Introduction
MongoDB is a leading NoSQL database platform designed for building scalable, high-performance applications. Its flexible document model and distributed architecture make it ideal for modern workloads ranging from web applications to real-time analytics. MongoDB Enterprise Edition extends the community version with advanced security features, management tools, and enterprise-grade support—critical requirements for production deployments.
On IBM Power systems running Red Hat Enterprise Linux 9 (ppc64le architecture), deploying MongoDB requires specific configuration steps due to platform-specific package availability and security requirements. This tutorial provides a practical, step-by-step guide to installing MongoDB Enterprise Edition 8 on RHEL 9 and securing it with TLS encryption.
What this tutorial covers:
- Installing MongoDB Enterprise Edition 8 on RHEL 9 (ppc64le)
- Configuring the MongoDB repository and installing packages
- Setting up the mongosh client shell
- Securing MongoDB with TLS/SSL encryption
- Verifying secure client connections
By the end of this tutorial, you'll have a production-ready MongoDB deployment with encrypted communication on IBM Power.
Prerequisites
Before starting, ensure your environment meets these requirements:
- Operating System: Red Hat Enterprise Linux 9 on IBM Power architecture (ppc64le)
- Access Level: Root or sudo privileges
- Network: Internet connectivity to access MongoDB and system repositories
- Tools: OpenSSL installed (for TLS certificate generation)
- Storage: Sufficient disk space for MongoDB binaries and database files (minimum 10GB recommended)
- License: Valid MongoDB Enterprise Edition license
Verify your system architecture:
uname -m # Should output: ppc64le
cat /etc/redhat-release # Should show RHEL 9.x
Step 1: Install MongoDB Enterprise Edition 8 on RHEL 9
1. Configure the MongoDB Enterprise Repository
Create the MongoDB repository configuration file:
sudo vi /etc/yum.repos.d/mongodb-enterprise-8.0.repo
Add the following content:
[mongodb-enterprise-8.0]
name=MongoDB Enterprise Repository
baseurl=https://repo.mongodb.com/yum/redhat/9/mongodb-enterprise/8.0/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://pgp.mongodb.com/server-8.0.asc
Save and exit the file.
Refresh cache
sudo dnf clean all && dnf makecache
2. Install MongoDB Enterprise Packages
Important Note: On RHEL 9 ppc64le, the mongodb-mongosh package is not available in the repository. Install only the core MongoDB components:
sudo yum install -y \
mongodb-enterprise-database \
mongodb-enterprise-server \
mongodb-enterprise-mongos \
mongodb-enterprise-tools
Note: To install a specific version, append the version number to each package name (e.g., mongodb-enterprise-server-8.0.7). Replace the version number with what's available in your repository.
3. Install mongosh Client Shell
Since mongosh is not available via yum on RHEL 9 ppc64le, download and install it manually:
# Create directory for MongoDB tools
mkdir -p ~/mongodb-tools
cd ~/mongodb-tools
# Download mongosh for ppc64le
wget https://downloads.mongodb.com/compass/mongosh-2.8.3-linux-ppc64le.tgz
# Extract the archive
tar -xvzf mongosh-2.8.3-linux-ppc64le.tgz
# Create symbolic link for system-wide access
sudo ln -s ~/mongodb-tools/mongosh-2.8.3-linux-ppc64le/bin/mongosh /usr/local/bin/mongosh
# Verify installation
mongosh --version
2.8.3
4. Start and Verify MongoDB Service
Start the MongoDB service:
sudo systemctl start mongod
If the service fails to start with a "unit file not found" error, reload systemd and retry:
sudo systemctl daemon-reload
sudo systemctl restart mongod
Verify the service is running:
sudo systemctl status mongod
You should see active (running) in the output.
Troubleshooting: If MongoDB fails to start, check for stale socket files:
sudo rm -f /tmp/mongodb-*.sock
sudo systemctl restart mongod
You can view mongodb logs at /var/log/mongodb/mongod.log
5. Test Basic Connectivity
Connect to MongoDB using the shell:
Run these commands to verify the installation:
// Check MongoDB version
db.version()
// List databases
show dbs
// Create a test document
use testdb
db.testCollection.insertOne({ name: "test", timestamp: new Date() })
// Verify the insert
db.testCollection.find()
// Exit the shell
exit
If these commands execute successfully, MongoDB is installed and operational.
Step 2: Secure MongoDB with TLS Encryption
By default, MongoDB accepts unencrypted connections. For production environments, enabling TLS encryption is essential to protect data in transit.
1. Generate Server Certificate and Key
Create a self-signed certificate for the MongoDB server:
cd /etc/ssl
sudo openssl req -new -x509 -days 365 -out mongodb-server.crt -keyout mongodb-server.key
When prompted, enter the following information:
- PEM pass phrase: Choose a secure password (e.g., `mongo`)
- Country Name: IN
- State: KA
- Locality: BLR
- Organization: IBM
- Organizational Unit: SYS
- Common Name: Your server's FQDN (e.g., `ca-mongo1.fyre.ibm.com`)
- Email: Your email address
This creates two files:
- mongodb-server.crt (certificate)
- mongodb-server.key (private key)
2. Generate Client Certificate and Key
Create a certificate for MongoDB clients:
sudo openssl req -new -x509 -days 365 -out mongodb-client.crt -keyout mongodb-client.key
Use the same information as above, but you can use a different Common Name if desired (e.g., mongoClient).
This creates:
- mongodb-client.crt
- mongodb-client.key
3. Create PEM Files
MongoDB requires certificates in PEM format. Combine the certificate and key files:
# Create server PEM file
sudo bash -c 'cat mongodb-server.crt mongodb-server.key > /etc/ssl/mongodb-server.pem'
# Create client PEM file
sudo bash -c 'cat mongodb-client.crt mongodb-client.key > /etc/ssl/mongodb-client.pem'
# Verify files were created
ls -lh /etc/ssl/mongodb-*.pem
4. Update MongoDB Configuration
Edit the MongoDB configuration file:
Update the net section to enable TLS:
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb-server.pem
CAFile: /etc/ssl/mongodb-server.pem
certificateKeyFilePassword: mongo
allowInvalidCertificates: true
port: 27017
bindIp: 127.0.0.1,ca-mongo1.fyre.ibm.com # Server's FQDN
Configuration Notes:
- mode: requireTLS - Enforces TLS for all connections
- certificateKeyFile - Path to server certificate
- CAFile - Certificate Authority file (using self-signed cert)
- certificateKeyFilePassword - Password you set during certificate creation
- allowInvalidCertificates: true - Required for self-signed certificates
- bindIp - Replace ca-mongo1.fyre.ibm.com with your server's hostname
For remote client access, ensure the hostname in bindIp matches your server's FQDN or use bindIpAll: true to listen on all interfaces.
5. Restart MongoDB
Apply the configuration changes:
sudo systemctl stop mongod
sudo systemctl start mongod
sudo systemctl status mongod
Verify the service started successfully.
6. Verify TLS Enforcement
Test that unencrypted connections are now rejected:
This should fail with a connection error, confirming TLS is enforced.
7. Connect with TLS
Connect using the TLS-enabled client:
mongosh --tls \
--tlsAllowInvalidCertificates \
--tlsAllowInvalidHostnames \
--tlsCertificateKeyFile /etc/ssl/mongodb-client.pem \
--tlsCertificateKeyFilePassword mongo \
--host ca-mongo1.fyre.ibm.com
Connection Parameters Explained:
- --tls - Enable TLS connection
- --tlsAllowInvalidCertificates - Accept self-signed certificates
- --tlsAllowInvalidHostnames - Allow hostname mismatches
- --tlsCertificateKeyFile - Path to client certificate
- --tlsCertificateKeyFilePassword - Client certificate password
- --host - MongoDB server hostname
A successful connection confirms MongoDB is properly secured with TLS encryption.
Test the secure connection:
// Verify connection
db.serverStatus().host
// Create encrypted data
use securedb
db.users.insertOne({ username: "admin", role: "dba", created: new Date() })
// Query data
db.users.find()
3. Important Security Notes
For Production Environments:
1. Use CA-Signed Certificates: Replace self-signed certificates with certificates from a trusted Certificate Authority
2. Remove Development Flags: Do not use --tlsAllowInvalidCertificates or allowInvalidCertificates: true in production
3. Enable Authentication: Configure MongoDB user authentication and role-based access control