Deploy Replica Set With Keyfile Authentication使用密钥文件身份验证部署副本集¶

Create a keyfile.创建密钥文件。¶

With keyfile authentication, each mongod instances in the replica set uses the contents of the keyfile as the shared password for authenticating other members in the deployment.对于keyfile身份验证，副本集中的每个mongod实例都使用keyfile的内容作为共享密码，用于对部署中的其他成员进行身份验证。Only mongod instances with the correct keyfile can join the replica set.只有具有正确密钥文件的mongod实例才能加入副本集。

A key’s length must be between 6 and 1024 characters and may only contain characters in the base64 set.键的长度必须介于6到1024个字符之间，并且只能包含base64集合中的字符。All members of the replica set must share at least one common key.副本集的所有成员必须至少共享一个公共密钥。

You can generate a keyfile using any method you choose.您可以使用选择的任何方法生成密钥文件。For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password.例如，下面的操作使用openssl生成一个复杂的伪随机1024字符字符串，用作共享密码。It then uses chmod to change file permissions to provide read permissions for the file owner only:然后使用chmod更改文件权限，以便仅为文件所有者提供读取权限：

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用密钥文件的其他详细信息和要求，请参见密钥文件。

Copy the keyfile to each replica set member.将密钥文件复制到每个副本集成员。¶

Copy the keyfile to each server hosting the replica set members.将密钥文件复制到承载复制集成员的每个服务器。Ensure that the user running the mongod instances is the owner of the file and can access the keyfile.确保运行mongod实例的用户是文件的所有者，并且可以访问密钥文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod instances, such as a USB drive or a network attached storage device.避免将密钥文件存储在存储介质上，这些存储介质可以很容易地从托管mongod实例的硬件断开连接，例如USB驱动器或网络连接存储设备。

Start each member of the replica set with access control enabled.在启用访问控制的情况下启动副本集的每个成员。¶

For each member in the replica set, start the mongod with either the security.keyFile configuration file setting or the --keyFile command-line option.对于副本集中的每个成员，使用security.keyFile文件配置文件设置或--keyFile命令行选项启动mongod。Running mongod with the --keyFile command-line option or the security.keyFile configuration file setting enforces both Internal/Membership Authentication and Role-Based Access Control.配合--keyFile命令行选项或security.keyFile配置文件设置运行mongod同时强制内部/成员身份验证和基于角色的访问控制。

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>
net:
   bindIp: localhost,<hostname(s)|ip address(es)>

mongod --config <path-to-config-file>

mongod --keyFile <path-to-keyfile> --replSet <replicaSetName> --bind_ip localhost,<hostname(s)|ip address(es)>

Connect to a member of the replica set over the localhost interface.通过localhost接口连接到副本集的成员。¶

Connect a mongo shell to one of the mongod instances over the localhost interface.通过localhost接口将mongo shell连接到其中一个mongod实例。You must run the mongo shell on the same physical machine as the mongod instance.必须在与mongod实例相同的物理计算机上运行mongoshell。

The localhost interface is only available since no users have been created for the deployment.localhost接口仅在没有为部署创建用户时可用。The localhost interface closes after the creation of the first user.创建第一个用户后，localhost接口关闭。

Initiate the replica set.启动复制集。¶

From the mongo shell, run the rs.initiate() method.从mongo shell运行rs.initiate()方法。

rs.initiate() can take an optional replica set configuration document.rs.initiate()可以获取可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id field set to the replica set name specified in either the replication.replSetName or the --replSet option._id字段设置为replication.replSetName或--replSet选项中指定的副本集名称。
• The members array with a document per each member of the replica set.members数组中每个副本集成员都有一个文档。

The following example initates a three member replica set.下面的示例初始化一个三成员副本集。

rs.initiate(
  {
    _id : <replicaSetName>,
    members: [
      { _id : 0, host : "mongo1.example.net:27017" },
      { _id : 1, host : "mongo2.example.net:27017" },
      { _id : 2, host : "mongo3.example.net:27017" }
    ]
  }
)

rs.initiate() triggers an election and elects one of the members to be the primary.rs.initiate()触发选举并选出其中一名成员作为主要成员。

Connect to the primary before continuing.继续之前先连接到主服务器。Use rs.status() to locate the primary member.使用rs.status()以定位主要成员。

Create the user administrator.创建用户管理员。¶

Add a user using the db.createUser() method.使用数据库db.createUser()方法。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

You must be connected to the primary to create users.您必须连接到主服务器才能创建用户。

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.下面的示例在admin数据库上创建具有userAdminAnyDatabase角色的用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enter the password when prompted.出现提示时输入密码。See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参见数据库用户角色。

Authenticate as the user administrator.作为用户管理员进行身份验证。¶

Authenticate to the admin database.对admin数据库进行身份验证。

In the mongo shell, use db.auth() to authenticate.在mongo shell中，使用db.auth()进行身份验证。For example, the following authenticate as the user administrator fred:例如，以下用户将以用户管理员fred身份进行身份验证：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Alternatively, connect a new mongo shell to the primary replica set member using the -u <username>, -p <password>, and the --authenticationDatabase parameters.或者，使用-u<username>、-p<password>和--authenticationDatabase参数将新mongo shell连接到主副本集成员。

mongo -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, the mongo shell prompts for the password.如果没有为-p命令行选项指定密码，mongo shell将提示输入密码。

Create the cluster administrator.创建群集管理器。¶

The clusterAdmin role grants access to replication operations, such as configuring the replica set.clusterAdmin角色授予对复制操作的访问权，例如配置副本集。

Create a cluster administrator user and assign the clusterAdmin role in the admin database:创建群集管理员用户并在admin数据库中分配clusterAdmin角色：

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

Enter the password when prompted.出现提示时输入密码。

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Create additional users (Optional).创建其他用户（可选）。¶

Create users to allow clients to connect and interact with the replica set.创建用户以允许客户端连接副本集并与之交互。See Database User Roles for basic built-in roles to use in creating read-only and read-write users.有关创建只读和读写用户时使用的基本内置角色，请参见数据库用户角色。

You may also want additional administrative users.您可能还需要其他管理用户。 For more information on users, see Users.有关用户的详细信息，请参阅用户。