linux上安装MongoDB副本集(带keyfile安全认证以及用户权限)

搭建前准备

MongoDB版本:4.0

主要参考搭建MongoDB副本集网站:https://www.jianshu.com/p/f021f1f3c60b

安装之前最好先确定一下几点:

    • 防火墙关闭
    • MongoDB的端口号对需要访问你的服务器开放

相关linux命令可参考博客https://www.cnblogs.com/yanduanduan/p/6396631.html

在安装的过程中,可以说遇到问题多多,下面就介绍一下问题情况,以及解决方法:

问题一(连接被拒绝):

{
    "operationTime" : Timestamp(0, 0),
    "ok" : 0,
    "errmsg" : "replSetInitiate quorum check failed because not all proposed set members responded affirmatively: 10.xx.xx.xx:27018 failed with Error connecting to 10.xx.xx.xx:27018 :: caused by :: Connection refused, 10.xx.xx.xx:27018 failed with Error connecting to 10.xx.xx.xx:27018 :: caused by :: Connection refused",
    "code" : 74,
    "codeName" : "NodeNotFound",
    "$clusterTime" : {
        "clusterTime" : Timestamp(0, 0),
        "signature" : {
            "hash" : BinData(0,"AAAAAAAAAAAAAAAAAAAAAAAAAAA="),
            "keyId" : NumberLong(0)
        }
    }
}

原因:

没有指定本机IP,默认是127.0.0.1;

解决方法:

在mongo.conf配置文件中,加上bind_ip=本机IP即可;

问题二(文件权限过大):

permissions on /root/mongodb/keyfile are too open

原因:

我指定的keyFile=/root/mongodb/keyfile/keyfile路径少写了文件“keyfile”,仅指定到文件夹“keyfile”,所以不管我怎么减少权限,都不行。

 解决方法:

补全keyfile文件的路径

keyFile=/root/mongodb/keyfile/keyfile

问题三(查看成员状态失败):

replSet:PRIMARY> rs.status()
{
    "operationTime" : Timestamp(1553750837, 1),
    "ok" : 0,
    "errmsg" : "not authorized on admin to execute command { replSetGetStatus: 1.0, lsid: { id: UUID("49593e29-481a-4765-a7ad-2b1ca5a8fbcf") }, $clusterTime: { clusterTime: Timestamp(1553750837, 1), signature: { hash: BinData(0, BAD749F5F3799A6EDEB97259390BD616FF6A9F5D), keyId: 6673011308209635329 } }, $db: "admin" }",
    "code" : 13,
    "codeName" : "Unauthorized",
    "$clusterTime" : {
        "clusterTime" : Timestamp(1553750837, 1),
        "signature" : {
            "hash" : BinData(0,"utdJ9fN5mm7euXJZOQvWFv9qn10="),
            "keyId" : NumberLong("6673011308209635329")
        }
    }
}

原因:

由于开启了权限验证,即“auth=true”,所以查看状态之前,需要先认证。

解决方法:

replSet:PRIMARY> use admin
switched to db admin
replSet:PRIMARY> db.auth('admin','admin')
1
replSet:PRIMARY> rs.status()

问题四(插入数据失败):

replSet:PRIMARY> db.admin.insert({"name":"zhangsan"})
WriteCommandError({
    "operationTime" : Timestamp(1553752333, 1),
    "ok" : 0,
    "errmsg" : "not authorized on admin to execute command { insert: "admin", ordered: true, lsid: { id: UUID("fa7499f8-f4be-4059-a713-0a2dd2ddbcc7") }, $clusterTime: { clusterTime: Timestamp(1553752333, 1), signature: { hash: BinData(0, 77558A08F8FF8235DF3CD87E13C2771943EBBDE0), keyId: 6673011308209635329 } }, $db: "admin" }",
    "code" : 13,
    "codeName" : "Unauthorized",
    "$clusterTime" : {
        "clusterTime" : Timestamp(1553752333, 1),
        "signature" : {
            "hash" : BinData(0,"d1WKCPj/gjXfPNh+E8J3GUPrveA="),
            "keyId" : NumberLong("6673011308209635329")
        }
    }
})

原因:

没有按照以下原则进行:

  • 数据库和用户是绑定的,光创建一个超级用户并不能操作在其他新建的数据库中插入数据
  • 在切换数据库时,先切换认证用户,不然会出现too many users are authenticated的错误。

解决方法:

  1. 输入use admin,进入admin数据库,root用户需要在admin数据库中认证。
  2. 输入db.auth('root','root')超级用户进行认证
  3. 输入db.createUser({user: "okevin",pwd: "123456",roles: [ { role: "readWrite", db: "recommended" } ]} )创建okevin用户,并为它指定数据库为recommended。
  4. 输入db.auth('okevin','123456')切换认证用户。
  5. 输入use recommended切换至recommended数据库
  6. 输入db.repo.insert({"name":"kevin"}),创建一条数据。

主要参考网址:http://www.cnblogs.com/yulinfeng/p/10226977.html

问题五(创建用户失败):

replSet:PRIMARY> db.createUser({user:"test", pwd:"test", roles:[{role: "userAdminAnyDatabase", db:"test" }]})
2019-03-28T13:56:08.968+0800 E QUERY    [js] Error: couldn't add user: No role named userAdminAnyDatabase@test :
_getErrorWithCode@src/mongo/shell/utils.js:25:13
DB.prototype.createUser@src/mongo/shell/db.js:1491:15

原因:

在db.createUser()方法中roles里面的db必须写成是admin库。

解决方法:

db的值改为admin

db.createUser({user:"test", pwd:"test", roles:[{role: "userAdminAnyDatabase", db:"admin" }]})

可参考网址:https://blog.csdn.net/jianlong727/article/details/53889990

问题六(从节点读取主节点数据失败):

019-03-28T14:43:13.643+0800 E QUERY    [js] Error: not master and slaveOk=false :
_getErrorWithCode@src/mongo/shell/utils.js:25:13
DB.prototype.getUsers@src/mongo/shell/db.js:1763:1
shellHelper.show@src/mongo/shell/utils.js:859:9
shellHelper@src/mongo/shell/utils.js:766:15
@(shellhelp2):1:1

原因:

这是正常的,默认情况下,主节点有读写权限,从节点是没有读写权限的。

解决方法:

通过命令进行设置

rs.slaveOk()

读写权限设置可参考网址:

https://blog.csdn.net/u011191463/article/details/68485529

配置完成后,Java连接池配置,可参考:

https://www.cnblogs.com/dmir/p/4780544.html

原文地址:https://www.cnblogs.com/yanduanduan/p/10616563.html