## Procedure 

Step 1: Create a key file. Create the key file your deployment will use to authenticate servers to each other. To generate pseudo-random data to use for a keyfile , issue the following openssl command: 

openssl rand -base64 741 > mongodb-keyfile chmod 600 mongodb-keyfile 

You may generate a key file using any method you choose. Always ensure that the password stored in the key file is both long and contains a high amount of entropy. Using openssl in this manner helps generate such a key. 

Step 2: Specify the key file when starting a MongoDB instance. Specify the path to the key file with the keyFile option. 

## Troubleshoot Kerberos Authentication on Linux 

New in version 2.4. 

## Kerberos Configuration Checklist 

If you have difficulty starting mongod or mongos with Kerberos (page 331) on Linux systems, ensure that: 

• The mongod and the mongos binaries are from MongoDB Enterprise. 

To verify MongoDB Enterprise binaries: 

mongod --version 

In the output from this command, look for the string modules: subscription or modules: enterprise to confirm your system has MongoDB Enterprise. 

• You are not using the HTTP Console$^{66}$. MongoDB Enterprise does not support Kerberos authentication over the HTTP Console interface. 

• Either the service principal name (SPN) in the keytab file (page 332) matches the SPN for the mongod or mongos instance, or the mongod or the mongos instance use the --setParameter saslHostName=<host name> to match the name in the keytab file. 

• The canonical system hostname of the system that runs the mongod or mongos instance is a resolvable, fully qualified domain for this host. You can test the system hostname resolution with the hostname -f command at the system prompt. 

• Each host that runs a mongod or mongos instance has both the A and PTR DNS records to provide forward and reverse lookup. The records allow the host to resolve the components of the Kerberos infrastructure. 

• Both the Kerberos Key Distribution Center (KDC) and the system running mongod instance or mongos must be able to resolve each other using DNS. By default, Kerberos attempts to resolve hosts using the content of the /etc/kerb5.conf before using DNS to resolve hosts. 

• The time synchronization of the systems running mongod or the mongos instances and the Kerberos infras- tructure are within the maximum time skew (default is 5 minutes) of each other. Time differences greater than the maximum time skew will prevent successful authentication. 

