For configuration settings that store credentials, you can either store the credentials in plain text or use the Ops Manager credentialstool to encrypt the credentials. If you choose to store credentials in plain text, reduce the permissions on the conf-mms.properties file on each server.
This procedure is valid only for SCRAM username and password authentication and (LDAP) PLAIN authentication. It doen't apply to MONGODB-X509 or GSSAPI authentication, both of which use usernames but not passwords.
Important
When installed with rpm or deb packages on Linux systems, the credentialstool tool requires root (sudo) privileges, because it reads the /etc/mongodb-mms/gen.key file. Ops Manager uses the gen.key to encrypt sensitive data in the database and configuration files.
Use the credentialstool to generate encrypted credentials for the MongoDB deployments:
Add the encrypted credentials to the conf-mms.properties file.
Enter the encrypted credential pair in the
mongo.mongoUrisettings where needed.Add the
mongo.encryptedCredentialssetting and set it totrue.Example
mongo.mongoUri=mongodb://da83ex3s:a4fbcf3a1@mydb1.example.net:40000/admin mongo.encryptedCredentials=true Important
The
conf-mms.propertiesfile can contain multiplemongo.mongoUrisettings. Ifmongo.encryptedCredentialsistrue, you must encrypt all user credentials found in the variousmongo.mongoUrisettings.