MongoDB Documentation, Release 3.0.4 If you still encounter problems with Kerberos on Linux, you can start both mongod and mongo (or another client) with the environment variable KRB5_TRACE set to different files to produce more verbose logging of the Kerberos process to help further troubleshooting. For example, the following starts a standalone mongod with KRB5_TRACE set: In some situations, MongoDB will return error messages from the GSSAPI interface if there is a problem with the Kerberos service. Some common error messages are: If you receive this error, ensure that you are using the correct credentials and the correct fully qualified domain name when connecting to the host. If you encounter this problem, consider the items in the Kerberos Configuration Checklist (page 380), in partic- ular, whether the SPN in the keytab file (page 332) matches the SPN for the mongod or mongos instance. To determine whether the SPNs match: klist -k <keytab> Replace <keytab> with the path to your keytab file. hostname -f Ensure that this name matches the name in the keytab file, or start mongod or mongos with the --setParameter saslHostName=<hostname> . The $redact pipeline operator restricts the contents of the documents based on information stored in the documents themselves. See also: Implement Field Level Redaction Common Error Messages Debug with More Verbose Logs env KRB5_KTNAME=/opt/mongodb/mongod.keytab \ KRB5_TRACE=/opt/mongodb/log/mongodb-kerberos.log \ /opt/mongodb/bin/mongod --dbpath /opt/mongodb/data \ --fork --logpath /opt/mongodb/log/mongod.log \ --auth --setParameter authenticationMechanisms=GSSAPI GSSAPI error in client while negotiating security context. This error occurs on the client and reflects insufficient credentials or a malicious attempt to authenticate. GSSAPI error acquiring credentials. This error occurs during the start of the mongod or mongos and reflects improper configuration of the system hostname or a missing or incorrectly configured keytab file. 1. Examine the keytab file, with the following command: 2. Check the configured hostname for your system, with the following command: • Kerberos Authentication (page 331) • Configure MongoDB with Kerberos Authentication on Linux (page 372) • Configure MongoDB with Kerberos Authentication on Windows (page 376) 381 6.3. Security Tutorials