Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-2259

Alow the Monitoring Agent to authenticate to monitored mongods using Kerberos

    • Type: Icon: Task Task
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 01112017-cleanup
    • Affects Version/s: None
    • Component/s: None
    • Labels:

      Install the prerequisites on the Monitoring Agent server

      Install the Linux Kerberos client package

      On Debian:

      sudo apt-get install krb5-user
      

      On RHEL:

      sudo yum install krb5-appl-clients.x86_64
      

      Don't forget to create an /etc/krb5.conf file.

      Install Python Kerberos packages

      On Debian:

      sudo apt-get install python-pip libkrb5-dev build-essential python-dev
      sudo pip install pymongo
      suod pip install kerberos
      

      On RHEL:

      sudo yum install gcc python-devel krb5-devel.x86_64 
      sudo pip install pymongo
      sudo pip install kerberos
      

      Create a krb5.conf file

      Create or configure the /etc/krb5.conf file as necessary for your Kerberos environment.

      Verify location of kinit application

      Make sure that the kinit application is available at /usr/bin/kinit.

      Create the Kerberos principal and MongoDB user

      1. Create or choose a Kerberos principal for the Monitoring Agent
      2. Generate a keytab for the Kerberos principal and copy it to the Monitoring Agent server. Make sure that the keytab file is owned by the same Linux user that you use to run the Monitoring Agent.
      3. Create a mongodb user for that Kerberos principal. Please see documentation on required roles [link to auth doc]
      4. Enter the Kerberos principal ID and the full path to the keytab in the settings.py file.

            Assignee:
            sam.kleinman Sam Kleinman (Inactive)
            Reporter:
            cailin.nelson@mongodb.com Cailin Nelson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved:
              10 years, 22 weeks ago