What if MongoDB executes db.dropAllUsers () under the admin library and does not have administrative privileges?

During the test, the db.dropAllUsers () operation is performed under the amin library, and then all the administrator users are gone, and what action is performed prompts Error: not authorized on admin to execute command...

Here's how to deal with this situation.

Let's take a look at the configuration file of the current mongo instance:

Cat / etc/mongo.cnf systemLog: destination: file logAppend: true path: / data/mongodata/log/mongo.log logRotate: rename timeStampFormat: ctime quiet: true storage: dbPath: / data/mongodata/data journal: enabled: true commitIntervalMs: 100 directoryPerDB: true syncPeriodSecs: 60 engine: wiredTiger wiredTiger: engineConfig: cacheSizeGB: 20 journalCompressor: snappy indexConfig: prefixCompression: trueprocessManagement: fork: true pidFilePath: / data/mongodata/data/mongo.pidnet: port: 27017 bindIp : 0.0.0.0 maxIncomingConnections: 3000 wireObjectCheck: true ipv6: false unixDomainSocket: enabled: false security: keyFile: / data/mongodata/data/keyfile authorization: enabledoperationProfiling: slowOpThresholdMs: 100 mode: slowOp

Attempt 1: change the profile (failed)

After searching on the Internet, I learned that the auth parameter was not specified when starting the mongod service. After seeing that the service startup script of mongod was started in the way of mongod-f / etc/mongo.cnf, I wondered if I could just disable the configuration related to configuration file authentication, so I changed authorization: enabled to authorization: disabled, and then restarted the mongod service. I found that authentication was still needed.

Attempt 2: specify parameters to start the service (successful)

If you cannot change the configuration file, you can only specify parameters to start the mongod service. When you directly execute mongod-- port 27017-- dbpath / data/mongodata/data Times error:

Detected data files in / data/mongodata/data created by the 'wiredTiger' storage engine, so setting the active storage engine to' wiredTiger'.

Then, according to the configuration file and the relevant parameter that storage engine is wiredTiger, start mongod-- port 27017-- dbpath / data/mongodata/data-- storageEngine wiredTiger-- wiredTigerCacheSizeGB 20-- wiredTigerJournalCompressor snappy again, and find that there is still an error:

Exception in initAndListen: 72 Requested option conflicts with current storage engine option for directoryPerDB; you requested false but the current server storage is already set to true and cannot be changed, terminating

Start according to the error prompt and the parameters of directoryperdb: mongod-- port 27017-- dbpath / data/mongodata/data-- storageEngine wiredTiger-- wiredTigerCacheSizeGB 20-- wiredTigerJournalCompressor snappy-- wiredTigerIndexPrefixCompression 1-- directoryperdb, and finally restart successfully. You can now authorize root users in the amdin library.

Tip:

1. The specific parameters to be taken should be adjusted according to the configuration file. If the specified parameters conflict with the original parameters of the instance, it will not work, but it does not matter. Mongodb will have detailed log output, which can be adjusted according to the prompt.

2. If the mongod service startup script is not started with a root user, it is best to switch to the corresponding account before starting, otherwise an error will be reported when starting with the script again after authorization.

!! Note: db.dropAllUsers () is a high-risk operation and should not be performed in a production environment.