Deploy Replica Set With Keyfile Authentication使用密钥文件身份验证部署副本集

Create a keyfile.创建密钥文件。

With keyfile authentication, each mongod instances in the replica set uses the contents of the keyfile as the shared password for authenticating other members in the deployment. Only mongod instances with the correct keyfile can join the replica set.

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. 密钥的长度必须介于6到1024个字符之间，并且只能包含base64集合中的字符。All members of the replica set must share at least one common key.副本集的所有成员必须至少共享一个公用密钥。

You can generate a keyfile using any method you choose. 可以使用您选择的任何方法生成密钥文件。For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. 例如，以下操作使用openssl生成一个复杂的伪随机1024字符串，用作共享密码。It then uses chmod to change file permissions to provide read permissions for the file owner only:然后，它使用chmod更改文件权限，仅为文件所有者提供读取权限：

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用密钥文件的其他详细信息和要求，请参阅密钥文件。

Copy the keyfile to each replica set member.将密钥文件复制到每个副本集成员。

Copy the keyfile to each server hosting the replica set members. 将密钥文件复制到承载副本集成员的每个服务器。Ensure that the user running the mongod instances is the owner of the file and can access the keyfile.确保运行mongod实例的用户是文件的所有者，并且可以访问密钥文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod instances, such as a USB drive or a network attached storage device.避免将密钥文件存储在存储介质上，这些介质可以很容易地与托管mongod实例的硬件断开连接，例如USB驱动器或网络连接的存储设备。

Start each member of the replica set with access control enabled.在启用访问控制的情况下启动副本集的每个成员。

For each member in the replica set, start the mongod with either the security.keyFile configuration file setting or the --keyFile command-line option. Running mongod with the --keyFile command-line option or the security.keyFile configuration file setting enforces both Internal/Membership Authentication and Role-Based Access Control.

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>
net:
   bindIp: localhost,<hostname(s)|ip address(es)>

Start the mongod using the configuration file:

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

mongod --keyFile <path-to-keyfile> --replSet <replicaSetName> --bind_ip localhost,<hostname(s)|ip address(es)>

Connect to a member of the replica set over the localhost interface.

Connect mongosh to one of the mongod instances over the localhost interface. You must run mongosh on the same physical machine as the mongod instance.

The localhost interface is only available since no users have been created for the deployment. The localhost interface closes after the creation of the first user.

Initiate the replica set.

From mongosh, run the rs.initiate() method.

rs.initiate() can take an optional replica set configuration document. In the replica set configuration document, include:

• The _id field set to the replica set name specified in either the replication.replSetName or the --replSet option.
• The members array with a document per each member of the replica set.

The following example initates a three member replica set.

rs.initiate(
  {
    _id : "myReplSet",
    members: [
      { _id : 0, host : "mongo1.example.net:27017" },
      { _id : 1, host : "mongo2.example.net:27017" },
      { _id : 2, host : "mongo3.example.net:27017" }
    ]
  }
)

rs.initiate() triggers an election and elects one of the members to be the primary.

Connect to the primary before continuing. Use rs.status() to locate the primary member.

Create the user administrator.

Add a user using the db.createUser() method. The user should have at minimum the userAdminAnyDatabase role on the admin database.

You must be connected to the primary to create users.

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enter the password when prompted. See Database User Roles for a full list of built-in roles and related to database administration operations.

Authenticate as the user administrator.

Authenticate to the admin database.

In mongosh, use db.auth() to authenticate. For example, the following authenticate as the user administrator fred:

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Alternatively, connect a new mongosh instance to the primary replica set member using the -u <username>, -p <password>, and the --authenticationDatabase parameters.

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.

Create the cluster administrator.

The clusterAdmin role grants access to replication operations, such as configuring the replica set.

Create a cluster administrator user and assign the clusterAdmin role in the admin database:

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),
     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

Enter the password when prompted.

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.

Create additional users (Optional).

Create users to allow clients to connect and interact with the replica set. See Database User Roles for basic built-in roles to use in creating read-only and read-write users.

You may also want additional administrative users. For more information on users, see Users.