无密码使用mongoDB可以吗？
我计划安装 mongodb 和连接到同一台机器的 Windows 服务。 该机器将处于隔离网络中。
当我们这样做的时候。 无密码连接本地mongodb可以吗？
我规划的房产是这样的...
private MongoDatabase _db;
public MongoDatabase DB
{
get
{
if (_db == null)
{
var mongoServer = MongoServer.Create();
_db = mongoServer.GetDatabase("myStatistics");
}
return _db;
}
}
private MongoCollection _collection;
public MongoCollection Collection
{
get { return _collection ?? (_collection = DB.GetCollection("myStats")); }
}
I am planning to install mongodb and the windows service which is connecting to it to the same machine.
That machine will be in isolated network.
When we do it like that.
Is it ok to connect local mongodb passwordless?
My planned properties will be like this...
private MongoDatabase _db;
public MongoDatabase DB
{
get
{
if (_db == null)
{
var mongoServer = MongoServer.Create();
_db = mongoServer.GetDatabase("myStatistics");
}
return _db;
}
}
private MongoCollection _collection;
public MongoCollection Collection
{
get { return _collection ?? (_collection = DB.GetCollection("myStats")); }
}
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
有两种选择：
在受信任的网络中使用禁用身份验证的 MongoDB 是可以的。 MongoDb 开发人员建议在以下位置运行数据库可信环境而不是专注于身份验证选项。
There are two options:
It's okay to use MongoDB with auth disabled in trusted network. MongoDb developers recommend running the database in trusted environment rather than focusing on auth options.
对我来说，问题是，通过无密码运行它可以获得什么好处？
即使您在受信任的环境中运行，使用密码真的要花那么多钱吗？虽然受信任的环境不应被破坏，但没有什么是完全安全的，通过添加密码，您可以添加额外的防御层。因此，如果有人破坏了您的服务器，他们不应该自动访问数据库。
出于同样的原因，当用户密码存储在数据库中时，您将对其进行加密/散列。如果有人破坏了您的服务器，他们不会自动获得对所有内容的访问权限。
这种方法称为纵深防御。
To me, the question is, what do you gain from running it password-less?
Even if you are running in a trusted environment, does it really cost that much to use a password? While the trusted environment should not be breached, nothing is completely safe and by adding the password, you are adding an additional layer of defense. So if somebody breaches your server they shouldn't automatically have access to the database.
For the same reason you would encrypt/hash user passwords when they are stored in the database. If somebody breaches your server, they don't automatically gain access to everything.
This approach is called defense in depth.
如果您的系统是隔离的，那么您可以做到。但从长远角度考虑您的项目的未来前景。稍后您可能需要具有受限访问权限的用户，您可能需要用户角色，如果您这样做很有可能，那么最好开始朝这个方向思考并开始使用身份验证。这也将为数据库的安全性增加一层，而无需花费太多。
If your system is isolated that yes you can do it. but think in term future picture of your project.Later you might need to users with restricted access ,You might need user roles ,and if you do which is highly possible ,than its better to start thinking in that direction and start using authentication. This will also add one more layer to the security of your db with out costing much.
同一台机器，隔离网络。我会说是的。我对我所使用的系统也做了同样的事情。
唯一的问题是，如果有其他计算机连接到网络，这些计算机也连接到互联网，并且可能不安全（没有防病毒、防火墙等）。
Same machine, isolated network. I'd say yes. I do the same with the system I work on.
Only issue is if there are other computers connected to the network, that are also connected to the internet, and might not be secure (no anti-virus, firewall, etc).