deploy-replica-set-with-keyfile-access-control.txt

.. _deploy-repl-set-with-keyfile:
.. _deploy-repl-set-with-auth:

==============================================
Deploy Replica Set With Keyfile Access Control
==============================================

.. default-domain:: mongodb

.. contents:: On this page
   :local:
   :backlinks: none
   :depth: 1
   :class: singlecol

Overview
--------

Enforcing access control on a :term:`replica set` requires configuring:

- Security between members of the replica set using
  :doc:`Internal Authentication</core/security-internal-authentication>`, and

- Security between connecting clients and the replica set using
  :doc:`/core/authorization`.

For this tutorial, each member of the replica set uses the same internal
authentication mechanism and settings.

Enforcing internal authentication also enforces user access control. To
connect to the replica set, clients like the :program:`mongo` shell need to
use a :doc:`user account</core/authorization>`. See
:ref:`security-repSetDeploy-access-control`.

Cloud Manager and Ops Manager
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If you are currently using or are planning to use Cloud Manager or
Ops Manager, consider using the built-in features for
deploying a replica set with access control enforced.

See ``Deploy Replica Set`` in the
:mms-docs:`Cloud Manager manual</tutorial/deploy-replica-set>` or in the
:opsmgr:`Ops Manager manual</tutorial/deploy-replica-set>`.

See ``Access Control for MongoDB Deployments`` in the
:mms-docs:`Cloud Manager manual</nav/security-enable-authentication>` or in the
:opsmgr:`Ops manager manual</nav/security-enable-authentication>`.

Considerations
--------------

Operating System
~~~~~~~~~~~~~~~~

This tutorial primarily refers to the :program:`mongod` process.
Windows users should use the :program:`mongod.exe` program instead.

Keyfile Security
~~~~~~~~~~~~~~~~

Keyfiles are bare-minimum forms of security and are best suited for testing or
development environments. For production environments we recommend using
:doc:`x.509 certificates</core/security-x.509>`.

.. _security-repSetDeploy-access-control:

Access Control
~~~~~~~~~~~~~~

.. include:: /includes/internal-authentication-tutorials-access-control-consideration.rst

.. _security-replica-deploy-with-access-control:

Deploy New Replica Set with Keyfile Access Control
--------------------------------------------------

.. include:: /includes/steps/deploy-replica-set-with-auth.rst

x.509 Internal Authentication
-----------------------------

For details on using x.509 for internal authentication, see
:doc:`/tutorial/configure-x509-member-authentication`.

To upgrade from keyfile internal authentication to x.509 internal
authentication, see
:doc:`/tutorial/upgrade-keyfile-to-x509`.