Configure MongoDB with Kerberos Authentication

# Run these commands on all 3 servers
# Install NTP to synchronize the clock on all three servers
sudo yum install -y ntp
sudo ntpdate 0.rhel.pool.ntp.org
sudo systemctl start  ntpd.service
sudo systemctl enable ntpd.service

# TODO: Fix the below ip addresses based on your lab environment
echo "172.31.10.101     kdc.mdbkrb5.net" | sudo tee -a /etc/hosts
echo "172.31.10.102     mdb01.mdbkrb5.net" | sudo tee -a /etc/hosts
echo "172.31.10.103     client01.mdbkrb5.net" | sudo tee -a /etc/hosts

sudo yum install -y krb5-server

# Rename the Kerberos Realm name from EXAMPLE.COM to MDBKRB5.NET, or any name of your choice
sudo sed -i 's/EXAMPLE.COM/MDBKRB5.NET/g' /var/kerberos/krb5kdc/kdc.conf
sudo sed -i 's/EXAMPLE.COM/MDBKRB5.NET/g' /var/kerberos/krb5kdc/kadm5.acl
sudo sed -i 's/kerberos.example.com/kdc.mdbkrb5.net/g' /etc/krb5.conf
sudo sed -i 's/example.com/mdbkrb5.net/g' /etc/krb5.conf
sudo sed -i 's/EXAMPLE.COM/MDBKRB5.NET/g' /etc/krb5.conf
sudo sed -i 's/#//g' /etc/krb5.conf
sudo sed -i 's/^ Configuration/# Configuration/g' /etc/krb5.conf

# File: /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = MDBKRB5.NET
 default_ccache_name = KEYRING:persistent:%{uid}
[realms]
 MDBKRB5.NET = {
  kdc = kdc.mdbkrb5.net
  admin_server = kdc.mdbkrb5.net
 }
[domain_realm]
 .mdbkrb5.net = MDBKRB5.NET
 mdbkrb5.net = MDBKRB5.NET



# File: /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88
[realms]
 MDBKRB5.NET = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }



# File: /var/kerberos/krb5kdc/kadm5.acl
*/admin@MDBKRB5.NET	*

# Create Kerberos database for the realm
sudo kdb5_util create -s -r MDBKRB5.NET
# Loading random data
# Initializing database '/var/kerberos/krb5kdc/principal' for realm 'MDBKRB5.NET',
# master key name 'K/M@MDBKRB5.NET'
# You will be prompted for the database Master Password.
# It is important that you NOT FORGET this password.
# Enter KDC database master key:
# Re-enter KDC database master key to verify:

sudo systemctl start krb5kdc.service
sudo systemctl start kadmin.service
sudo systemctl enable krb5kdc.service
sudo systemctl enable kadmin.service

# Set up a Kerberos principal with admin privileges
# and principal for the users, KDC host, and MongoDB server
# for simplicity I used <user/service name>@123 as the password
# Commands you need to run
sudo kadmin.local
# Authenticating as principal root/admin@MDBKRB5.NET with password.
# kadmin.local:
# Run the below commands at kadmin.local prompt

addprinc root/admin
# Enter password for principal "root/admin@MDBKRB5.NET":
# Re-enter password for principal "root/admin@MDBKRB5.NET":
# Principal "root/admin@MDBKRB5.NET" created.
addprinc alex
# Enter password for principal "alex@MDBKRB5.NET":
# Re-enter password for principal "alex@MDBKRB5.NET":
# Principal "alex@MDBKRB5.NET" created.
addprinc bob
# Enter password for principal "bob@MDBKRB5.NET":
# Re-enter password for principal "bob@MDBKRB5.NET":
# Principal "bob@MDBKRB5.NET" created.
addprinc host/kdc.mdbkrb5.net
# Enter password for principal "host/kdc.mdbkrb5.net@MDBKRB5.NET":
# Re-enter password for principal "host/kdc.mdbkrb5.net@MDBKRB5.NET":
# Principal "host/kdc.mdbkrb5.net@MDBKRB5.NET" created.
addprinc mongodb/mdb01.mdbkrb5.net
# Enter password for principal "mongodb/mdb01.mdbkrb5.net@MDBKRB5.NET":
# Re-enter password for principal "mongodb/mdb01.mdbkrb5.net@MDBKRB5.NET":
# Principal "mongodb/mdb01.mdbkrb5.net@MDBKRB5.NET" created.

q

# Install the Kerberos client
sudo yum install -y krb5-workstation

# TODO: Copy the /etc/krb5.conf file contents from
# Kerberos Server's config file to MongoDB server
sudo cat /etc/krb5.conf

sudo tee /etc/yum.repos.d/mongodb-enterprise.repo << EOF
[mongodb-enterprise]
name=MongoDB Enterprise Repository
baseurl=https://repo.mongodb.com/yum/redhat/\$releasever/mongodb-enterprise/4.0/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
EOF

# Install the MongoDB server
sudo yum install -y mongodb-enterprise

## Disable the selinux
sudo setenforce 0
sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

# Configure mongod.conf with Kerberos settings
sudo tee /etc/mongod.conf << EOF
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
storage:
  dbPath: /var/lib/mongo
  journal:
    enabled: true
processManagement:
  fork: true  # fork and run in background
  pidFilePath: /var/run/mongodb/mongod.pid  # location of pidfile
  timeZoneInfo: /usr/share/zoneinfo
net:
  port: 27017
  bindIp: 0.0.0.0 # <-- TODO: Exposes MongoDB to Public IP. Please use internal IPs instead
security:
  authorization: enabled
  keyFile: /var/lib/mongo/private/keyfile
  sasl:
    hostName: mdb01.mdbkrb5.net
replication:
  replSetName: rs0
setParameter:
  authenticationMechanisms: GSSAPI,SCRAM-SHA-256
EOF

# Create a directory to store MongoDB keyfile and Kerberos keytab file
sudo mkdir -p /var/lib/mongo/private
openssl rand -base64 756 | sudo tee /var/lib/mongo/private/keyfile
sudo chmod 400 /var/lib/mongo/private/keyfile

sudo ktutil
# ktutil:  
# Run the below commands at ktutil prompt

addent -password -p mongodb/mdb01.mdbkrb5.net -k 2 -e aes256-cts
# Password for mongodb/mdb01.mdbkrb5.net@MDBKRB5.NET:

write_kt /var/lib/mongo/private/mon01.keytab
q

sudo klist -k /var/lib/mongo/private/mon01.keytab
# Keytab name: FILE:/var/lib/mongo/private/mon01.keytab
# KVNO Principal
# ---- ------------------------------------------
#    2 mongodb/mdb01.mdbkrb5.net@MDBKRB5.NET

# Set the keytab file location in environment variable
echo "KRB5_KTNAME=/var/lib/mongo/private/mon01.keytab" | sudo tee /etc/sysconfig/mongod

# Change the folder ownership to mongod
sudo chown -R mongod:mongod /var/lib/mongo/private
sudo systemctl start mongod

# Install the Kerberos client
sudo yum install -y krb5-workstation

# TODO: Copy the /etc/krb5.conf file contents from
# Kerberos Server's config file to the Client's machine
sudo cat /etc/krb5.conf

sudo tee /etc/yum.repos.d/mongodb-enterprise.repo << EOF
[mongodb-enterprise]
name=MongoDB Enterprise Repository
baseurl=https://repo.mongodb.com/yum/redhat/\$releasever/mongodb-enterprise/4.0/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
EOF

# Install the mongodb enterprise dependencies and mongodb shell
sudo yum install -y cyrus-sasl cyrus-sasl-gssapi cyrus-sasl-plain krb5-libs libcurl libpcap lm_sensors-libs net-snmp net-snmp-agent-libs openldap openssl rpm-libs tcp_wrappers-libs
sudo yum install -y mongodb-enterprise-shell-4.0.2

# Login into the Kerberos as bob
kinit -p bob
# Password for bob@MDBKRB5.NET:

klist
# Ticket cache: KEYRING:persistent:1000:1000
# Default principal: bob@MDBKRB5.NET
# Valid starting       Expires              Service principal
# 10/04/2018 16:58:49  10/05/2018 16:58:48  krbtgt/MDBKRB5.NET@MDBKRB5.NET

mongo social --quiet --host mdb01.mdbkrb5.net --authenticationMechanism=GSSAPI --authenticationDatabase='$external' --username bob@MDBKRB5.NET
# MongoDB Enterprise rs0:PRIMARY>
# Run the below commands at rs0:PRIMARY prompt

# db.runCommand({connectionStatus: 1}).authInfo
# {
#   "authenticatedUsers": [
#     {
#       "user": "bob@MDBKRB5.NET",
#       "db": "$external"
#     }
#   ],
#   "authenticatedUserRoles": [
#     {
#       "role": "readWrite",
#       "db": "social"
#     }
#   ]
# }

# Test the write privilege on social database
db.people.insert({fname: 'Shyam', lname: 'Arjarapu'})
# WriteResult({ "nInserted" : 1 })

# Test the read privilege on social database
db.people.findOne()
# {
# 	"_id" : ObjectId("5bb647a8315c61d11c361945"),
# 	"fname" : "Shyam",
# 	"lname" : "Arjarapu"
# }

# Note that bob has no previleges on admin database
use admin
# switched to db admin
show collections
# Warning: unable to run listCollections, attempting to approximate collection names by parsing connectionStatus