Добавление TSL в пн go приводит к сбою

Question

У меня запущена и работает архитектура репликации 3 mongodb. Когда я добавляю TSL в файл / etc / mongod conf mongod, он сразу вылетает и ничего не записывает в журнал go. Я поместил файл pem, содержащий все сертификаты и ключ, в /etc/ssl/mongo.pem с ключом внизу файла. Я сделал chmod 600 в файле pem. Я добавляю TSL к основному сначала и останавливаю и начинаю mongod. Мой Mongod TLS config:

net:

  port: 27017

  bindIpAll: true

  tls:

    mode: requireTLS

    certificateKeyFile: /etc/ssl/mongo.pem
security:
  keyFile: /opt/mongod/keyfile

Ошибка, которую я получаю при запуске:

ec2-user@ip-10-0-16-140 log]$ sudo service mongod start
Starting mongod (via systemctl):  Job for mongod.service failed because the control process exited with error code. See "systemctl status mongod.service" and "journalctl -xe" for details.
                                                           [FAILED]

Возврат из состояния вызова:

[ec2-user@ip-10-0-16-140 ~]$ systemctl status mongod.service
● mongod.service - SYSV: Mongo is a scalable, document-oriented database.
   Loaded: loaded (/etc/rc.d/init.d/mongod; bad; vendor preset: disabled)
   Active: failed (Result: exit-code) since Fri 2020-02-28 00:43:51 UTC; 17s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 18327 ExecStop=/etc/rc.d/init.d/mongod stop (code=exited, status=0/SUCCESS)
  Process: 18548 ExecStart=/etc/rc.d/init.d/mongod start (code=exited, status=1/FAILURE)

Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Starting SYSV: Mongo is a scalable, document-oriented database....
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session opened for user mongod by (uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session closed for user mongod
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal mongod[18548]: Starting mongod: [FAILED]
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service: control process exited, code=exited status=1
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Failed to start SYSV: Mongo is a scalable, document-oriented database..
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Unit mongod.service entered failed state.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service failed.
[ec2-user@ip-10-0-16-140 ~]$ journalctl -xe
Feb 28 00:42:13 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18523]: pam_unix(sudo:session): session closed for user root
Feb 28 00:42:27 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/vi /etc/mongo.pem
Feb 28 00:42:27 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:42:31 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: pam_unix(sudo:session): session closed for user root
Feb 28 00:42:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/vi /etc/ssl/mongo.pem
Feb 28 00:42:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:43:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: pam_unix(sudo:session): session closed for user root
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/sbin/service mongod start
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Starting SYSV: Mongo is a scalable, document-oriented database....
-- Subject: Unit mongod.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit mongod.service has begun starting up.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session opened for user mongod by (uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session closed for user mongod
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal mongod[18548]: Starting mongod: [FAILED]
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service: control process exited, code=exited status=1
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Failed to start SYSV: Mongo is a scalable, document-oriented database..
-- Subject: Unit mongod.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit mongod.service has failed.
-- 
-- The result is failed.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Unit mongod.service entered failed state.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service failed.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: pam_unix(sudo:session): session closed for user root
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal dhclient[2603]: XMT: Solicit on eth0, interval 113300ms.

Answer 1

Это может быть проблема с вашим mongodb.pem файлом. В целях тестирования вы можете создать самозаверяющий сертификат и ключ, например:

openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key

cat mongodb-cert.key mongodb-cert.crt > mongodb.pem

, а затем установить разрешения для файла PEM, вы можете использовать

chmod 600 mongodb.pem

, учитывая следующий файл конфигурации для экземпляра mongod:

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: 0.0.0.0
   port: 27017

Примечание: bindIP с 0.0.0.0 не рекомендуется, но это хорошее место для запуска. Кроме того, вы можете найти журналы в /var/log/mongodb/mongod.log в качестве пути по умолчанию