MongoDB is a document-oriented NoSQL database that stores records as BSON (binary JSON) documents with flexible schemas and rich indexing. This guide covers installing MongoDB 3.2 on Ubuntu 14.04 LTS (Trusty), importing a sample JSON dataset using mongoimport, enabling Role-Based Access Control (RBAC) authentication, and resolving a common MONGODB-CR vs. SCRAM-SHA-1 authentication error when monitoring MongoDB 3.x with older Nagios plugins.
Support Warning: Ubuntu 14.04 LTS and MongoDB 3.2 have both reached End of Life. On modern Ubuntu LTS systems with MongoDB 6.0/7.0+, use
mongoshinstead of the legacymongoshell andSCRAM-SHA-256authentication.
Step 1: Configure the Official MongoDB APT Repository
1. Import the MongoDB GPG Signing Key
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv EA312927
Example output:
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.ApILz9KbVd --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv EA312927
gpg: requesting key EA312927 from hkp server keyserver.ubuntu.com
gpg: key EA312927: public key "MongoDB 3.2 Release Signing Key <packaging@mongodb.com>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
2. Add the Repository Source List and Install mongodb-org
echo "deb http://repo.mongodb.org/apt/ubuntu trusty/mongodb-org/3.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.2.list
sudo apt-get update
sudo apt-get install -y mongodb-org
Step 2: Start mongod and Verify Service Status
Start the mongod service:
sudo service mongod start
Inspect /var/log/mongodb/mongod.log to confirm mongod is listening on port 27017 (the default configured in /etc/mongod.conf):
sudo tail -n 20 /var/log/mongodb/mongod.log
2016-09-14T17:44:54.437-0700 I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2016-09-14T17:44:54.437-0700 I CONTROL [initandlisten] ** We suggest setting it to 'never'
2016-09-14T17:44:54.437-0700 I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/defrag is 'always'.
2016-09-14T17:44:54.437-0700 I CONTROL [initandlisten] ** We suggest setting it to 'never'
2016-09-14T17:44:54.439-0700 I FTDC [initandlisten] Initializing full-time diagnostic data capture with directory '/var/lib/mongodb/diagnostic.data'
2016-09-14T17:44:54.533-0700 I NETWORK [initandlisten] waiting for connections on port 27017
(Tip: For production workloads, disable Linux Transparent Huge Pages (never) as recommended in the startup log warning to prevent memory allocation latency spikes.)
Step 3: Import a Sample Dataset with mongoimport
Download the sample companies.zip dataset and extract companies.json:
wget https://github.com/ahmedzbyr/big_data_learning/raw/master/bigData/mongodb/dataset/companies.zip
unzip companies.zip
Import companies.json into the company database and companies collection using mongoimport (which connects to localhost:27017 by default; pass --host and --port when targeting a remote instance):
mongoimport --db company --collection companies --file companies.json
2016-09-14T17:54:34.032-0700 connected to: localhost
2016-09-14T17:54:37.025-0700 [#########...............] company.companies 30.0MB/74.6MB (40.3%)
2016-09-14T17:54:40.033-0700 [###################.....] company.companies 61.8MB/74.6MB (82.8%)
2016-09-14T17:54:41.274-0700 [########################] company.companies 74.6MB/74.6MB (100.0%)
2016-09-14T17:54:41.274-0700 imported 18801 documents
Step 4: Configure Authentication and Role-Based Access Control
By default, MongoDB binds to 127.0.0.1 without access control enabled. Always create an administrative user and enable security.authorization before exposing MongoDB on a network interface.
1. Create the User Administrator in the admin Database
Open the mongo shell and create a mongoadmin user with the userAdminAnyDatabase role:
use admin
db.createUser(
{
user: "mongoadmin",
pwd: "REPLACE_WITH_STRONG_PASSWORD",
roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
}
)
2. Enable Access Control in /etc/mongod.conf
Edit /etc/mongod.conf to enable security.authorization (or start mongod with --auth):
security:
authorization: enabled
Restart mongod:
sudo service mongod restart
3. Authenticate and Create Application-Specific Users
Connect as mongoadmin against the admin authentication database:
mongo --port 27017 -u "mongoadmin" -p --authenticationDatabase "admin"
Create a scoped application user (ahmed) with readWrite access to company and read access to test:
use company
db.createUser(
{
user: "ahmed",
pwd: "REPLACE_WITH_APP_PASSWORD",
roles: [
{ role: "readWrite", db: "company" },
{ role: "read", db: "test" }
]
}
)
Test connecting as ahmed and inserting a document:
mongo --port 27017 -u "ahmed" -p --authenticationDatabase "company"
use company
db.authtesting.insert({ x: 1, y: 1 })
// WriteResult({ "nInserted" : 1 })
db.authtesting.findOne()
// { "_id" : ObjectId("57d9f85a3d1dcdf58c16cab3"), "x" : 1, "y" : 1 }
Troubleshooting: Nagios check_mongodb.py Authentication Error (MONGODB-CR vs. SCRAM-SHA-1)
When monitoring a MongoDB 3.0+ server from Nagios using an older check_mongodb.py plugin and an outdated pymongo driver (< 2.8), the check may fail with:
[ahmed@localhost libexec]$ ./check_mongodb_2.py -H 192.168.94.138 -P 27017 -u admin -p REPLACE_PASSWORD -A databases -W 5 -C 10
CRITICAL - General MongoDB Error: command SON([('authenticate', 1), ('user', u'admin'), ('nonce', u'42110dc29ee7fe6b'), ('key', u'827a2b0e4af97e88560800ab86b04e57')]) failed: auth failed
And /var/log/mongodb/mongod.log on the MongoDB server reports:
Failed to authenticate admin@admin with mechanism MONGODB-CR: AuthenticationFailed: MONGODB-CR credentials missing in the user document
Root Cause & Resolution
Starting in MongoDB 3.0, the default authentication mechanism changed from MONGODB-CR (authSchema version 3) to SCRAM-SHA-1 (authSchema version 5).
- Recommended Fix: Upgrade
pymongoon the Nagios server (pip install --upgrade pymongo) socheck_mongodb.pysupportsSCRAM-SHA-1natively without downgrading database security. - Legacy Workaround (Lab/Test Environments Only): If the monitoring client cannot be upgraded on a legacy test box, downgrading
admin.system.version(authSchema.currentVersion) from5to3and recreating the user forces MongoDB 3.2 to storeMONGODB-CRcredentials (do not runremove({})on production user tables):use admin var schema = db.system.version.findOne({ "_id" : "authSchema" }) schema.currentVersion = 3 db.system.version.save(schema)(Note:
MONGODB-CRwas completely removed in MongoDB 4.0+.)