@@ -12,14 +12,13 @@ options in versions of MongoDB up to and including version 2.2.
1212
1313Some important things to note about authentication:
1414
15- Authentication is off by default.
15+ * Authentication is off by default.
16+ * Prior to version 2.0, it is not possible to enable authentication
17+ in a sharded environment.
1618
17- Prior to version 2.0, it is not possible to enable authentication
18- in a sharded environment.
19-
20- Once authenticated, a normal user has full "read and write" access
21- to the database. You can also create read-only users, who only
22- have read access.
19+ * Once authenticated, a normal user has full "read and write" access
20+ to the database. You can also create read-only users, who only
21+ have read access.
2322
2423Each database contains a "system.users" collection, which contains
2524all the user information. For example:
@@ -154,7 +153,7 @@ and you will still have ``write`` access:
154153
155154 test> db.auth("readOnly", "readOnly")
156155
157- test> db.coll.insert({foo:'bar'}) _[ still actually `` adminUser``]_
156+ test> db.coll.insert({foo:'bar'}) // still actually adminUser
158157 Inserted 1 record(s) in 1ms
159158
160159 test > db.coll.find()
@@ -216,7 +215,6 @@ database when running with authentication enabled:
216215 * - Connection
217216 - Admin Users Exist
218217 - Authentication Required on Accessing Database
219-
220218 * - Localhost
221219 - Yes
222220 - Yes
@@ -266,7 +264,7 @@ both Eve and Bob have accounts with “admin” access:
266264
267265Bob also has an account on the admin database and has used the same password:
268266
269- .. code-block::
267+ .. code-block:: javascript
270268
271269 test> use admin
272270 switched to db admin
@@ -276,10 +274,6 @@ Bob also has an account on the admin database and has used the same password:
276274 { "_id": ObjectId("50742045032a960d16f43950"), "user": "bob", "readOnly": false, "pwd": "ac2061b4a08ef8f2d60a07dc18ab4a0a" }
277275 Fetched 1 record(s) in 1ms -- Index[none] -- More[false]
278276
279- .. 3. Run the modified exploit code -
280-
281- .. todo:: ??
282-
283277Secure Mode on Shards and Replica Sets
284278--------------------------------------
285279
0 commit comments