Here is how you can install MongoDB 3.4.x on Ubuntu 16.04 and secure it. I use the Studio 3T software form Studio 3T.
Advertisement:
Before you install MongoDB ensure you have secured your server and installed it and installed an SSL certificate. Click the links here to set up a Digital Ocean, Vultr or AWS Server. Read my old guide to installing MongoDB on Ubuntu 14.04 and using Studio 3T ( https://studio3t.com/ ).
Install MongoDB 3.6
Official guide here
Add the keyserver
1 2 3 4 5 6 7 8 9 | sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2930ADAE8CAF5059EE73BB4B58712A2291FA4AD5 Executing: /tmp/tmp.T7UNroLh1A/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv 2930ADAE8CAF5059EE73BB4B58712A2291FA4AD5 gpg: requesting key 91FA4AD5 from hkp server keyserver.ubuntu.com gpg: key 91FA4AD5: public key "MongoDB 3.6 Release Signing Key <packaging@mongodb.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) |
1 2 | echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.6 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.6.list deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.6 multiverse |
Update
1 | sudo apt-get update |
Install the latest stable version of MongoDB
1 | sudo apt-get install -y mongodb-org |
MongoDB.conf options
FYI: Secure MongoDB: https://docs.mongodb.com/manual/security/ and Security Checklist https://docs.mongodb.com/manual/administration/security-checklist/
MongoDB Hardening Info: https://docs.mongodb.com/manual/core/security-hardening/
Start Mongodb
1 | sudo mongod --port 27017 --dbpath /mongodb_data/ --bind_ip 127.0.0.1 --config /etc/mongod.conf |
You should see startup activity
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | sudo mongod --port 27017 --dbpath /mongodb_data/ 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] MongoDB starting : pid=10413 port=27017 dbpath=/mongodb_data/ 64-bit host=ypurservername 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] db version v3.6.2 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] git version: 489d177dbd0f0420a8ca04d39fd78d0a2c539420 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] OpenSSL version: OpenSSL 1.0.2g 1 Mar 2016 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] allocator: tcmalloc 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] modules: none 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] build environment: 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] distmod: ubuntu1604 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] distarch: x86_64 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] target_arch: x86_64 2018-01-16T22:46:22.924+1100 I CONTROL [initandlisten] options: { net: { port: 27017 }, storage: { dbPath: "/mongodb_data/" } } 2018-01-16T22:46:22.925+1100 I STORAGE [initandlisten] 2018-01-16T22:46:22.925+1100 I STORAGE [initandlisten] wiredtiger_open config: create,cache_size=1463M,session_max=20000,eviction=(threads_min=4,threads_max=4),config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),statistics_log=(wait=0),verbose=(recovery_progress), 2018-01-16T22:46:23.012+1100 I CONTROL [initandlisten] 2018-01-16T22:46:23.014+1100 I STORAGE [initandlisten] createCollection: admin.system.version with provided UUID: ******* 2018-01-16T22:46:23.026+1100 I COMMAND [initandlisten] setting featureCompatibilityVersion to 3.6 2018-01-16T22:46:23.033+1100 I STORAGE [initandlisten] createCollection: local.startup_log with generated UUID: d4271258-e51f-407d-af15-975f61e66eaf 2018-01-16T22:46:23.049+1100 I FTDC [initandlisten] Initializing full-time diagnostic data capture with directory '/mongodb_data/diagnostic.data' 2018-01-16T22:46:23.050+1100 I NETWORK [initandlisten] waiting for connections on port 27017 |
In a new terminal window open a MongoDB process
1 2 3 | <span class="m">mongo --port 27017 --authenticationDatabase 'admin' --username username --password password >... </span>> |
Create a user
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | > use admin switched to db admin > db.createUser( ... { ... user: "yourdbuser", ... pwd: "**************************************************************", ... roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] ... } ... ) Successfully added user: { "user" : "yourdbuser", "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ] } > |
Create a test db
1 2 3 4 5 6 7 8 | show dbs use testdb s = { Name : "Test Value" } { "Name" : "Test Value" } db.testdb.insert( s ); WriteResult({ "nInserted" : 1 }) db.testdb.find() { "_id" : ObjectId("5a5deba7b563981038f32051"), "Name" : "Test Value" } |
Run MongoDB at Startup
Note: I tried setting up a service but it failed so I added the following command to /etc/rc.local
1 | /usr/bin/mongod --quiet --port 27017 --dbpath /mongodb_data/ --bind_ip 127.0.0.1,##.##.##.## --config /etc/mongod.conf |
Todo: Service Setup.
Ignore the follwoing….
Create a service
1 | sudo nano /etc/systemd/system/mongodb.service |
I added
1 2 3 4 5 6 7 8 9 10 | [Unit] Description=High-performance, schema-free document-oriented database After=network.target [Service] User=mongodb ExecStart=/usr/bin/mongod --quiet --port 27017 --dbpath /mongodb_data/ --bind_ip 127.0.0.1,##.##.##.## --config /etc/mongod.conf [Install] WantedBy=multi-user.target |
TIP: Bing to local 127.0.0.1 and also your external IP (if you have hardened and setup IP whitelists for the port).
Make /etc/init.d/mongod executable
1 | sudo chmod +x /etc/init.d/mongod |
Firewall
Configure your firewall (tip: whitelist your local development IP to allow your IP access etc)
1 2 3 4 5 6 7 8 9 | sudo ufw allow from 123.123.123.12/32 to any port 27017 Rule added sudo ufw reload Firewall reloaded sudo ufw allow out 27017 Rule added Rule added (v6) |
Reload the firewall and show the status. Add port 27017 (or your custom port) to your TCP and UDP firewall. http://icanhazip.com/ will display your public IP.
1 2 3 4 5 6 7 8 9 10 11 | sudo ufw reload sudo ufw status Status: active To Action From -- ------ ---- ... 27017 ALLOW 123.123.123.123 ... 27017 ALLOW OUT Anywhere ... |
Display the MongoDB version
1 2 3 4 5 6 7 8 9 10 | mongod -version db version v3.6.2 git version: 489d177dbd0f0420a8ca04d39fd78d0a2c539420 OpenSSL version: OpenSSL 1.0.2g 1 Mar 2016 allocator: tcmalloc modules: none build environment: distmod: ubuntu1604 distarch: x86_64 target_arch: x86_64 |
Make MongoDB configuration changes
1 | sudo nano /etc/mongod.conf |
– Consider saving your database data somewhere else (mongodb.conf)
1 2 | storage: dbPath: /folder_to_store_mongodb_data/ |
– Consider redirecting your log file (mongodb.conf)
1 2 3 4 | systemLog: destination: file logAppend: true path: "/folder_to_store_mongodb_logs/mongo.log" |
– Consider changing the default MongoDB port (mongodb.conf)
1 2 | net: port: 27123 |
– Allow MongoDB to talk locally and globally if need be and optionally enable IPV6 (binding IP’s in mongodb.conf)
TIP: Ensure you bind you localhost port (127.0.0.1) AND your public IP (e.g 123.123.123.123) as you will need to bind to public IP too if you want to connect to MongoDB externally. I did not bing my eternal IP and was blocked for a few days.
1 2 3 | net: ipv6: true bindIp: 127.0.0.1,123.123.123.123 |
If you allow external access then consider whitelisting your IP and disabling local admin login – more here (mongodb.conf)
1 2 | setParameter: enableLocalhostAuthBypass: false |
Official configuration documentation can be found here.
At this stage, MongoDB is open to the world and if you connect to your server with no username or password you will see it is open.
I created an admin user with Studio 3T for MongoDB in the IntelliShell.
I typed the following to create a user (I added a root role after creating the screenshot above).
1 2 | use admin db.createUser({user: "yourusername", pwd: "yourpassword", roles:[{role: "userAdminAnyDatabase", db: "admin"},{role: "root", db: "admin"}]}) |
Verify that the user was created
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | show users { "_id" : "admin.yourusername", "user" : "yourusername", "db" : "admin", "roles" : [ { "role" : "root", "db" : "admin" }, { "role" : "userAdminAnyDatabase", "db" : "admin" } ] } |
Now you can use these credentials to log in to the database.
You can see the new credentials are working and now we need to remove anonymous and empty connections.
Add the following to mongodb.conf
1 2 | security: authorization: enabled |
Restart MongoDB
1 2 | sudo systemctl stop mongodb sudo systemctl start mongodb |
or
1 | /usr/bin/mongod --config /etc/mongod.conf |
Now when you connect to your database with no login details you will see no databases.
Show the status of MongoDB
1 2 3 4 5 6 7 8 9 10 11 | sudo systemctl start mongodb user@server:~# sudo systemctl status mongodb ● mongodb.service - High-performance, schema-free document-oriented database Loaded: loaded (/etc/systemd/system/mongodb.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2017-08-18 18:00:38 AEST; 4 days ago Main PID: 6946 (mongod) Tasks: 19 Memory: 76.3M CPU: 57min 16.367s CGroup: /system.slice/mongodb.service └─6946 /usr/bin/mongod --quiet --config /etc/mongod.conf |
View the last 20 lines of the MongoDB log file.
1 | tail -n 20 /var/log/mongodb/mongod.log |
(or replace the path with your log location)
1 | tail -n 20 /yourmongodb_logs/mongod.log |
Viewing MongoDB files
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | ls -al total 384 drwxr-xr-x 4 root root 4096 Sep 5 18:12 . drwxr-xr-x 30 root root 4096 Aug 5 18:48 .. -rw-r--r-- 1 root root 32768 Sep 5 18:12 collection-0--5805649544981213952.wt -rw-r--r-- 1 root root 36864 Sep 5 18:12 collection-0-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:12 collection-2-6117837641988028070.wt drwxr-xr-x 2 root root 4096 Sep 5 18:12 diagnostic.data -rw-r--r-- 1 root root 16384 Sep 5 18:47 index-1--5805649544981213952.wt -rw-r--r-- 1 root root 36864 Sep 5 18:12 index-1-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:12 index-3-6117837641988028070.wt -rw-r--r-- 1 root root 32768 Sep 5 18:47 index-4-6117837641988028070.wt drwxr-xr-x 2 root root 4096 Sep 5 18:03 journal -rw-r--r-- 1 root root 32768 Sep 5 18:12 _mdb_catalog.wt -rw-r--r-- 1 root root 0 Sep 5 18:12 mongod.lock -rw-r--r-- 1 root root 36864 Sep 5 18:12 sizeStorer.wt -rw-r--r-- 1 root root 95 Sep 5 18:18 storage.bson -rw-r--r-- 1 root root 49 Sep 5 18:18 WiredTiger -rw-r--r-- 1 root root 4096 Sep 5 18:12 WiredTigerLAS.wt -rw-r--r-- 1 root root 21 Sep 5 18:18 WiredTiger.lock -rw-r--r-- 1 root root 996 Sep 5 18:12 WiredTiger.turtle -rw-r--r-- 1 root root 61440 Sep 5 18:12 WiredTiger.wt |
MongoDB Users and Roles
More on securing MongoDB here and here.
Remove MongoDB
1 | sudo apt-get remove --purge mongodb-org |
Remove MongoDB files
1 2 3 4 | cd /mongodb_data_folder/ rm -R *.* rm -R WiredTiger rm -R journal |
Remove MongoDB
1 2 3 4 | sudo rm /var/lib/mongodb/mongod.lock sudo apt-get purge mongodb mongodb-clients mongodb-server mongodb-dev sudo apt-get purge mongodb-10gen sudo apt-get autoremove |
I had these warnings with MongoDB 3.2
1 2 | I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'. I CONTROL [initandlisten] ** We suggest setting it to 'never' |
I ran this fix.
Installing MongoDB on Ubuntu 16.04 guide here. More on SSL and MongoDB here.
todo: MongoDB Startup at reboot troubleshooting steps.
Good luck.
Donate and make this blog better
Ask a question or recommend an article
v1.6 Added MongoDB 3.6 install info and strat at startup
v1.5 MongoDB troubleshooting