MongoDB Documentation, Release 3.0.4 Procedure Enable Authentication after Creating the User Administrator Overview Related Documents 359 6.3. Security Tutorials Enabling authentication on a MongoDB instance restricts access to the instance by requiring that users identify them- selves when connecting. In this procedure, you will create the instance’s first user, which must be a user administrator and then enable authentication. Then, you can authenticate as the user administrator to create additional users and grant additional access to the instance. This procedures outlines how enable authentication after creating the user administrator. The approach requires a restart. To enable authentication without restarting, see Enable Client Access Control (page 357). Step 3: Add users. While connected to a mongos , add the first administrative user and then add subsequent users. See Create a User Administrator (page 384). Specify the key file at runtime. When starting the component, set the --keyFile option, which is an option for both mongos instances and mongod instances. Set the --keyFile to the key file’s path. The keyFile setting implies the authorization setting, which means in most cases you do not need to set authorization explicitly. security: keyFile: /srv/mongodb/keyfile Specify the key file in the configuration file. In the configuration file, set the keyFile option to the key file’s path and then start the component, as in the following example: Step 2: Enable authentication on each component in the cluster. On each mongos and mongod in the cluster, including all config servers and shards, specify the key file using one of the following approaches: You may generate a key file using any method you choose. Always ensure that the password stored in the key file is both long and contains a high amount of entropy. Using openssl in this manner helps generate such a key. openssl rand -base64 741 > mongodb-keyfile chmod 600 mongodb-keyfile To generate pseudo-random data to use for a keyfile , issue the following openssl command: Step 1: Create a key file. Create the key file your deployment will use to authenticate servers to each other. • Authentication (page 320) • Security (page 317) • Use x.509 Certificate for Membership Authentication (page 363)