How to secure mongodump to make backup from remote machine?

Question

I have mongod instance running on 1.2.3.4 for example and have another backup server on 100.90.80.1.

I need to make backup mongodb data from 1.2.3.4 to 100.90.80.1 with the following bash script:

#!/bin/bash

set -e

MONGODUMP_PATH="/usr/bin/mongodump"
MONGO_HOST="1.2.4.4"
MONGO_PORT="27017"
MONGO_DATABASE="db"
MONGO_USERNAME="login"
MONGO_PASSWORD="pass"

TIMESTAMP=`date +%F-%H%M`
BACKUP_FILE_PATH="/var/backups/tokumx-backup-$TIMESTAMP"

error_exit()
{
  echo "Backup TokuMX filed due Error: $1" 1>&2
  rm -rf $BACKUP_FILE_PATH
  rm -rf $BACKUP_FILE_PATH.tar
  exit 1
}

# Create backup
$MONGODUMP_PATH --host $MONGO_HOST --port $MONGO_PORT --db $MONGO_DATABASE --use
rname $MONGO_USERNAME --password $MONGO_PASSWORD --out $BACKUP_FILE_PATH

# Make archive
tar cf $BACKUP_FILE_PATH.tar -C $BACKUP_FILE_PATH/ .

# Remove backup folder
rm -rf $BACKUP_FILE_PATH

But I can't connect to 1.2.3.4 due this option in /etc/mongodb.conf

bind_ip = 127.0.0.1

I know that I may to change the restriction above to bind_ip = 0.0.0.0 but it's not secure.

What is the best way to make secure connections to remote mongod server and backup files to another one with my bash script above?

P.S: I run the script above such as the following:

sudo sh /scripts/tokumx_backup_script

How about using an SSH tunnel? (using the ssh command with the -L switch). — nagylzs, Apr 19 '15 at 15:32
I could, but it is documented everywhere. For example: http://blog.trackets.com/2014/05/17/ssh-tunnel-local-and-remote-port-forwarding-explained-with-examples.html The main point is that you connect from the backup machine to the live machine using SSH. You add " -L 127.0.0.1:xxx:127.0.0.1:27017 " parameters to the ssh command. Then you can connect to XXX port on the backup machine and access your mongodb server as if it were listening locally.I would recommend to read ssh documentation because it is really well documented and you can find many examples on the net. — nagylzs, Apr 19 '15 at 15:41
I run my bash script like the following `sudo sh /scripts/tokumx_backup_script` so how could I change it to work over ssh? — Erik, Apr 19 '15 at 15:44
You need to run ssh in the background, because it blocks execution. Let's suppose you can connect from backup to live this way: " ssh user01@live ". Then you should run something like this: " ssh -nNT -L 11111:127.0.0.1:27017 user01@live ". While this command is running, you can connect to port 11111 locally. To run this in the background, use " ssh .... &". And the kill it afterwards. — nagylzs, Apr 19 '15 at 15:48
Yes, but it won't fit into a comment. I'm writting an answer sortly. — nagylzs, Apr 19 '15 at 15:52

nagylzs · Accepted Answer · 2015-04-21T05:27:53.870

On live machine:

make sure ssh server is running
create a user dedicated for tunneling. Alternatively, select an existing user. In this example, I'll use the user "test".

Login as test, and do this:

test@gw:~ % ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/home/test/.ssh/id_rsa):
Created directory '/home/test/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/test/.ssh/id_rsa.
Your public key has been saved in /home/test/.ssh/id_rsa.pub.
The key fingerprint is:
02:90:f6:e9:d6:52:32:91:dd:bb:6a:11:7c:58:8c:d5 test@gw.sznet
The key's randomart image is:
+--[ RSA 2048]----+
|  .. o =..       |
|  o.o o + E      |
| . ..+ o .       |
|    =.= o        |
|   . =.oS.       |
|    + o..        |
|   . . o         |
|      o          |
|     .           |
+-----------------+
test@gw:~ %
test@gw:~ % cd .ssh
test@gw:~/.ssh % ls
id_rsa          id_rsa.pub
test@gw:~/.ssh % chmod 600 *
test@gw:~/.ssh % mv id_rsa.pub authorized_keys
test@gw:~/.ssh % cd ..
test@gw:~ % chmod 700 .ssh

Then copy the file ~test/.ssh/id_rsa (from live server) to the file ~backupuser/.ssh/id_rsa_live.pem on the backup server.

Next step: login as backupuser on backup machine, cd to .ssh directory and create (or append to) the file "~backupuser/.ssh/config" and enter this:

host live
    hostname 1.2.3.4 # your live IP here!
    identifyfile /home/backupuser/.ssh/id_rsa_live.pem # your pem file, copied from the live server in the previous step
    protocol 2
    port 22 # port number of your ssh server on the live server, usually 22

After this, you should be able to connect from the backup server to the live server without entering a password:

ssh test@live

Please test this first. Make sure that you can login without giving a password.

At this point, you have the option to copy from live to backup with the scp command:

scp test@live:/some/path/on/live/server /some/path/on/local/backup/machine

So you could create a backup on the live server and then save it locally on the backup server. You can also send shell commands this way:

ssh test@live -c " some command to execute on the live server with the test user "

Finally, if you still isinst on running the backup on the backup server, you can create a new tunnel with this command:

ssh -nNT -L 12345:127.0.0.1:27017 &

and then you can use 127.0.0.1:12345 for backing up. But please be aware that the tunnel will run in the background, so you will have to find a way to stop it.

I've found the following snippet http://www.ntosic.net/2014/05/backup-mongo-database-from-remote-server-bash-script/ and there is no any `-L` option. What's focus? — Erik, Apr 19 '15 at 16:36
It backs up the database on the remote server, then copies it with scp. — nagylzs, Apr 19 '15 at 16:46
-n redirects stin from /dev/null, prevents reading from stdin. -N means: do not execute a remote command. -T means "disable pseudo-tty allocation". You should REALLY read ssh documentation. Just type in "man ssh". — nagylzs, Apr 21 '15 at 05:12
ps, there is a typo in this answer - identifyfile should be identityfile — Andy Lorenz, Jun 18 '20 at 09:53

How to secure mongodump to make backup from remote machine?

1 Answers1