mongodb user can login without any authentication

Question

When you first install mongodb, there is no root user. You simply start mongo with (if on mac osx) "mongod --dbpath='/usr/local/var/mongodb'", and then run mongo in the shell and it will connect you without any authentication.

I create the admin user in the admin database:

> db
admin

> db.createUser({
  "user" : "test1",
  "pwd" : "test1",
  "roles" : [ { "role" : "userAdminAnyDatabase", "db" : "admin" } ]
})

> db.getUsers()
[
    {
        "_id" : "admin.test1",
        "user" : "test1",
        "db" : "admin",
        "roles" : [
            {
                "role" : "userAdminAnyDatabase",
                "db" : "admin"
            }
        ],
        "mechanisms" : [
            "SCRAM-SHA-1",
            "SCRAM-SHA-256"
        ]
    }
]

Now I connect to mongo shell as admin user:

> db
admin
> db.runCommand({connectionStatus : 1})
{
    "authInfo" : {
        "authenticatedUsers" : [
            {
                "user" : "test1",
                "db" : "admin"
            }
        ],
        "authenticatedUserRoles" : [
            {
                "role" : "userAdminAnyDatabase",
                "db" : "admin"
            }
        ]
    },
    "ok" : 1
}

I start mongod with access control:

$ sudo mongod --auth --port 27017 --dbpath=.
Password:
2020-04-16T20:28:40.656-0400 I CONTROL  [main] Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'
2020-04-16T20:28:40.672-0400 I CONTROL  [initandlisten] MongoDB starting : pid=8441 port=27017 dbpath=. 64-bit

I even turned on security:

$ cd /usr/local/etc/
$ vim mongod.conf
security:
  authorization: "enabled"

Yet I can simply login with just "mongo":

$ mongo admin
MongoDB shell version v4.0.4
connecting to: mongodb://127.0.0.1:27017/admin
Implicit session: session { "id" : UUID("95879725-00ed-4cee-bd43-8ba093df1e19") }
MongoDB server version: 4.0.4
> db.runCommand({connectionStatus : 1})
{
    "authInfo" : {
        "authenticatedUsers" : [ ],
        "authenticatedUserRoles" : [ ]
    },
    "ok" : 1
}

This is wild. What else must I do? Unless there is some type of automatic login when logged into the ip the server is running on?

D. SM D. SM · Accepted Answer · 2020-04-17T00:43:19

Some commands do not require authentication. Try reading or writing to a collection.

Authentication itself is performed via a sequence of commands (you can read about those here) therefore some of the commands must by necessity not require authentication.

Some commands return different responses based on whether a connection is authenticated. For example, try {ismaster:1} with and without authentication.

mongodb user can login without any authentication

1 Answers