Navigation
This version of the documentation is archived and no longer supported. To learn how to upgrade your version of MongoDB Ops Manager, refer to the upgrade documentation.
You were redirected from a different version of the documentation. Click here to go back.

Connect to Hosts with Kerberos Authentication

On this page

Kerberos is a generic authentication protocol available in MongoDB Enterprise after version 2.4. The On Prem MMS Monitoring agent can authenticate to monitored hosts using Kerberos in addition to the default MongoDB authentication protocol.

Install the monitoring agent and all requirements before beginning to configure Kerberos.

Install Required Operating System Packages

Debian and Ubuntu Linux

Install the following required packages:

copy 
sudo apt-get install krb5-user python-setuptools libkerb5-dev build-essential python-dev

Red Hat Enterprise, CentOS and Fedora Linux

Install the following required packages:

copy 
sudo yum install krb5-appl-clients.x86_64 gcc python-devel krb5-devel.x86_64

Install Python Requirements

copy 
sudo apt-get uninstall python-kerberos
sudo easy_install pymongo kerberos

Configure Kerberos Environment

  1. Create or configure the /etc/kerb5.conf file on the system to integrate this host into your Kerberos environment.
  2. Ensure that the kinit binary is available at the /user/bin/kinit path.

Create Kerberos Principal and MongoDB User

  1. Create or choose a Kerberos principal for the On Prem MMS Monitoring agent.

  2. Generate a keytab for the Kerberos principal and copy it to the system where the monitoring agent runs.

    Important

    Ensure that the user that will run the Monitoring agent is the same user that owns the keytab file.

  3. Create a MongoDB user for the new Kerberos principal. See Authentication Requirements for more information about required authentication roles.

  4. Edit the agent’s settings.py file to inform the agent about the keytab and principal identifier. Set:

    • the krb5Principal to the name of the Kerberos principal.

      copy 
      krb5Principal = <id>

    • Set the kerb5Keytab value to the complete absolute path of the keytab file:

      copy 
      krb5Keytab = None

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.