How can I enter Mongo as a superuser or reset users?

Question

I'm was playing around with permissions and locked myself out of Mongo database. I'm pretty sure I did this by trying to explicitly add access to a database but instead I overwrote only allowing permission to the database. So I'm effectively locked out of my Mongo database and everything I read tells me how to create a super user if I have the add user privilege. Right now I don't think I have any users that have that privilege. Is there a way to enter the database as all access? I own the server and have root access.

Answer 1

If you have locked yourself out then you need to do the following:

1. Stop your MongoDB instance
2. Remove the --auth and/or --keyfile options from your MongoDB config to disable authentication
3. Start the instance without authentication
4. Edit the users as needed
5. Restart the instance with authentication enabled

Answer 2

I had a similar issue when I created a user without adding a superuser first. The following steps helped solve the problem:

1. Open the MongoDB configuration file using sudo (sudo vi mongodb.conf).
   The file can be found in /etc/ folder.
2. Comment "auth = true".
3. Stop the MongoDB service (sudo service mongod stop)
4. Start the MongoDB service (sudo service mongod start)

5. Then create "root" superuser using the below command:

   use admin
   
   db.createUser({user:"admin",pwd:"password",roles:[{role:"root",db:"admin"}]});
   

   For reference https://docs.mongodb.com/manual/reference/built-in-roles/#superuser-roles

6. Go back and uncomment "auth=true". Stop and Start/Restart the mongodb service.

Answer 3

If you use a replica set with a keyfile

Security between members of the replica set using Internal Authentication

Keyfile is used for auth in replication.

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>

You can use this command to login as a admin to mongod:

mongo -u __system -p "$(tr -d '\011-\015\040' < path-to-keyfile)" --authenticationDatabase local

Afterword you are able to create or modify your admin user.

Internal Role

__system MongoDB assigns this role to user objects that represent cluster members, such as replica set members and mongos instances. The role entitles its holder to take any action against any object in the database.

Do not assign this role to user objects representing applications or human administrators, other than in exceptional circumstances.

Answer 4

Check the answers to this question, they might help

https://stackoverflow.com/questions/20117104/mongodb-root-user

Basically if you still have access to the server, you may be able to access the Admin database.

There's more in this page http://docs.mongodb.org/v2.4/reference/user-privileges/

Note that 2.6 version changes how this works completely. For 2.6 you'll need to spend more time with http://docs.mongodb.org/manual/security/

Answer 5

@Divya's answer helped but was not complete for me. Here's what I had to do:

Steps

1. Connect to the machine that was hosting my MongoDB instance
2. Open the MongoDB configuration file found in /etc/ folder using: sudo nano mongod.conf
3. Comment out the following code like so:

   # security:
   #   authorization: enabled
   

4. Stop the MongoDB service: sudo service mongod stop
5. Start the MongoDB service: sudo service mongod start
6. Connect to the database using Robo3T or equivalent. With a connection to the admin collection, create a new admin superuser:

   db.createUser({ user:"admin", pwd:"password", roles:[{role:"root", db:"admin"}] });
   

7. Go back and uncomment the lines from step 3. Then repeat steps 4 and 5.
8. You should now be able to authenticate with the new user you created in step 6 and have full access to the database.

Troubleshooting

• If for whatever reason, after trying to restart your mongo service, you cannot connect to it, you can make sure the service properly started with: systemctl --type=service --state=active. If it has started, it will be in the list as mongod.service.
• Mongo logs can also be found at /var/log/mongodb/mongodb.log but this is less likely to be helpful in this situation.

Answer 6

You have to stop Mongo, remove the admin files, then start Mongo

sudo service mongod stop
mv /data/admin.* .
sudo service mongod start