Install MongoDB on Linux

MongoDB's official packages are not in default distribution repositories, so you must add MongoDB's own repo before installing. This guide covers adding the repo on Debian/Ubuntu and Fedora/RHEL-family systems, locking the service under systemd, enabling authentication, and bootstrapping a single-node replica set — a prerequisite for transactions and many production deployments.

Add the MongoDB Repository

Debian / Ubuntu

MongoDB 7.0 targets Ubuntu 22.04 LTS (Jammy) and Debian 12 (Bookworm). Adjust the codename if you are on a different release.

sudo apt install -y gnupg curl

curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc \
  | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg

# Ubuntu 22.04
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] \
https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" \
  | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list

sudo apt update && sudo apt install -y mongodb-org

Pin the packages so an unattended apt upgrade does not jump major versions:

echo "mongodb-org hold" | sudo dpkg --set-selections
echo "mongodb-org-database hold" | sudo dpkg --set-selections
echo "mongodb-org-server hold" | sudo dpkg --set-selections
echo "mongosh hold" | sudo dpkg --set-selections
echo "mongodb-org-mongos hold" | sudo dpkg --set-selections
echo "mongodb-org-tools hold" | sudo dpkg --set-selections

Fedora / RHEL / Rocky / AlmaLinux

sudo tee /etc/yum.repos.d/mongodb-org-7.0.repo <<'EOF'
[mongodb-org-7.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/7.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-7.0.asc
EOF

sudo dnf install -y mongodb-org

On RHEL/Rocky 9 you may need to allow the mongod binary through SELinux or set the appropriate context; see the troubleshooting section below.

Enable and Start mongod

sudo systemctl enable --now mongod

sudo systemctl status mongod

You should see active (running). The service unit file ships with the package and already sets Restart=on-failure, so mongod recovers from crashes without extra configuration.

Configure mongod.conf

The main config file is /etc/mongod.conf (YAML). Key sections to review before enabling auth:

sudo nano /etc/mongod.conf

Relevant defaults and what to change:

• net.bindIp — defaults to 127.0.0.1. Add your server's private IP if remote drivers need access: bindIp: 127.0.0.1,10.0.0.5.
• net.port — default 27017. Change if you need a non-standard port.
• storage.dbPath — default /var/lib/mongodb. Move to a dedicated volume on production systems.
• systemLog.path — default /var/log/mongodb/mongod.log.

After any config edit, reload the service:

sudo systemctl restart mongod

Enable Authentication

MongoDB ships with auth disabled. Enable it in two steps: create an admin user first, then turn on auth.

Step 1 — Create the admin user

Connect to the local instance without auth:

mongosh

use admin
db.createUser({
  user: "mongoadmin",
  pwd: passwordPrompt(),
  roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
})

Type exit when done.

Step 2 — Turn on auth in mongod.conf

Add or uncomment the security section:

sudo tee -a /etc/mongod.conf <<'EOF'

security:
  authorization: enabled
EOF

sudo systemctl restart mongod

Verify the restriction is active — this should now fail:

mongosh --eval "db.adminCommand({ listDatabases: 1 })"

And this should succeed:

mongosh -u mongoadmin -p --authenticationDatabase admin \
  --eval "db.adminCommand({ listDatabases: 1 })"

Configure a Single-Node Replica Set

Many features — multi-document transactions, change streams, most Atlas-compatible tooling — require a replica set even on a single node. This is a minimal but production-valid configuration.

Step 1 — Declare the replica set name

In /etc/mongod.conf, add or uncomment:

sudo tee -a /etc/mongod.conf <<'EOF'

replication:
  replSetName: "rs0"
EOF

sudo systemctl restart mongod

Step 2 — Initiate the replica set

mongosh -u mongoadmin -p --authenticationDatabase admin

rs.initiate({
  _id: "rs0",
  members: [ { _id: 0, host: "127.0.0.1:27017" } ]
})

The shell prompt changes to rs0 [direct: primary] after a few seconds. Confirm with:

rs.status()

Look for "stateStr" : "PRIMARY" in the output. Your single node now functions as the primary of a one-member replica set. Adding secondary members later is a straightforward rs.add() call.

Open the Firewall

Only expose port 27017 to trusted hosts. Using ufw on Ubuntu:

sudo ufw allow from 10.0.0.0/24 to any port 27017

Using firewalld on Fedora/RHEL:

sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family=ipv4 source address=10.0.0.0/24 port port=27017 protocol=tcp accept'
sudo firewall-cmd --reload

Never open 27017 to 0.0.0.0/0 on a public interface without TLS enabled.

Verify the Full Stack

mongosh -u mongoadmin -p --authenticationDatabase admin --eval "
  print('Replica set state:', rs.status().myState);
  print('Auth enabled:', db.adminCommand({getCmdLineOpts:1}).parsed.security);
"

Expected output (will vary):

# Replica set state: 1
# Auth enabled: { authorization: 'enabled' }

Troubleshooting

• mongod fails to start on RHEL/Rocky 9 — SELinux may block data directory access. Run sudo ausearch -c 'mongod' --raw | sudo audit2allow -M mymongod && sudo semodule -X 300 -i mymongod.pp, or set the correct context with sudo chcon -Rv -u system_u -t mongod_var_lib_t /var/lib/mongodb.
• "command listDatabases requires authentication" — expected after enabling auth. Connect with -u and -p flags as shown above.
• rs.initiate() returns "already initialized" — run rs.status() to confirm state; re-initiating a running replica set requires rs.reconfig() instead.
• mongod won't bind to a new IP — check that the IP actually exists on an interface (ip addr) and that you restarted mongod after the config change.
• Journal or lock file errors on restart — indicates an unclean shutdown. Run sudo -u mongodb mongod --repair --dbpath /var/lib/mongodb, then start the service normally.