Closed from my mongodb instance

Question

I created two users that I thought were userAdmins. Unfortunately, when I log in with them, I get permission for everything. If I can log in without a username or password, I get permission for everything. What can I do?

Users were created using the following commands

use admin

db.createUser(
    {
      user: "Nikhil",
      pwd: "wouldntyouliketoknow",
      roles: ["userAdminAnyDatabase" ]
    }
)

Doesn't userAdminAnyDatabasewhat I think it means?

Answer 1

I use the fact that you have authorization protection turned on for this. Why don't you just turn off the security.authorization function and restart mongod?

http://docs.mongodb.org/manual/reference/configuration-options/

, , , :

use admin

db.createUser(
  {
    user: "Nikhil",
    pwd: "wouldntyouliketoknow",
    roles: 
      [
        {
          role: "userAdminAnyDatabase",
          db: "admin"
        }
      ]
  }
)

, db .

: http://docs.mongodb.org/manual/tutorial/enable-authentication/

userAdmin . , , , :

userAdminAnyDatabase

Provides the same access to user administration operations as userAdmin, except it applies to all databases in the cluster. The role also provides the following actions on the cluster as a whole:

authSchemaUpgrade
invalidateUserCache
listDatabases

The role also provides the following actions on the admin.system.users and admin.system.roles collections on the admin database, and on legacy system.users collections from versions of MongoDB prior to 2.6:

collStats
dbHash
dbStats
find
killCursors
planCacheRead

The userAdminAnyDatabase role does not restrict the permissions that a user can grant. As a result, userAdminAnyDatabase users can grant themselves privileges in excess of their current privileges and even can grant themselves all privileges, even though the role does not explicitly authorize privileges beyond user administration. This role is effectively a MongoDB system superuser.

http://docs.mongodb.org/manual/reference/built-in-roles/#built-in-roles

Answer 2

MongoD auth, .

, MongoD. http://docs.mongodb.org/manual/core/authentication/#localhost-exception

, MongoDB, , -.