178

I am using the same connection string on local and production. When the connection string is mongodb://localhost/mydb

What is the username and password? Is it secure to keep it this way?

6 Answers 6

342

By default mongodb has no enabled access control, so there is no default user or password.

To enable access control, use either the command line option --auth or security.authorization configuration file setting.

You can use the following procedure or refer to Enabling Auth in the MongoDB docs.

Procedure

  1. Start MongoDB without access control.

     mongod --port 27017 --dbpath /data/db1
    
  2. Connect to the instance.

     mongosh --port 27017
    
  3. Create the user administrator.

     use admin
     db.createUser(
       {
         user: "myUserAdmin",
         pwd: passwordPrompt(), // or cleartext password
         roles: [ 
           { role: "userAdminAnyDatabase", db: "admin" },
           { role: "readWriteAnyDatabase", db: "admin" } 
         ]
       }
     )
    
  4. Re-start the MongoDB instance with access control.

     mongod --auth --port 27017 --dbpath /data/db1
    
  5. Authenticate as the user administrator.

     mongosh --port 27017 --authenticationDatabase "admin"\
         -u "myUserAdmin" -p 
    
6
  • 34
    If user is created with role userAdminAnyDatabase, then will be impossible to create any database. Therefore roles section should be: roles: [ { role: "root", db: "admin" } ]
    – georgeos
    Commented Apr 6, 2017 at 23:14
  • 6
    Please link the original post from MongoDB Manual
    – ntcho
    Commented Sep 1, 2017 at 12:10
  • 1
    if you want to find the dbpath use: grep dbPath /etc/mongod.conf
    – rcd
    Commented Jun 17, 2019 at 19:40
  • @georgeos I've tried that, and it is ok, can create database without any problem. as natcho mentioned, same way proposed in MongoDB manual .
    – Bheid
    Commented Jun 29, 2021 at 8:18
  • 1
    Recent versions of Mongo use mongosh as the command, not mongo, eg: mongosh --port 27017 Commented Nov 30, 2022 at 8:15
30

In addition with what @Camilo Silva already mentioned, if you want to give free access to create databases, read, write databases, etc, but you don't want to create a root role, you can change the 3rd step with the following:

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: "abc123",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" }, 
             { role: "dbAdminAnyDatabase", db: "admin" }, 
             { role: "readWriteAnyDatabase", db: "admin" } ]
  }
)

If you have already created the user, you can update the user as follows:

First log on:

mongo --port 27017 -u "myUserAdmin" -p "abc123" \
  --authenticationDatabase "admin"

The add permissions:

use admin
db.grantRolesToUser(
   "myUserAdmin",
   [ { role: "userAdminAnyDatabase", db: "admin" }, 
     { role: "dbAdminAnyDatabase", db: "admin" }, 
     { role: "readWriteAnyDatabase", db: "admin" } ]
)
2
  • To create a Replica Set, and administer a cluster, it is need to add role "clusterAdmin"
    – danilo
    Commented Oct 7, 2021 at 21:34
  • upvoting because of the --authenticationDatabase parameter. Did the trick for me. Commented May 18, 2022 at 11:07
6

For MongoDB earlier than 2.6, the command to add a root user is addUser (e.g.)

db.addUser({user:'admin',pwd:'<password>',roles:["root"]})
2
5

In addition to previously provided answers, one option is to follow the 'localhost exception' approach to create the first user if your db is already started with access control (--auth switch). In order to do that, you need to have localhost access to the server and then run:

mongo
use admin
db.createUser(
 {
     user: "user_name",
     pwd: "user_pass",
     roles: [
           { role: "userAdminAnyDatabase", db: "admin" },
           { role: "readWriteAnyDatabase", db: "admin" },
           { role: "dbAdminAnyDatabase", db: "admin" }
        ]
 })

As stated in MongoDB documentation:

The localhost exception allows you to enable access control and then create the first user in the system. With the localhost exception, after you enable access control, connect to the localhost interface and create the first user in the admin database. The first user must have privileges to create other users, such as a user with the userAdmin or userAdminAnyDatabase role. Connections using the localhost exception only have access to create the first user on the admin database.

Here is the link to that section of the docs.

1

Go to mongo in your instance

    mongo

    use admin

    db.createUser({user:"Username", pwd:"Password", roles:[{role:"root", db:"admin"}]})
1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Feb 19, 2022 at 14:10
-1
mongod --bind_ip_all --auth

use this command after modifying the .conf file:

 network interfaces
net:
  port: 27017
  bindIp: 127.0.0.1,mongodb_server_ip

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.