[DOCS-11500] Add suggestion on how to preserve KRB5_KTNAME on systemd-based Linux distros Created: 28/Mar/18  Updated: 30/Oct/23  Resolved: 24/Aug/22

Status: Closed
Project: Documentation
Component/s: Server
Affects Version/s: None
Fix Version/s: Server_Docs_20231030

Type: Improvement Priority: Major - P3
Reporter: Dmitry Ryabtsev Assignee: Dave Cuthbert (Inactive)
Resolution: Fixed Votes: 1
Labels: kerberos
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Participants:
Days since reply: 1 year, 22 weeks, 1 day ago
Epic Link: DOCSP-1769
Story Points: 1

 Description   

In the documentation section that talks about configuring MongoDB for Kerberos authentication on Linux we have the following suggestion:

If you installed MongoDB Enterprise using one of the official .deb or .rpm packages, and you use the included init/upstart scripts to control the mongod instance, you can set the KR5_KTNAME variable in the default environment settings file instead of setting the variable each time.

For .rpm packages, the default environment settings file is /etc/sysconfig/mongod.

For .deb packages, the file is /etc/default/mongodb.

This is rather outdated suggestion since most of the modern Linux distros (Ubuntu 16, RHEL 7) have switched from init/upstart scripts to systemd unit files. Our packages that we ship for these distros deploy the appropriate unit files. The highlighted recommendation cannot be applied there.

In order to preserve the value of the KRB5_KTNAME environment variable on such hosts the user should modify the unit files. We should update our documentation so it would explain how it can be done:

  1. To find the location of the unit file (and to view its content)

    $ sudo systemctl cat <service_name>
    

  2. Sample unit file (with KRB5_KTNAME added):

    [Unit]
    Description=High-performance, schema-free document-oriented database
    After=network.target
    Documentation=https://docs.mongodb.org/manual
     
    [Service]
    User=mongodb
    Group=mongodb
    ExecStart=/usr/bin/mongod --config /etc/mongod.conf
    Environment="KRB5_KTNAME=/etc/mongod.keytab"
    PIDFile=/var/run/mongodb/mongod.pid
    # file size
    LimitFSIZE=infinity
    # cpu time
    LimitCPU=infinity
    # virtual memory size
    LimitAS=infinity
    # open files
    LimitNOFILE=64000
    # processes/threads
    LimitNPROC=64000
    # locked memory
    LimitMEMLOCK=infinity
    # total threads (user+kernel)
    TasksMax=infinity
    TasksAccounting=false
     
    # Recommended limits for for mongod as specified in
    # http://docs.mongodb.org/manual/reference/ulimit/#recommended-settings
     
    [Install]
    WantedBy=multi-user.target
    

  3. Once the unit file is modified, it should be re-loaded as:

    sudo systemctl daemon-reload
    

  4. Then the service needs to be restarted for the change to take effect


 Comments   
Comment by Githook User [ 06/Sep/22 ]

Author:

{'name': 'Dave Cuthbert', 'email': '69165704+davemungo@users.noreply.github.com', 'username': 'davemungo'}

Message: DOCS_11500 set KRB5_KTNAME on systemd v6.0 (#1685)

Comment by Githook User [ 24/Aug/22 ]

Author:

{'name': 'Dave Cuthbert', 'email': '69165704+davemungo@users.noreply.github.com', 'username': 'davemungo'}

Message: DOCS-11500 BACKPORT (#1712)
Branch: v4.2
https://github.com/10gen/docs-mongodb-internal/commit/9c78931007bad0a97dbba999968e6d84a65dd4cc

Comment by Githook User [ 24/Aug/22 ]

Author:

{'name': 'Dave Cuthbert', 'email': '69165704+davemungo@users.noreply.github.com', 'username': 'davemungo'}

Message: DOCS_11500 set KRB5_KTNAME on systemd v6.0 (#1685)

Generated at Thu Feb 08 08:02:57 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.