--- title: "How to Take Control of Your MongoDB Security" description: "Learn how to take control of your MongoDB security by creating an administrative user and enabling authentication in this step-by-step tutorial!" canonical: "https://adamtheautomator.com/mongodb-security/" --- # How to Take Control of Your MongoDB Security > Learn how to take control of your MongoDB security by creating an administrative user and enabling authentication in this step-by-step tutorial! Source: https://adamtheautomator.com/mongodb-security/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Take Control of Your MongoDB Security](https://adamtheautomator.com/wp-content/uploads/2022/01/How-to-Take-Control-of-Your-MongoDB-Security.jpg) # How to Take Control of Your MongoDB Security [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)27 January 20225 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Linux](/tag/linux/)[MongoDB](/tag/mongodb/)[Security](/tag/security/) Table of Contents * [Prerequisites](#prerequisites) * [Creating a Dedicated Administrative User](#creating-a-dedicated-administrative-user) * [Adding Security by Enabling Authentication](#adding-security-by-enabling-authentication) * [Testing if Authentication Works](#testing-if-authentication-works) * [Conclusion](#conclusion) Hackers are becoming more sophisticated, and they know how to exploit vulnerabilities. If you have sensitive data in your MongoDB database, it’s crucial to take security seriously. But how? Worry not! This tutorial has got you covered! In this tutorial, you’ll learn to protect your MongoDB databases and ward off hackers by setting up security measures. Read on and start taking control of your MongoDB security! ## Prerequisites * This tutorial will be a hands-on demonstration. To follow along, be sure you have the following: Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) * [MongoDB installed](https://docs.mongodb.com/manual/tutorial/install-mongodb-on-ubuntu/) on your Linux machine. Related:[How to Deploy and Manage a Docker MongoDB Container](https://adamtheautomator.com/docker-mongodb/) * A non-root user with [`sudo`](https://www.liquidweb.com/kb/how-to-set-up-and-manage-sudo-permissions) privileges. ## Creating a Dedicated Administrative User MongoDB does not have any built-in authentication system. By default, anyone with access to the database has full administrative privileges — too dangerous! How to secure your database? You’ll create a user with administrative privileges and lock down the databases to that administrative user. This setup allows you to provide a single point of user access with administrative privileges while restricting what each user can do within the database. For example, developers should have read-only access to databases, while administrators can create and edit data. 1\. Open your terminal and run the [`mongo`](https://docs.mongodb.com/manual/reference/mongo-shell/) command below without any arguments. This command lets you connect to your MongoDB shell as the default admin user. > _This admin user is powerful as it has full read/write access to all databases on the server, and it’s best to avoid using this user for day-to-day work._ ```bash mongo ``` You will get a warning that says **Access control is not enabled**…., as shown below. This warning indicates that anyone who can access the MongoDB server can perform the actions they want with the databases. These actions include but are not limited to deleting, dropping, updating databases. > _This warning shows up is because you haven’t enabled access control yet. Don’t worry about it, for now. You’ll learn how to enable access control in the following section._ ![Connecting to your MongoDB shell](https://adamtheautomator.com/wp-content/uploads/2022/01/image-344.png) Connecting to your MongoDB shell 2\. Next, run the [`show dbs`](https://tecadmin.net/tutorial/mongodb-show-databases) command to show all databases on the server, including the **admin** databases that a normal user isn’t supposed to see. ```bash show dbs ``` ![Showing all databases on the server](https://adamtheautomator.com/wp-content/uploads/2022/01/image-345.png) Showing all databases on the server 3\. Run the `use admin` command below to switch to the admin database since your focus is on creating a dedicated administrative user. This command changes your current database context to use the admin database, as shown below. MongoDB uses the admin database to store access control rules and provide built-in authentication, usernames, and password for users and their roles. You can’t delete or rename the admin database because it’s essential to the database’s functionality. ```bash use admin ``` ![Switching to the admin database](https://adamtheautomator.com/wp-content/uploads/2022/01/image-346.png) Switching to the admin database 4\. Now, copy and paste the code below to the mongo shell and hit Enter. This code creates a user called `AdminATA`, with a password of `LDWbPf6Fy9Ezs3Mv`, but you can use different credentials as you prefer. This new user has read/write (`readWriteAnyDatabase`) access to all databases and admin access to all collections. But this user has no drop/delete database privileges and can’t drop or change privileges of other users. After running the command and you get an error, recheck your code and try again. ```bash # The db.createUser() method creates a new user on the current database, with the privileges specified by roles. db.createUser( { # Specifying the username AdminATA, but you can enter whatever username you like user: "AdminATA", # The passwordPrompt() method is a universal helper function # that tells the MongoDB shell to prompt you for a password for the AdminATA user. pwd: passwordPrompt(), # Specifying the roles you want your AdminATA user to have. roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ] } ) ``` 5\. Provide a secure password when prompted, as shown below, and press Enter. ![Providing a secure password ](https://adamtheautomator.com/wp-content/uploads/2022/01/image-347.png) Providing a secure password Below, you can see a **Successfully added user** message. This output confirms that you successfully created a user with administrative privileges and restricted them to the least privileges required. At this point, you already have an administrative user called AdminATA that can do everything you need on the database without giving access to everyone. ![Verifying Successful Admin User Creation in MongoDB](https://adamtheautomator.com/wp-content/uploads/2022/01/image-348.png) Verifying Successful Admin User Creation in MongoDB 6\. Finally, run the exit command to leave the mongo shell. ```bash exit ``` ![Leaving the mongo shell](https://adamtheautomator.com/wp-content/uploads/2022/01/image-349.png) Leaving the mongo shell ## Adding Security by Enabling Authentication Now that you have an administrative user, you’ll add another layer of security by enabling authentication. Doing so gives database access to users with the correct credentials only. Authentication refers to the process of validating a connection, typically by providing a username and password or using an authentication token. Authentication ensures that you are who you say you are and not an imposter trying to access resources. 1\. Enable authentication by editing the MongoDB configuration file with the following, and save the changes: * Open the _/etc/mongod.conf_ file in your favorite text editor. The _/etc/mongod.conf_ file contains [configuration](https://docs.mongodb.com/manual/reference/configuration-options/) of your MongoDB cluster. * Look for and uncomment the **#security** directive by removing the **#** symbol in front of the directive, as shown below. This directive tells MongoDB to look for the security setting in the configuration file. * Add a new line below the **security** directive that says **authorization: enabled**. Note that the **authorization: enabled** line is indented (has two spaces at the beginning), as shown below. ![Adding the authorization parameter](https://adamtheautomator.com/wp-content/uploads/2022/01/image-352.png) Adding the authorization parameter 2\. Next, run the following `systemctl` command to restart the MongoDB server for the changes to take effect. ```bash sudo systemctl restart mongod ``` Related:[Controlling Systemd services with Ubuntu systemctl](https://adamtheautomator.com/ubuntu-systemctl/) 3\. Finally, run the below command to view the status of your MongoDB service. ```bash sudo systemctl status mongod ``` Below, you can see a line that says **Active: active (running)** in green text, which indicates your MongoDB server is running and ready to accept connections. ![Viewing MongoDB Service Status](https://adamtheautomator.com/wp-content/uploads/2022/01/image-353.png) Viewing MongoDB Service Status ## Testing if Authentication Works You’ve just enabled authentication, but how do you know it works? You’ll log in to the administrative user to test and ensure your authentication works by viewing databases. 1\. Run the following commands to access the `mongo` shell as you did in the “Creating a Dedicated Administrative User” section (step one). ```bash mongo ``` As you can see below, you no longer receive the **Access control is not enabled…** warning about enabling authentication. Instead, you’ll get a message that tells you the version of your MongoDB server and MongoDB shell. ![Connecting to the MongoDB Shell](https://adamtheautomator.com/wp-content/uploads/2022/01/image-354.png) Connecting to the MongoDB Shell 2\. Next, rerun the `show dbs` command to check if you can still access the database. ```bash show dbs ``` The command should show you all databases, even the admin database. But as you see below, nothing shows up. Why? Viewing the list of databases is a privilege reserved for administrative users only. You haven’t authenticated your mongo shell to use the Admin role, so you’re not authorized to view the list of databases. ![Listing All Databases (empty)](https://adamtheautomator.com/wp-content/uploads/2022/01/showdbs-empty.png) Listing All Databases (empty) With authentication enabled, the connection will fail if someone tries to access the database using a connection string that doesn’t contain the correct credentials. > _Authenticating connection strings is a core part of MongoDB security, and you should implement authentication at all layers of the application. All connections to MongoDB must use an authentication string consisting of credentials. These credentials include the correct username and password._ 3\. Run the `exit` command to exit from the MongoDB shell. ```bash exit ``` 4\. Now, run the command below to log in to the MongoDB shell with your newly-created administrative user’s username (`-u`) and password (`-p`). Replace `AdminATA` with the username you created in the “Creating a Dedicated Administrative User” section (step four). The `--authenticationDatabase` parameter tells the MongoDB shell to authenticate against the `admin` database. ```bash mongo -u AdminATA -p --authenticationDatabase admin ``` 5\. Provide your password for your administrative user when prompted. ![](https://adamtheautomator.com/wp-content/uploads/2022/01/image-355.png) Providing administrative password ![logging into the MongoDB shell as an administrator](https://adamtheautomator.com/wp-content/uploads/2022/01/image-356.png) logging into the MongoDB shell as an administrator 6\. Finally, rerun the `show dbs` command to try and see if you can view all databases. ```bash show dbs ``` This time, as you see below, the list of databases shows up since you’re an admin user. ![Listing all databases as admin user](https://adamtheautomator.com/wp-content/uploads/2022/01/image-357.png) Listing all databases as admin user ## Conclusion In this tutorial, you learned how to connect to create an administrative user and enable authentication. You’ve learned to take control of your MongoDB security and put restrictions on who can access databases on your server. At this point, you get to decide whether who can access what. So what’s next for you? Perhaps learn [how to use a MongoDB container securely](https://adamtheautomator.com/docker-mongodb/)? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fmongodb-security%2F&text=How%20to%20Take%20Control%20of%20Your%20MongoDB%20Security)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fmongodb-security%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fmongodb-security%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/02/Learn-How-to-Proxy-Applications-With-Envoy-Proxy-Server.jpg) ### [Learn How to Proxy Applications With Envoy Proxy Server](/envoy-proxy/) Learn how to set up Envoy Proxy Server to proxy applications for increased privacy in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-to-Provision-a-Website-With-aaPanel-and-LetsEncrypt.jpg) ### [How to Provision a Website With aaPanel and LetsEncrypt](/aapanel/) Learn how to install aaPanel, provision a website, and secure the website with SSL using Let’s Encrypt in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-To-Set-Up-WireGuard-VPN-on-Linux.jpg) ### [How To Set Up WireGuard VPN on Linux](/wireguard-vpn/) Learn how to set up WireGuard VPN on Linux to securely connect and access your network, in this step-by-step tutorial! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)