Here is how you can install MongoDB 3.4.x on Ubuntu 16.04 and secure it. I use the Studio 3T software form Studio 3T.
Advertisement:
Before you install MongoDB ensure you have secured your server and installed it and installed an SSL certificate. Click the links here to setup a Digital Ocean, Vultr or AWS Server. Read my old guide on installing MongoDB on Ubuntu 14.04 and using Studio 3T ( https://studio3t.com/ ).
Install MongoDB 3.4
Here are the official install instructions here
First, you will need to add the MongoDB v3.4 package known Ubuntu install packages list.
|
1 |
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 0C49F3730359A14518585931BC711F9BA15703C6 |
Remove old MongoDB sources for 3.2 (if you tried previous installs like I did)
|
1 |
rm /etc/apt/sources.list.d/mongodb-org-3.2* |
Install MongoDB on Ubuntu 16.04
|
1 2 3 |
echo "deb [ arch=amd64,arm64 ] http://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.4.list sudo apt-get update sudo apt-get install -y mongodb-org |
Make changes (as required) to /etc/mongod.conf
|
1 2 3 4 5 |
sudo nano /etc/mongod.conf > # e.g >dbPath: /yourmongodb_data_path/ >path: /yourmongodb_logs_path/mongod.log >port: 12345 |
Now we need to enable the auto starting of MongoDB
|
1 |
sudo nano /etc/systemd/system/mongod.service |
Add the following contents to the above file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
[Unit] Description=High-performance, schema-free document-oriented database After=network.target [Service] User=mongodb ExecStart=/usr/bin/mongod --fork --config /etc/mongod.conf --quiet --dbpath /yourmongodb_data_path/ --logpath/yourmongodb_logs_path/mongod.log --logappend --smallfiles --auth # file size LimitFSIZE=infinity # cpu time LimitCPU=infinity # virtual memory size LimitAS=infinity # open files LimitNOFILE=64000 # processes/threads LimitNPROC=64000 # total threads (user+kernel) TasksMax=infinity TasksAccounting=false [Install] WantedBy=multi-user.target |
Reload daemon services
|
1 |
systemctl daemon-reload |
Verify the MongoDB service file exists
|
1 |
ls /etc/systemd/system | grep mongo |
View the status of services
|
1 2 3 4 5 6 7 8 9 10 |
systemctl list-unit-files --type=service UNIT FILE STATE accounts-daemon.service enabled acpid.service disabled apport-forward@.service static apt-daily-upgrade.service static apt-daily.service static ... mongod.service enabled ... |
Set MongoDB to auto start at startup
|
1 |
sudo systemctl enable mongod |
Troubleshooting on 16.04 (service won’t start)
I had multiple MongoDB configuration files ans these commnds were handy troubleshooting.
|
1 2 |
/etc/systemd/system/mongodb.service /lib/systemd/system/mongodb.service |
I was unable to start my MongoDB service
|
1 2 3 4 5 |
sudo systemctl start mongodb Failed to start mongodb.service: Unknown unit: mongodb.service See system logs and 'systemctl status mongodb.service' for details. sudo service mongod restart mongod: unrecognized service |
I removed upstart service
|
1 |
sudo apt-get remove upstart |
Check Mongo DB installed components
|
1 2 3 4 5 6 |
dpkg -l '*mongod*' | grep ii ii mongodb-org 3.4.8 amd64 MongoDB open source document-oriented database system (metapackage) ii mongodb-org-mongos 3.4.8 amd64 MongoDB sharded cluster query router ii mongodb-org-server 3.4.8 amd64 MongoDB database server ii mongodb-org-shell 3.4.8 amd64 MongoDB shell client ii mongodb-org-tools 3.4.8 amd64 MongoDB tools |
Check MongoDB locations
|
1 2 3 4 |
dpkg -L mongodb-org-server | grep systemd /lib/systemd /lib/systemd/system /lib/systemd/system/mongod.service |
I cleared all past MongoDB service files in /etc/systemd/system and in /lib/systemd/system/ (deleting mongod.service and mongodb.service files that were mistakenly created) Various guides on the net said to create these files.
Firewall
Configure your firewall (tip: whitelist your local development IP to allow your IP access etc)
|
1 2 3 4 5 6 7 8 9 |
sudo ufw allow from 123.123.123.12/32 to any port 27017 Rule added sudo ufw reload Firewall reloaded sudo ufw allow out 27017 Rule added Rule added (v6) |
Reload the firewall and show the status. Add port 27017 (or your custom port) to your TCP and UDP firewall. http://icanhazip.com/ will display your public IP.
|
1 2 3 4 5 6 7 8 9 10 11 |
sudo ufw reload sudo ufw status Status: active To Action From -- ------ ---- ... 27017 ALLOW 123.123.123.123 ... 27017 ALLOW OUT Anywhere ... |
Display the MongoDB version
|
1 2 3 4 5 6 7 8 9 10 |
mongod -version db version v3.4.7 git version: cf38c1b8a0a8dca4a11737581beafef4fe120bcd OpenSSL version: OpenSSL 1.0.2g 1 Mar 2016 allocator: tcmalloc modules: none build environment: distmod: ubuntu1604 distarch: x86_64 target_arch: x86_64 |
Make MongoDB configuration changes
|
1 |
sudo nano /etc/mongod.conf |
– Consider saving your database data somewhere else (mongodb.conf)
|
1 2 |
storage: dbPath: /folder_to_store_mongodb_data/ |
– Consider redirecting your log file (mongodb.conf)
|
1 2 3 4 |
systemLog: destination: file logAppend: true path: "/folder_to_store_mongodb_logs/mongo.log" |
– Consider changing the default MongoDB port (mongodb.conf)
|
1 2 |
net: port: 27123 |
– Allow MongoDB to talk locally and globally if need be and optionally enable IPV6 (binding IP’s in mongodb.conf)
TIP: Ensure you bind you localhost port (127.0.0.1) AND your public IP (e.g 123.123.123.123) as you will need to bind to public IP too if you want to connect to MongoDB externally. I did not bing my eternal IP and was blocked for a few days.
|
1 2 3 |
net: ipv6: true bindIp: 127.0.0.1,123.123.123.123 |
If you allow external access then consider whitelisting your IP and disabling local admin login – more here (mongodb.conf)
|
1 2 |
setParameter: enableLocalhostAuthBypass: false |
Enabling MongoDB at startup.
|
1 2 |
sudo systemctl enable mongod Created symlink from /etc/systemd/system/multi-user.target.wants/mongod.service to /lib/systemd/system/mongod.service. |
Start MongoDB
|
1 |
sudo service mongod start |
tip: You will need to bind to your local and external public IP to allow connections to your database (ensure you whitelist IPs that will have access to your database and not let everyone in).
Official configuration documentation can be found here.
At this stage, MongoDB is open to the world and if you connect to your server with no username or password you will see it is open.
I created an admin user with Studio 3T for MongoDB in the IntelliShell.
I typed the following to create a user (I added a root role after creating the screenshot above).
|
1 2 |
use admin db.createUser({user: "yourusername", pwd: "yourpassword", roles:[{role: "userAdminAnyDatabase", db: "admin"},{role: "root", db: "admin"}]}) |
Verify that the user was created
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
show users { "_id" : "admin.yourusername", "user" : "yourusername", "db" : "admin", "roles" : [ { "role" : "root", "db" : "admin" }, { "role" : "userAdminAnyDatabase", "db" : "admin" } ] } |
Now you can use these credentials to log in to the database.
You can see the new credentials are working and now we need to remove anonymous and empty connections.
Add the following to mongodb.conf
|
1 2 |
security: authorization: enabled |
Restart MongoDB
|
1 2 |
sudo systemctl stop mongodb sudo systemctl start mongodb |
or
|
1 |
/usr/bin/mongod --config /etc/mongod.conf |
Now when you connect to your database with no login details you will see no databases.
Show the status of MongoDB
|
1 2 3 4 5 6 7 8 9 10 11 |
sudo systemctl start mongodb user@server:~# sudo systemctl status mongodb ● mongodb.service - High-performance, schema-free document-oriented database Loaded: loaded (/etc/systemd/system/mongodb.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2017-08-18 18:00:38 AEST; 4 days ago Main PID: 6946 (mongod) Tasks: 19 Memory: 76.3M CPU: 57min 16.367s CGroup: /system.slice/mongodb.service └─6946 /usr/bin/mongod --quiet --config /etc/mongod.conf |
View the last 20 lines of the MongoDB log file.
|
1 |
tail -n 20 /var/log/mongodb/mongod.log |
(or replace the path with your log location)
|
1 |
tail -n 20 /yourmongodb_logs/mongod.log |
Viewing MongoDB files
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
ls -al total 384 drwxr-xr-x 4 root root 4096 Sep 5 18:12 . drwxr-xr-x 30 root root 4096 Aug 5 18:48 .. -rw-r--r-- 1 root root 32768 Sep 5 18:12 collection-0--5805649544981213952.wt -rw-r--r-- 1 root root 36864 Sep 5 18:12 collection-0-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:12 collection-2-6117837641988028070.wt drwxr-xr-x 2 root root 4096 Sep 5 18:12 diagnostic.data -rw-r--r-- 1 root root 16384 Sep 5 18:47 index-1--5805649544981213952.wt -rw-r--r-- 1 root root 36864 Sep 5 18:12 index-1-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:12 index-3-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:47 index-4-6117837641988028070.wt drwxr-xr-x 2 root root 4096 Sep 5 18:03 journal -rw-r--r-- 1 root root 32768 Sep 5 18:12 _mdb_catalog.wt -rw-r--r-- 1 root root 0 Sep 5 18:12 mongod.lock -rw-r--r-- 1 root root 36864 Sep 5 18:12 sizeStorer.wt -rw-r--r-- 1 root root 95 Sep 5 18:18 storage.bson -rw-r--r-- 1 root root 49 Sep 5 18:18 WiredTiger -rw-r--r-- 1 root root 4096 Sep 5 18:12 WiredTigerLAS.wt -rw-r--r-- 1 root root 21 Sep 5 18:18 WiredTiger.lock -rw-r--r-- 1 root root 996 Sep 5 18:12 WiredTiger.turtle -rw-r--r-- 1 root root 61440 Sep 5 18:12 WiredTiger.wt |
MongoDB Users and Roles
More on securing MongoDB here and here.
Remove MongoDB
|
1 |
sudo apt-get remove --purge mongodb-org |
Remove MongoDB files
|
1 2 3 4 |
cd /mongodb_data_folder/ rm -R *.* rm -R WiredTiger rm -R journal |
Remove MongoDB
|
1 2 3 4 |
sudo rm /var/lib/mongodb/mongod.lock sudo apt-get purge mongodb mongodb-clients mongodb-server mongodb-dev sudo apt-get purge mongodb-10gen sudo apt-get autoremove |
I had these warnings with MongoDB 3.2
|
1 2 |
I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'. I CONTROL [initandlisten] ** We suggest setting it to 'never' |
I ran this fix.
Installing MongoDB on Ubuntu 16.04 guide here. More on SSL and MongoDB here.
todo: MongoDB Startup at reboot troubleshooting steps.
Good luck.
Donate and make this blog better
Ask a question or recommend an article
v1.5 MongoDB troubleshooting
