Using a cert to connect graylog to a mongodb cluster

Graylog Central (peer support)
1

1. Describe your incident:

https://docs.graylog.org/v1/docs/multinode-setup

This document says to put the database password. in the connections string. I would like to connect with a certificate because I think it is a better security model than connecting with a plain text password. I tried to use the Linux method of using two ` marks to interpret the cat command to call the secret inside the key file and it did not connect. I ran netstat twice after restarting the service and saw a time wait followed by a dropped connection. Is there a method to use a key file, or is this route not workable? If you can’t use a key file will it accept a salted hash for a connection string?

2. Describe your environment:
cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION=“Ubuntu 20.04.3 LTS”

  • Package Version:
    4.1
  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

I put a key file in place and tried to use the linux backticks solution to pull the key secret

4. How can the community help?

Is it technically possible to connect to Mongodb with a key or salted hash? If so what is the syntax?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hello && welcome

Are you referring to something like this?

3

That is exactly what I am referring to, and I understand the technical reasons why the feature request is denied. My follow up for this is this. if you cannot use a key to authenticate, can you encrypt your password as a salted hash, or this also not technically possible? Thank you.

Sincerely,
Michael Lazin

4

Hello,

Good question, I don’t know right now but I’ll look into it.

5

Hello,

You question is on point. I started researching this also because of upcoming projects I have. Since our MongoDb is on the same server which holds only the metadata is within the server, we didn’t have a need for it. which makes it more secure by configuring MongoDb with roles such as this example.

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [
      { role: "userAdminAnyDatabase", db: "admin" },
      { role: "readWriteAnyDatabase", db: "admin" }
    ]
  }
)

When creating a user/password for Graylog connection to MongoDb we gave that user for this connection a role and since its within the GL server meaning its not connecting outside the server, we just ensured the user name and password were very unique. Example:

use some_db
db.createUser(
  {
    user: "myNormalUser",
    pwd: "xyz123",
    roles: [ { role: "readWrite", db: "some_db" },
             { role: "read", db: "some_other_db" } ]
  }
)

But never the less, these are good ideas/questions. Knowing with larger environments this may not be possible to have MongoDb/Graylog on the same node.

Perhaps posting here for a feature request would be ideal.

Feature request

Hope that helps

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.