Installing and Securing MongoDB on Ubuntu Focal Fossa (20.04)
- database
- compute
- mysql
- mongoDB
- UFW
- bindIP
MongoDB is a document-oriented database, available for free as an open-source solution. Renowned for its scalability, robustness, reliability, and user-friendly nature, it is one of the premier choices among NoSQL database engines.
Diverging from traditional relational databases, MongoDB users no longer need an intricate predefined schema before adding data. This flexibility stems from its ability to modify schemas at any point in time. Embracing the NoSQL philosophy, it employs JSON-like documents for data storage, allowing the insertion of diverse and arbitrary data.
Powerful Production-Optimized Instance come with the compute and storage capabilities you need to run your MondoDB Instance smoothly.
We recommend you follow this tutorial using a Production-Optimized Instance.
You may need certain IAM permissions to carry out some actions described on this page. This means:
- you are the Owner of the Scaleway Organization in which the actions will be carried out, or
- you are an IAM user of the Organization, with a policy granting you the necessary permission sets
- You have an account and are logged into the Scaleway console
- You have configured your SSH key
- You have created an Instance that runs Ubuntu Focal Foassa (20.04) or later
- You have privileges or access to the root user.
Setting up MongoDB
Adding MongoDB repository
You should always use the official MongoDB mongodb-org
packages, to make sure you have the latest, up-to-date major and minor MongoDB releases.
-
Connect to your Instance via SSH.
ssh root@your.instance.ip.addressIf you do not know your server IP, you can list your existing servers using the Scaleway CLI
scw instance server list
.Tip:If you use the root user, you can remove the
sudo
before each command. -
Update the Ubuntu package manager.
apt update -
Upgrade the Ubuntu packages already installed.
apt upgrade -
Import the key for the official MongoDB repository (Ubuntu ensures the authenticity of software packages by verifying that they are signed with GPG keys.).
curl -fsSL https://pgp.mongodb.com/server-7.0.asc | \sudo gpg -o /etc/apt/trusted.gpg.d/mongodb-server-7.0.gpg \--dearmorThe command above should respond with an
OK
. -
Add the MongoDB repository details so that Ubuntu’s
apt
command-line tool will know where to download the packages. Execute the following command to create a list file for MongoDB.echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.listTip:If you are running a different Version of Ubuntu Linux, the command above may differ. Check the official documentation for more information.
-
Update the packages list
apt update
Installing MongoDB
-
Install the
mongodb-org
meta-package, which includes the daemon, configuration and init scripts, shell, and management tools on the server.apt install mongodb-org -
Press enter or type
Y
to proceed when prompted. Once the installation is completed, start the MongoDB daemon.systemctl start mongod.service -
Since
systemctl
does not provide output, verify that the service has started properly.systemctl status mongod● mongod.service - MongoDB Database ServerLoaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese>Active: active (running) since Tue 2022-03-01 10:36:39 UTC; 1s agoDocs: https://docs.mongodb.org/manualMain PID: 21330 (mongod)Memory: 59.7MCGroup: /system.slice/mongod.service└─21330 /usr/bin/mongod --config /etc/mongod.confsystemctl status mongod.service● mongod.service - MongoDB Database ServerLoaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese>Active: active (running) since Tue 2022-03-01 10:36:39 UTC; 1s agoDocs: https://docs.mongodb.org/manualMain PID: 21330 (mongod)Memory: 59.7MCGroup: /system.slice/mongod.service└─21330 /usr/bin/mongod --config /etc/mongod.confPress
q
to exit. -
Ensure that it restarts automatically at each boot
systemctl enable mongod.serviceCreated symlink from /etc/systemd/system/multi-user.target.wants/mongod.service to /lib/systemd/system/mongod.service.
Securing MongoDB
The default installation of MongoDB is vulnerable because no authentication is required to interact with the database. Any user could create and destroy databases, as well as read from and write to their contents by default. To secure MongoDB, we need to create an administrative user and enable authentication.
-
Connect to the Mongo shell to add a new user.
mongoshConnecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6Using MongoDB: 7.0.0Using Mongosh: 1.10.6For mongosh info see: https://docs.mongodb.com/mongodb-shell/
You can choose any preferred name for the administrative user since the privilege level is assigned from the role of `userAdminAnyDatabase`.The `admin` database designates where the credentials are stored. You can learn more about authentication in the [MongoDB Security Authentication section](https://docs.mongodb.com/manual/core/authentication/). -
Set the username of your choice and be sure to pick your own secure password and substitute them in the command below:
use admindb.createUser({user: "AdminOce",pwd: "PWD2018AdminOce",roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]})The command above returns:
{ ok: 1 } -
Type
exit
and press ENTER or useCTRL+C
to leave the client.admin> exit
Enabling authentication
In order to enforce authentication, we need to enable authentication and restart the MongoDB daemon.
-
Open the configuration file.
nano /etc/mongod.conf -
Remove the hash in front of
security
to enable the section. Then, we add the authorization lines (indented with two spaces) as per the following excerpt below:security:authorization: "enabled" -
Restart the daemon.
systemctl restart mongod.service -
Check the status to verify that the service has rebooted.
systemctl status mongod● mongod.service - MongoDB Database ServerLoaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese>Active: active (running) since Tue 2022-03-01 10:43:45 UTC; 2s agoDocs: https://docs.mongodb.org/manualMain PID: 21449 (mongod)Memory: 153.2MCGroup: /system.slice/mongod.service└─21449 /usr/bin/mongod --config /etc/mongod.confsystemctl status mongod.service● mongod.service - MongoDB Database ServerLoaded: loaded (/lib/systemd/system/mongod.service; disabled; vendor prese>Active: active (running) since Tue 2022-03-01 10:43:45 UTC; 2s agoDocs: https://docs.mongodb.org/manualMain PID: 21449 (mongod)Memory: 153.2MCGroup: /system.slice/mongod.service└─21449 /usr/bin/mongod --config /etc/mongod.confPress
q
to exit. -
Ensure that the daemon restarts automatically at boot.
systemctl enable mongodsystemctl enable mongod.serviceJun 27 15:36:34 mongoDB systemd[1]: Started High-performance, schema-free document-oriented database.
Testing authentication
-
Connect without credentials to verify that our actions are restricted
mongoshConnecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6Using MongoDB: 7.0.0Using Mongosh: 1.10.6For mongosh info see: https://docs.mongodb.com/mongodb-shell/test>We are connected to the
test
database. -
Test that the access is restricted with the
show dbs
command:test> show dbsMongoServerError: command listDatabases requires authentication -
Exit the shell to proceed.
> exitbye
Verifying the administrative user’s access
- Connect as our administrator with the
-u
option to supply a username and-p
to be prompted for a password. Supply the database where we stored the user’s authentication credentials with the--authenticationDatabase
option.mongosh -u AdminOce -p --authenticationDatabase admin - Once the correct password is entered, we are dropped into the shell, where we can issue the
show dbs
command:test> show dbsadmin 135 kBconfig 61.4 kBlocal 73.7 kB
Type exit
or press CTRL+C
to exit.
Configuring remote access (optional)
Enabling UFW
Uncomplicated Firewall (UFW), is a front-end to iptables. Its main goal is to make managing your firewall drop-dead simple and to provide an easy-to-use interface.
If UFW is already installed on your computer, go directly to step 5.
- Install UFW.
apt install ufw
- Check UFW status.
ufw status
- Enable UFW, as it is probably inactive.
ufw enable
- Ensure to allow SSH.
ufw allow OpenSSH
- Rerun the UFW status command.
ufw statusStatus: activeTo Action From-- ------ ----OpenSSH ALLOW AnywhereOpenSSH (v6) ALLOW Anywhere (v6)
- Allow access to the default MongoDB port
27017
but restrict that access to a specific host.ufw allow from client_ip_address to any port 27017 - Re-run this command using the IP address for each additional client that needs access. To double-check the rule, run
ufw status
again:ufw statusTo Action From-- ------ ----OpenSSH ALLOW Anywhere27017 ALLOW client_ip_addressOpenSSH (v6) ALLOW Anywhere (v6)
Configuring a public bindIP
-
To allow remote connections, add our host’s publically-routable IP address to the
mongod.conf
file.nano /etc/mongod.conf -
In the
net
section, add the MongoHost’s IP to the bindIp line.Note:Verify your private IP with the
ifconfig
command.net:port: 27017bindIp: 127.0.0.1,IP_of_MongoHost -
Restart the daemon.
systemctl restart mongod.service -
Check the daemon status.
systemctl status mongod.serviceActive: active (running) since Thu 2018-xx-yy 13:15:35 UTC; 5s ago
Testing remote connections
Ensure that Mongo is listening on its public interface by adding the --host
flag with the IP address from the mongodb.conf file
.
mongosh -u AdminOce -p --authenticationDatabase admin --host IP_address_of_MongoHost
Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.10.6Using MongoDB: 7.0.0Using Mongosh: 1.10.6For mongosh info see: https://docs.mongodb.com/mongodb-shell/
Uninstalling MongoDB
This process will completely remove MongoDB, its configuration, and all databases. This process is not reversible, so ensure that all of your configuration and data is backed up before proceeding.
- Stop MongoDB.
service mongod stop
- Remove any MongoDB packages that you had previously installed.
apt purge mongodb-org*
- Remove MongoDB databases and log files.
rm -r /var/log/mongodbrm -r /var/lib/mongodb