhere (v6) ``` ### Configuring a public bindIP 1. To allow remote connections, add the host's publicly routable IP address to the `mongod.conf` file. ``` nano /etc/mongod.conf ``` 2. In the `net` section, add the MongoHost's IP to the bindIp line. 3. Verify your NAT IP with the `ifconfig` command. ``` ifconfig ``` An output similar to the following displays. ``` net: port: 27017 bindIp: 127.0.0.1,IP_of_MongoHost ``` 3. Restart the daemon. ``` systemctl restart mongod.service ``` 4. Check the daemon status. ``` systemctl status mongod.service ``` An output similar to the following displays. ``` Active: active (running) since Thu 2018-xx-yy 13:15:35 UTC; 5s ago ``` ### Testing remote connections Ensure that Mongo is listening on its public interface by adding the `--host` flag with the IP address from the `mongodb.conf file`. ``` mongosh -u AdminOce -p --authenticationDatabase admin --host IP_address_of_MongoHost ``` An output similar to the following displays. ``` Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6 Using MongoDB: 7.0.0 Using Mongosh: 1.10.6 For mongosh info see: https://docs.mongodb.com/mongodb-shell/ ``` ### Uninstalling MongoDB This process will completely remove MongoDB, its configuration, and all databases. This process is not reversible, so ensure that all of your configuration and data are backed up before proceeding. 1. Stop MongoDB. ``` service mongod stop ``` 2. Remove any MongoDB® packages that you had previously installed. ``` apt purge mongodb-org* ``` 3. Remove MongoDB® databases and log files. ``` rm -r /var/log/mongodb rm -r /var/lib/mongodb ```