mongodb4.4.22主从(副本集附仲裁节点)部署带认证模式

环境:
OS:CentOS 7
DB:4.4.22

机器角色:
192.168.1.102:29001 主
192.168.1.104:29001 从
192.168.1.105:29001 仲裁节点

 

1.下载相应的版本
https://www.mongodb.com/download-center/community
我这里下载的是mongodb-linux-x86_64-rhel70-4.4.22.tgz

 

2.创建安装目录
192.168.1.102:29001 对应的安装目录
[root@test services]# mkdir -p /usr/local/services
[root@test services]# mkdir -p /home/middle/mongodb/data
[root@test services]# mkdir -p /home/middle/mongodb/log
[root@test services]# mkdir -p /home/middle/mongodb/key
[root@test services]# mkdir -p /home/middle/mongodb/conf
[root@test services]# mkdir -p /home/middle/mongodb/run

192.168.1.104:29001 对应的安装目录
[root@test services]# mkdir -p /usr/local/services
[root@test services]# mkdir -p /home/middle/mongodb/data
[root@test services]# mkdir -p /home/middle/mongodb/log
[root@test services]# mkdir -p /home/middle/mongodb/key
[root@test services]# mkdir -p /home/middle/mongodb/conf
[root@test services]# mkdir -p /home/middle/mongodb/run

192.168.1.105:29001 仲裁节点对应的安装目录
[root@test services]# mkdir -p /usr/local/services
[root@test services]# mkdir -p /home/middle/mongodb/data
[root@test services]# mkdir -p /home/middle/mongodb/log
[root@test services]# mkdir -p /home/middle/mongodb/key
[root@test services]# mkdir -p /home/middle/mongodb/conf
[root@test services]# mkdir -p /home/middle/mongodb/run

 

3.安装数据库
192.168.1.102:29001 安装
[root@test soft]# tar -xvf mongodb-linux-x86_64-rhel70-4.4.22.tgz
[root@test soft]# mv mongodb-linux-x86_64-rhel70-4.4.22 /usr/local/services/mongodb

192.168.1.104:29001 安装
[root@test soft]# tar -xvf mongodb-linux-x86_64-rhel70-4.4.22.tgz
[root@test soft]# mv mongodb-linux-x86_64-rhel70-4.4.22 /usr/local/services/mongodb

192.168.1.105:29001 安装
[root@test soft]# tar -xvf mongodb-linux-x86_64-rhel70-4.4.22.tgz
[root@test soft]# mv mongodb-linux-x86_64-rhel70-4.4.22 /usr/local/services/mongodb

 

4.产生秘钥验证
在其中一个机器上创建秘钥文件,我这里是在192.168.1.102:29001
[root@test key]# cd /home/middle/mongodb/key
[root@test key]# openssl rand -base64 741 >>keyfile
[root@test key]# chmod 700 keyfile

加个keyfile拷贝到另外的两个节点相应的目录
scp keyfile root@192.168.1.104:/home/middle/mongodb/key/
scp keyfile root@192.168.1.105:/home/middle/mongodb/key/

 

5.生成日志文件(配置文件中指定了,提前创建)
192.168.1.101:29001
[root@test key]#echo>/home/middle/mongodb/log/mongodb.log

192.168.1.104:29001
[root@test key]#echo>/home/middle/mongodb/log/mongodb.log

192.168.1.105:29001
[root@test key]#echo>/home/middle/mongodb/log/mongodb.log

 

6.创建配置文件 mongo.cnf
vi /home/middle/mongodb/conf/mongo.cnf

port=29001
fork=true
dbpath=/home/middle/mongodb/data
logpath=/home/middle/mongodb/log/mongodb.log
pidfilepath=/home/middle/mongodb/run/29001.pid
logappend=true
shardsvr=true
replSet=myrepl
bind_ip=192.168.1.102,127.0.0.1
oplogSize=16384 ##默认单位是MB,这里给16GB
logRotate=reopen
##keyFile=/home/middle/mongodb/key/keyfile
##auth=true

 

每个节点都创建配置参数,修改相应的ip项即可
这里keyFile和auth先注释,因为等部署完初始化完集群后再启用

7.启动
主节点启动:
192.168.1.102:29001
[root@test key]# /usr/local/services/mongodb/bin/mongod -f /home/middle/mongodb/conf/mongo.cnf

从节点启动:
192.168.1.104:29001
[root@test key]# /usr/local/services/mongodb/bin/mongod -f /home/middle/mongodb/conf/mongo.cnf

仲裁节点启动:
192.168.1.105:29001
[root@test key]# /usr/local/services/mongodb/bin/mongod -f /home/middle/mongodb/conf/mongo.cnf

 

8.初始化副本集

[root@localhost bin]# /usr/local/services/mongodb/bin/mongo 192.168.1.102:29001
use admin
config={_id:'myrepl',members:[{_id:0,host:'192.168.1.102:29001'},{_id:1,host:'192.168.1.104:29001'},{_id:2,host:'192.168.1.105:29001', arbiterOnly:true}]}
rs.initiate(config)

到这里就完成了不需要带认证的副本集部署,下面的部署我们继续配置带认证的.

 

9.创建用户
在主节点上(我这里是节点1)上创建管理员账号test
[root@localhost bin]# /usr/local/services/mongodb/bin/mongo 192.168.1.102:29001
use admin
db.createUser({user:"test",pwd:"test123",roles:["root"]});     --创建用户
db.auth("test","test123");                                                      --设置用户登陆权限，密码一定要和创建用户时输入的密码相同
show users;                                                                          --查看创建的用户

 

若把其他的库(local)赋予test账号，可以执行如下命令

db.grantRolesToUser(
    "test",
    [
      { role: "dbOwner", db: "local" }
    ]
)

 

登录另外的两个节点,查看是否完成同步

[root@localhost bin]# /usr/local/services/mongodb/bin/mongo 192.168.1.104:29001
repltest:SECONDARY> use admin;
switched to db admin
myrepl:SECONDARY> rs.secondaryOk()
myrepl:SECONDARY> show users;
{
        "_id" : "admin.test",
        "userId" : UUID("3d4d001f-c12d-4571-a981-5241c4a13387"),
        "user" : "test",
        "db" : "admin",
        "roles" : [
                {
                        "role" : "root",
                        "db" : "admin"
                }
        ],
        "mechanisms" : [
                "SCRAM-SHA-1",
                "SCRAM-SHA-256"
        ]
}

 

仲裁节点不存储数据,所以不能读取数据

[root@localhost bin]# /usr/local/services/mongodb/bin/mongo 192.168.1.105:29001
repltest:ARBITER> use admin;
switched to db admin
myrepl:ARBITER> rs.secondaryOk()
myrepl:ARBITER> show users;
uncaught exception: Error: not master or secondary; cannot currently read from this replSet member :
_getErrorWithCode@src/mongo/shell/utils.js:25:13
DB.prototype.getUsers@src/mongo/shell/db.js:1659:15
shellHelper.show@src/mongo/shell/utils.js:914:9
shellHelper@src/mongo/shell/utils.js:819:15
@(shellhelp2):1:1

 

10.重启动服务
每个节点都执行
关闭顺序:仲裁节点-->从节点-->主节点
/usr/local/services/mongodb/bin/mongo localhost:29001
use admin
db.shutdownServer()

##将之前注释掉的认证去掉注释后重启动服务
keyFile=/home/middle/mongodb/key/keyfile
auth=true

启动
启动顺序:主节点-->从节点-->仲裁节点
/usr/local/services/mongodb/bin/mongod -f /home/middle/mongodb/conf/mongo.cnf

 

11.登录
登陆主库:

[root@localhost conf]# /usr/local/services/mongodb/bin/mongo 192.168.1.102:29001
MongoDB shell version v4.4.22
connecting to: mongodb://192.168.1.102:29001/test?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("7df14d81-a84f-43e1-b598-75a218bbc8aa") }
MongoDB server version: 4.4.22
myrepl:PRIMARY> use admin
switched to db admin
myrepl:PRIMARY> db.auth("test","test123");
myrepl:PRIMARY> show dbs
admin   0.000GB
config  0.000GB
local   0.000GB

 

登录从库:

[root@localhost conf]# /usr/local/services/mongodb/bin/mongo 192.168.1.104:29001
myrepl:SECONDARY> use admin
switched to db admin
myrepl:SECONDARY> db.auth("test","test123");
myrepl:SECONDARY> show dbs
myrepl:SECONDARY> rs.secondaryOk()
myrepl:SECONDARY> show dbs
admin   0.000GB
config  0.000GB
local   0.000GB

 

12.创建普通账号

登录主库

[root@localhost conf]# /usr/local/services/mongodb/bin/mongo 192.168.1.102:29001
myrepl:PRIMARY> use admin
switched to db admin
myrepl:PRIMARY> db.auth("test","test123");
myrepl:PRIMARY>use db_pushmsg
myrepl:PRIMARY>db.createUser({user:'hxl',pwd:'hxl123',roles:[{role:'dbOwner',db:'db_pushmsg'}]})