mongodb sharded cluster认证

最新推荐文章于 2024-11-28 09:29:14 发布

原创最新推荐文章于 2024-11-28 09:29:14 发布 · 357 阅读

0 ·

CC 4.0 BY-SA版权

MONGODB 专栏收录该内容

28 篇文章

订阅专栏

1、生成密钥文件
openssl rand -base64 741 > /home/keyfile
chmod 600 keyfile
建议把密钥文件的权限设置为600（针对启动mongo实例的那个用户）
接着需要把这个密钥文件拷贝到集群中每一个结点上（路由结点，元配置结点，分片结点上都要有这个密钥文件）；
注：开启了keyFile,隐含就开启了auth，连接副本集就需要进行认证了，否则只能通过本地例外方式操作数据库。

在副本集中添加用户需要在服务未加--keyFile参数启动的情况加按照单实例方法添加(访问任意一个副本器操作，其他副本集会自动同步)，账户添加、授权成功后重新加入keyFile启动服务，即可完成并使用。

2、把生成的密钥文件拷贝到集群中每一个结点上：
12
cp /home/keyfile /opt/config/data/
cp /home/keyfile /opt/mongos/
cp /home/keyfile /opt/shard1/data/
cp /home/keyfile /opt/shard2/data/
cp /home/keyfile /opt/shard3/data/
cp /home/keyfile /opt/shard4/data/
cp /home/keyfile /opt/shard5/data/

scp /ho keyfile 13/14/15/16

13
scp /ho keyfile IP:/opt/config/data/
scp /ho keyfile IP:/opt/mongos/
scp /ho keyfile IP:/opt/shard1/data/
scp /ho keyfile IP:/opt/shard2/data/
scp /ho keyfile IP:/opt/shard3/data/
scp /ho keyfile IP:/opt/shard4/data/
scp /ho keyfile IP:/opt/shard5/data/

14
scp /ho keyfile IP:/opt/config/data/
scp /ho keyfile IP:/opt/mongos/
scp /ho keyfile IP:/opt/shard1/data/
scp /ho keyfile IP:/opt/shard2/data/
scp /ho keyfile IP:/opt/shard3/data/
scp /ho keyfile IP:/opt/shard4/data/
scp /ho keyfile IP:/opt/shard5/data/

15
scp /ho keyfile IP:/opt/config/data/
scp /ho keyfile IP:/opt/mongos/
scp /ho keyfile IP:/opt/shard1/data/
scp /ho keyfile IP:/opt/shard2/data/
scp /ho keyfile IP:/opt/shard3/data/
scp /ho keyfile IP:/opt/shard4/data/
scp /ho keyfile IP:/opt/shard5/data/

16
scp /ho keyfile IP:/opt/config/data/
scp /ho keyfile IP:/opt/mongos/
scp /ho keyfile IP:/opt/shard1/data/
scp /ho keyfile IP:/opt/shard2/data/
scp /ho keyfile IP:/opt/shard3/data/
scp /ho keyfile IP:/opt/shard4/data/
scp /ho keyfile IP:/opt/shard5/data/

find /opt/ -name keyfile

3、登陆mongos添加集群用户
db.createUser({
... user: "rootadminAAA",
... pwd: "admDDDDin@2018DDDDMDDDDWEEEEDntQ",
... roles: [
... {role: "clusterAdmin", db: "admin"},
... {role: "readWriteAnyDatabase", db: "admin"},
... {role: "userAdminAnyDatabase", db: "admin"},
... {role: "dbAdminAnyDatabase", db: "admin"}]
... })

db.auth("rootadmin","admDDDDin@2018DDDDMDDDDWEEEEDntQ")

注：在 3步时，查看集群里有哪个用户信息及权限；

4、查看各个集群启动的服务如下：
12
root 3684 1 1 Jan28 ? 21:43:41 /usr/local/mongodb-3.6.2/bin/mongos --config /usr/local/mongodb-3.6.2/conf/mongos.conf
root 3775 1 0 Jan28 ? 13:37:34 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard1.conf
root 3817 1 0 Jan28 ? 12:36:42 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard4.conf
root 3854 1 1 Jan28 ? 1-00:42:30 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard5.conf
root 179829 179810 0 19:36 pts/

13
root@mongodb-2:/root# ps -ef|grep mongodb
root 3590 1 1 Jan28 ? 20:57:43 /usr/local/mongodb-3.6.2/bin/mongos --config /usr/local/mongodb-3.6.2/conf/mongos.conf
root 3675 1 0 Jan28 ? 13:11:40 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard1.conf
root 3705 1 1 Jan28 ? 1-03:28:35 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard2.conf
root 3736 1 1 Jan28 ? 1-01:06:04 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard5.conf
root 126060 125886 0 19:45 pts/0 00:00:00 grep --color=auto mongodb

root@mongodb-2:/

14
root@mongodb-3:/root# ps -ef|grep mongodb
root 3632 1 1 Jan28 ? 19:46:19 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/config.conf
root 3860 1 0 Jan28 ? 13:37:56 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard1.conf
root 3888 1 1 Jan28 ? 1-07:32:44 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard2.conf
root 3915 1 31 Jan28 ? 24-13:32:59 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard3.conf
root 155784 155565 0 19:47 pts/0 00:00:00 grep --color=auto mongodb
root@mongodb-3:/root#

15
root@mongodb-4:/root# ps -ef|grep mongodb
root 3569 1 0 Jan28 ? 16:42:16 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/config.conf
root 3743 1 1 Jan28 ? 1-05:20:08 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard2.conf
root 3770 1 7 Jan28 ? 6-01:45:03 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard3.conf
root 3797 1 0 Jan28 ? 13:08:35 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard4.conf
root 155083 154867 0 19:48 pts/0 00:00:00 grep --color=auto mongodb
root@mongodb-4:/root#

16
root@mongodb-5:/root# ps -ef|grep mongodb
root 3571 1 0 Jan28 ? 16:41:09 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/config.conf
root 3753 1 7 Jan28 ? 6-01:51:58 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard3.conf
root 3780 1 0 Jan28 ? 12:35:49 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard4.conf
root 3808 1 1 Jan28 ? 1-11:18:29 /usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard5.conf
root 55001 54787 0 19:48 pts/0 00:00:00 grep --color=auto mongodb
root@mongodb-5:/root#

5、关闭原先的集群：db.shutdownServer()
注意，需要按照路由结点(mongos) -> 配置结点(config) -> 分片结点(shard1-5) 的顺序，依次关闭各结点的进程

6、重新启动集群 :，需要按照配置结点(config) -> 分片结点(shard1-5)->路由结点(mongos) 的顺序
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/config.conf --keyFile /opt/config/data/keyfile
/usr/local/mongodb-3.6.2/bin/mongos --config /usr/local/mongodb-3.6.2/conf/mongos.conf --keyFile /opt/mongos/keyfile
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard1.conf --keyFile /opt/shard1/data/keyfile
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard2.conf --keyFile /opt/shard2/data/keyfile
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard3.conf --keyFile /opt/shard3/data/keyfile
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard4.conf --keyFile /opt/shard4/data/keyfile
/usr/local/mongodb-3.6.2/bin/mongod --config /usr/local/mongodb-3.6.2/conf/shard5.conf --keyFile /opt/shard5/data/keyfile

7、验证集群的认证
root@node:/root#mongo IP:20000
mongos> db
test
mongos> show collections;
2018-04-09T16:31:17.604+0800 E QUERY [thread1] Error: listCollections failed: {
"ok" : 0,
"errmsg" : "not authorized on test to execute command { listCollections: 1.0, filter: {},

mongos> use admin
switched to db admin
mongos> show collections;
2018-04-09T16:31:26.158+0800 E QUERY [thread1] Error: listCollections failed: {
"ok" : 0,
"errmsg" : "not authorized on admin to execute command { listCollections: 1.0, filter: {},

账户认证后状态
#admin库认证
mongo IP:20000/admin -u rootadmin -p admin@2018MintQ
mongos> show collections;
system.indexes
system.users
system.version