Configuring MongoDB for Smart IT

MongoDB is included with and used by BMC MyIT and BMC Remedy with Smart IT (Smart IT). MongoDB is a database intended for very large amounts of data. It is high performance, because the lack of joins or embedding make reading and writing data fast. MongoDB can be used in high availability environments through replicated servers with automatic fail-over. MongoDB is scalable through automatic sharding, which means automatic partitioning of data across partitions.

The MongoDB database provides replica sets to support high availability and automatic failover. Replica sets are clustered servers that use the following types of servers:

• Primary — Stores the data; all read/write operations go to this server from any client. One server is always the primary server.
• Secondary — Stores backup data and is synchronized with the primary server. If the primary server is unavailable, the replica set elects a secondary server to become the primary server.
• Arbiter — Stores no data, cannot become the primary server during failover, and participates in the election process during failover only. Typically, arbiters are required only to break ties when there is an even number of secondary servers.

The installer for BMC MyIT and SmartIT can install MongoDB only on the same server as it installs BMC MyIT and Smart IT. While that configuration is suitable for development and testing, it does not provide the high availability and scalability that you need for your production environments. Use the guidelines and procedures in this topic to securely set up and configure MongoDB for your production environment.

Overview of deploying MongoDB securely in a production environment

The following table summarizes the process of deploying MongoDB securely in a production environment

Supported versions

The following table indicates the versions of MongoDB and Elasticsearch that BMC MyIT and Smart IT support:

Installing and setting up MongoDB

Follow this procedure to install and set up MongoDB on your primary server.

1. Run with root access:
   (Linux) Run the sudo su command.
   (Windows) Run as the system administrator.
2. Download MongoDB:
   
   •  (Linux) curl -O http://downloads.mongodb.org/linux/mongodb-linux-x86_64-2.6.8.tgz
   • (Windows) http://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-2.6.8.zip
     (Or, to get specific versions: http://www.mongodb.org/downloads#previous)
     

3. Extract the MongoDB archive:
   (Linux) tar -zxvf mongodb-linux-x86_64-2.6.8.tgz
   (Windows) Unzip.

4. Copy MongoDB to the target directory:
   (Linux) 
   mkdir -p /dbdata/mongodb
cp -R -n mongodb-linux-x86_64-2.6.8/ /dbdata/mongodb
   (Windows)
   Create c:\dbdata\mongodb.
   Move the extracted folder to c:\dbdata\mongodb.

5. Create the database data directory:
   (Linux) mkdir -p /dbdata/mongodata
   (Windows) Create c:\dbdata\mongodata.

6. If you are installing MongoDB as part of a replica set, create a key file. Your replica set deployment will use this key to authenticate servers to each other.
   Ensure that your key file meets the following requirements:
   
   • Contains 6 to 1024 characters and contains only characters in the base64 set.
   • (Linux only) Does not have group or world permissions on UNIX systems (the chmod 600 yourKeyFile command).
   • Setting keyFile enables authentication and specifies a key file for the replica set members to use when authenticating to each other.
   • Key file content is arbitrary but is the same on all members of the replica set instances that connect to the set.
   
   Example commands for Linux:
   

   openssl rand -base64 741 > mongo.key

   chmod 600 mongo.key

OR

   tr -cd '[:alnum:]' < /dev/urandom | fold -w50 | head -n1 > "mongo.key"

   
   Example command for Windows:
   Create the mongo.key file in c:\dbdata\mongodb with the following content: mysecretkey007
7. Start the MongoDB server.
   

   Windows: c:\dbdata\mongodb\mongodb-linux-x86_64-2.6.8/bin/mongod --dbpath c:\dbdata\mongodata --port 27017

   
   Unix: /dbdata/mongodb/mongodb-linux-x86_64-2.6.8/bin/mongod --dbpath /dbdata/mongodata --port 27017

8. Connect to the mongo shell and create the administrator user and the social database administrator:

   use admin
   db.createUser( {
   user: "siteUserAdmin",
   pwd: "password",
   roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
   });
   db.createUser( {
   user: "siteRootAdmin",
   pwd: "password",
   roles: [ { role: "root", db: "admin" } ]
   });
   use social
   db.createUser( {
   user: "social_admin", 
   pwd: "password",
   roles:
   [ { role: "dbOwner", db: "social" } ]
   });
   

9. Stop the mongo process that was started in step 7.

10. (Linux only) Add MongoDB as a service with the key file parameter:

    1. On  Red Hat Enterprise Linux (including CENT OS), create the file /etc/mongod.conf and add the following settings:
       

       Note

       For MongoDB 2.6.x, remove setParameter = textSearchEnabled=true.

       
       

       dbpath = /dbdata/mongodata 
       port = 27017 
       logpath = /dbdata/mongodb/mongo_social.log 
       logappend = true 
       quiet = true 
       journal = true 
       replSet = myitsocial 
       fork = true 
       keyFile = /dbdata/mongodb/mongo.key
       nohttpinterface = true

    2. Create the file /etc/init.d/mongorepl with the appropriate permissions and the following content:
       

       #!/bin/sh 
       # 
       # /etc/init.d/mongorepl 
       # Subsystem file for "MyIT-MongoRepl" server 
       # 
       # chkconfig: 2345 95 05 (1) 
       # description: MyIT-MongoRepl server daemon 
       #MONGOBIN -> point to mongod binary. 
        
       MONGOBIN="/dbdata/mongodb/mongodb-linux-x86_64-2.6.8/bin/mongod" 
        
       do_start() 
       { 
          echo "starting!"; 
          eval "$MONGOBIN -f /etc/mongod.conf"; 
       } 
        
       do_stop() 
       { 
          echo "stopping!" 
          eval "$MONGOBIN -f /etc/mongod.conf --shutdown"; 
       } 
        
       case "$1" in 
          start) 
             do_start 
             ;; 
          stop) 
             do_stop 
             ;; 
       esac 
        
       exit 0

        

    3. Use Redhat's chkconfig utility to start the service automatically:
       • To add to chkconfig: chkconfig --add mongorepl
       • To enable in run levels: chkconfig mongorepl on
       • To start:  service mongorepl start
       • To stop: service mongorepl stop
11. (Windows only) Start the MongoDB service with the key file:
    

    1. Create the file c:\dbdata\mongodb\mongodb-win32-x86_64-2008plus-2.6.8\mongod.cfg and add following settings:
       

       Note

       For MongoDB 2.6.x, remove setParameter = textSearchEnabled=true.

       
       

       dbpath=c:\dbdata\mongodata
       port=27017
       logpath=c:\dbdata\mongodb\mongo_social.log
       logappend=true
       quiet=true
       journal=true
       replSet=myitsocial
       keyFile = c:\dbdata\mongodb\mongo.key
       nohttpinterface = true

    2. As administrator, open the command prompt window and run the following command:

       c:\dbdata\mongodb\mongodb-win32-x86_64-2008plus-2.6.8\bin\mongod.exe --config c:\dbdata\mongodb\mongodb-win32-x86_64-2008plus-2.6.8\mongod.cfg --install

    3. To start the service, run the net start MongoDB command.

Deploying MongoDB as a replica set

Replication provides redundancy and increases data availability. With multiple copies of data on different database servers, replication protects a database from the loss of a single server. Replication also allows you to recover from hardware failure and service interruptions. With additional copies of the data, you can dedicate one to disaster recovery, reporting, or backup.

You can use replication to increase read capacity. Clients have the ability to send read and write operations to different servers. To increase the locality and availability of data for a distributed environment, you can maintain replica servers in different data centers.

 For development and testing environments, you can skip this procedure and run MongoDB as a stand-alone server. The examples in this procedure use the following configuration: 

• MongoDB1 server with the IP address 10.20.30.40
• MongoDB2 server with the IP address 10.20.30.41 
• MongoDB3 server with the IP address 10.20.30.42

Before you begin

Log on to the first MongoDB server and install MongoDB following the steps in To set up MongoDB.

To deploy MongoDB as a replica set

1. After you log on and install MongoDB, verify that MongoDB is running:
   ps -aef|grep mongo
   You should see output similar to the following example:

   rlakkamr 35368 35347 0 06:10 pts/0 00:00:00 grep mongo root 46274 1 0 Aug08 ? 00:13:32 /dbdata/mongodb/mongodb-linux-x86_64-2.6.8/bin/mongod --replSet myitsocial \--logpath .1.log. --dbpath /dbdata/mongodata \--port 27017 --keyFile /dbdata/mongodb/mongo.key \--setParameter textSearchEnabled=true once verified

2. Start the mongo shell.
   Example: /dbdata/mongodb/mongodb-linux-x86_64-2.6.8/bin/mongo

3. Issue the following commands:

   > use admin 
   > db.auth("siteRootAdmin", "<your-password-goes-here>"); 
   1

   > rs.initiate() 
   { 
      "info2" : "no configuration explicitly specified -- making one", 
      "me" : "10.20.30.40:27017", 
      "info" : "Config now saved locally. Should come online in about a minute.", 
      "ok" : 1 
   }

4. After a few minutes, verify in the same window with the rs.conf() command:

   > rs.conf() 
   { 
      "_id" : "social", 
      "version" : 1, 
      "members" : [ 
          { 
             "_id" : 0, 
             "host" : "10.20.30.40:27017" 
          } 
      ] 
   }

5. For the other MongoDB servers, follow the procedure in To set up MongoDB except for steps 7 to 9.
6. From the mongo shell on the first server (MongoDB1), complete the following tasks:
   
   1. Run the following command:
      /dbdata/mongodb/mongodb-linux-x86_64-2.6.8/bin/mongo
   2. Run the db.auth command:
       > db.auth("admin", "<your-password-goes-here>"); 1
   3. Add member:
      >rs.add("10.20.30.41:27017")
>rs.add("10.20.30.42:27017")

   4. To check the status of the replica set, run the rs.status() command.
       You should see output similar to the following example:

      { 
      "set" : "myitsocial", 
      "date" : ISODate("2014-08-12T06:15:02Z"), 
      "myState" : 1, 
      "members" : [ 
         { 
            "_id" : 0, 
            "name" : "10.20.30.40:27017", 
            "health" : 1, 
            "state" : 1, 
            "stateStr" : "PRIMARY", 
            "uptime" : 303165, 
            "optime" : Timestamp(1407521114, 1), 
            "optimeDate" : ISODate("2014-08-08T18:05:14Z"), 
            "self" : true 
         }, 
         { 
            "_id" : 1, 
            "name" : "10.20.30.41:27017", 
            "health" : 1, 
            "state" : 2, 
            "stateStr" : "SECONDARY", 
            "uptime" : 302985, 
            "optime" : Timestamp(1407521114, 1), 
            "optimeDate" : ISODate("2014-08-08T18:05:14Z"), 
            "lastHeartbeat" : ISODate("2014-08-12T06:15:02Z"), 
            "lastHeartbeatRecv" : ISODate("2014-08-12T06:15:02Z"), 
            "pingMs" : 0, 
         "syncingTo" : "10.20.30.40:27017" 
         },
         { 
            "_id" : 2, 
            "name" : "10.20.30.42:27017", 
            "health" : 1, "state" : 2, 
            "stateStr" : "SECONDARY", 
            "uptime" : 302985, 
            "optime" : Timestamp(1407521114, 1), 
            "optimeDate" : ISODate("2014-08-08T18:05:14Z"), 
            "lastHeartbeat" : ISODate("2014-08-12T06:15:02Z"), 
            "lastHeartbeatRecv" : ISODate("2014-08-12T06:15:02Z"), 
            "pingMs" : 0, 
            "syncingTo" : "10.20.30.40:27017" 
         } 
      ], 
      "ok" : 1 
      }

7. (Optional) To rotate mongodb logs, run the logRotate command from the admin schema:

   use admin
   db.runCommand( { logRotate : 1} )

8. For Linux, ensure that ulimit is set to 64000:
   ulimit -n 64000

9. For each BMC MyIT or SmartIT server, change the config.js file in Smart_IT_MyIT/social:

   "db_host":"mongodb://10.0.0.1:27017,10.0.0.2:27017,10.0.0.3:27017/",   
   "db_name": "social",   
   "db_auth": true,   
   "db_username": "social_admin",   
   "db_pw": "password", 
   

Applying security settings

You can restrict MongoDB access by using any combination of the following methods:

iptables -A INPUT -s <ip-address> -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT 
 
iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT

netsh advfirewall firewall add rule name="Open mongod port 27017" dir=in action=allow protocol=TCP localport=27017

netsh advfirewall firewall add rule name="Allowing mongod" dir=in action=allow program=" C:\mongodb\bin\mongod.exe"