Skip to content

Instantly share code, notes, and snippets.

@soulmachine

soulmachine/mongodb.md

Last active February 12, 2020 00:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save soulmachine/c151896798604ebe4c7ddacef42f86d5 to your computer and use it in GitHub Desktop.
Save soulmachine/c151896798604ebe4c7ddacef42f86d5 to your computer and use it in GitHub Desktop.
Download ZIP
MongoDB
Raw
mongodb.md

Install MongoDB on Debian 10:

sudo apt-get install gnupg
wget -qO - https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -

echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.2 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.2.list


sudo apt-get update
sudo apt-get install -y mongodb-org

sudo systemctl enable mongod
sudo systemctl start mongod
sudo systemctl status mongod

Security

Edit /etc/mongod.conf and change bindIp to 0.0.0.0(during development), after production, set it to a private IP address such as 192.168.5.1.

Adding an Administrative User

Enter the Mongo shell:

$ mongo

Use the following JavaScript code to create an user:

use admin;

db.createUser(
  {
    user: "programmer",
    pwd: "programmer123",
    roles: [ { role: "root", db: "admin" } ]
  }
)

Enable Authentication

Edit /etc/mongod.conf and add

security:
  authorization: "enabled"

Restart the server sudo systemctl restart mongod.

Verifying the Administrative User’s Access

mongo -u programmer -p

show dbs;

IP address whilelist

sudo ufw enable
sudo ufw status

sudo ufw allow from client_ip_address to any port 22
sudo ufw allow proto tcp from client_ip_address to any port 27017

The overall /etc/mongod.conf

# Where and how to store data.
storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true
  engine: wiredTiger
#  mmapv1:
#  wiredTiger:

# where to write logging data.
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
net:
  port: 27017
  bindIp: 0.0.0.0

security:
  authorization: "enabled"

# how the process runs
processManagement:
  timeZoneInfo: /usr/share/zoneinfo

Configure for production

For WiredTiger

Disable atime for filesystem

Increase ulimit:

Added the following four lines to /etc/security/limits.conf:

*    soft    nofile    65536
*    hard    nofile    65536
*    soft    nproc    65536
*    hard    nproc    65536

Configuring NUMA on Linux

sysctl -w vm.zone_reclaim_mode=0 ps --no-headers -o comm 1

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment