MongoDB用户权限管理 #

# mongod.conf
security:
  authorization: enabled

# 命令行启动
mongod --auth

// 连接MongoDB
mongosh

// 切换到admin数据库
use admin

// 创建管理员
db.createUser({
    user: "admin",
    pwd: "password123",
    roles: [
        { role: "userAdminAnyDatabase", db: "admin" },
        { role: "readWriteAnyDatabase", db: "admin" }
    ]
})

// 或创建超级管理员
db.createUser({
    user: "root",
    pwd: "password123",
    roles: ["root"]
})

// 切换到目标数据库
use mydb

// 创建读写用户
db.createUser({
    user: "appuser",
    pwd: "password123",
    roles: [
        { role: "readWrite", db: "mydb" }
    ]
})

// 创建只读用户
db.createUser({
    user: "readonly",
    pwd: "password123",
    roles: [
        { role: "read", db: "mydb" }
    ]
})

// 查看当前数据库用户
db.getUsers()

// 查看指定用户
db.getUser("appuser")

// 查看所有用户（admin数据库）
use admin
db.system.users.find()

// 修改密码
db.changeUserPassword("appuser", "newpassword")

// 修改用户信息
db.updateUser("appuser", {
    roles: [
        { role: "readWrite", db: "mydb" },
        { role: "read", db: "otherdb" }
    ]
})

// 添加角色
db.grantRolesToUser("appuser", [
    { role: "dbAdmin", db: "mydb" }
])

// 移除角色
db.revokeRolesFromUser("appuser", [
    { role: "read", db: "otherdb" }
])

// 删除用户
db.dropUser("appuser")

// 删除所有用户（当前数据库）
db.dropAllUsers()

// 创建自定义角色
use admin

db.createRole({
    role: "appAdmin",
    privileges: [
        { resource: { db: "mydb", collection: "" }, actions: ["find", "insert", "update"] },
        { resource: { db: "mydb", collection: "logs" }, actions: ["insert"] }
    ],
    roles: [
        { role: "read", db: "mydb" }
    ]
})

// 查看角色
db.getRole("appAdmin", { showPrivileges: true })

// 查看所有角色
db.getRoles()

// 查看用户角色
db.getUser("appuser").roles

// 添加权限
db.grantPrivilegesToRole("appAdmin", [
    { resource: { db: "mydb", collection: "users" }, actions: ["remove"] }
])

// 移除权限
db.revokePrivilegesFromRole("appAdmin", [
    { resource: { db: "mydb", collection: "users" }, actions: ["remove"] }
])

// 添加角色
db.grantRolesToRole("appAdmin", [
    { role: "readWrite", db: "mydb" }
])

// 删除角色
db.dropRole("appAdmin")

// 指定数据库和集合
{ resource: { db: "mydb", collection: "users" }, actions: ["find"] }

// 指定数据库所有集合
{ resource: { db: "mydb", collection: "" }, actions: ["find"] }

// 所有数据库所有集合
{ resource: { db: "", collection: "" }, actions: ["find"] }

// 集群资源
{ resource: { cluster: true }, actions: ["serverStatus"] }

# 连接时认证
mongosh -u admin -p password123 --authenticationDatabase admin

# 连接后认证
mongosh
> use admin
> db.auth("admin", "password123")

# 连接字符串
mongosh "mongodb://admin:password123@localhost:27017/mydb?authSource=admin"

# MongoDB Atlas
mongosh "mongodb+srv://user:password@cluster.mongodb.net/mydb"

// Node.js
const { MongoClient } = require('mongodb')

const uri = "mongodb://admin:password123@localhost:27017/mydb?authSource=admin"
const client = new MongoClient(uri)

async function run() {
    await client.connect()
    const db = client.db('mydb')
    // ...
}

# 生成keyFile
openssl rand -base64 756 > /etc/mongodb/keyfile
chmod 400 /etc/mongodb/keyfile
chown mongodb:mongodb /etc/mongodb/keyfile

# mongod.conf
security:
  authorization: enabled
  keyFile: /etc/mongodb/keyfile

1. 生成keyFile
2. 分发keyFile到所有成员
3. 配置所有成员使用keyFile
4. 重启所有成员
5. 创建管理员用户

# 所有组件使用相同的keyFile
security:
  keyFile: /etc/mongodb/keyfile

1. Config Server配置keyFile
2. 所有Shard配置keyFile
3. mongos配置keyFile
4. 创建管理员用户

1. 最小权限原则
   - 只授予必要的权限
   - 避免使用root角色

2. 分类管理
   - 管理员用户
   - 应用用户
   - 只读用户

3. 密码管理
   - 使用强密码
   - 定期更换密码
   - 不在代码中硬编码

4. 审计日志
   - 启用审计日志
   - 记录用户操作

# mongod.conf
security:
  authorization: enabled
  keyFile: /etc/mongodb/keyfile

net:
  bindIp: 127.0.0.1,内网IP
  port: 27017

# 启用TLS
net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/mongodb/server.pem

# mongod.conf
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json