Install MongoDB on Ubuntu and Debian: repository, mongosh and authentication

Short answer: add MongoDB’s own APT repository, then run sudo apt install mongodb-org, sudo systemctl enable --now mongod and connect with mongosh. As of October 2026 the current release is MongoDB 9.0, supported on Ubuntu 22.04, 24.04 and 26.04 and on Debian 13; Debian 12 gets MongoDB 8.0. Create an admin user and enable authentication before allowing any remote access.

sudo apt-get install -y gnupg curl
curl -fsSL https://pgp.mongodb.com/server-9.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-9.gpg --dearmor
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-9.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/9.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-9.0.list
sudo apt-get update
sudo apt-get install -y mongodb-org
sudo systemctl enable --now mongod
mongosh

The commands follow MongoDB’s installation pages for Community Edition 9.0 and 8.0 and its platform support table, all read on 21 October 2026. Nothing was installed for this article; the AVX check below was run on a Debian 12 server.

Which MongoDB version for which release?

MongoDB 9.0.0 came out on 28 September 2026 (9.0.4 followed on 13 October). Each major version is built for a fixed list of distribution releases, and MongoDB treats anything else as unsupported, including a server later upgraded to a release that is not on the list:

Source: MongoDB’s “Supported Platforms for MongoDB Community” page, which also lists RHEL, Rocky and AlmaLinux 8, 9 and 10 for every current version. Check it again before you install, since new releases get added in patch versions (Ubuntu 26.04 arrived with 9.0.4). The mongodb package some older Ubuntu and Debian releases carried is not MongoDB’s own and conflicts with mongodb-org: remove it first if it is installed.

Before you install: CPU, memory and disk

• AVX: since MongoDB 5.0, mongod on x86_64 needs a CPU with the AVX instruction set. Without it, the server dies at start with an illegal-instruction error. On a virtual server, what counts is whether the hypervisor passes AVX through.
• 64-bit only: uname -m must say x86_64 or aarch64.
• Memory: the WiredTiger cache takes 50% of (RAM minus 1 GB) by default, at least 256 MB, and the filesystem cache uses what is left. A 4 GB server gives WiredTiger 1.5 GB. Plan 2 GB of RAM as a floor for anything beyond a test.
• Filesystem: MongoDB’s production notes strongly recommend XFS for data-bearing nodes with WiredTiger; ext4 works, and most VPS images use it.

Check all four from inside the server:

grep -o -m1 -w avx /proc/cpuinfo || echo "no AVX: MongoDB 5.0 or newer will not start"
uname -m
free -h
df -hT /var/lib

How do I install MongoDB on Ubuntu?

1. 1Import MongoDB's signing key

   sudo apt-get install -y gnupg curl
   curl -fsSL https://pgp.mongodb.com/server-9.asc | \
      sudo gpg -o /usr/share/keyrings/mongodb-server-9.gpg --dearmor

2. 2Add the repository for your release

   echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-9.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/9.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-9.0.list

   Not sure which codename you have? lsb_release -cs or grep VERSION_CODENAME /etc/os-release prints it.

3. 3Install

   sudo apt-get update
   sudo apt-get install -y mongodb-org

   mongodb-org is a metapackage: the server (mongod), the router mongos, the shell mongosh and the database tools (mongodump, mongorestore and friends). Updates then arrive with your normal apt upgrade, within the 9.0 series.

How do I install MongoDB on Debian 13 and 12?

The steps are the same; the key, codename and component differ. Debian 13 takes 9.0, Debian 12 stays on 8.0, which has its own key:

sudo apt-get install -y gnupg curl
curl -fsSL https://pgp.mongodb.com/server-9.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-9.gpg --dearmor
echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-9.gpg ] https://repo.mongodb.org/apt/debian trixie/mongodb-org/9.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-9.0.list
sudo apt-get update
sudo apt-get install -y mongodb-org

sudo apt-get install -y gnupg curl
curl -fsSL https://pgp.mongodb.com/server-8.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor
echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/8.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list
sudo apt-get update
sudo apt-get install -y mongodb-org

Pointing a Debian 12 server at the 9.0 repository with a trixie line “to get the newest” mixes packages built for another release. It may install, but it is unsupported. If you want 9.0 on Debian, start from Debian 13: for an existing Debian 12 server, the clean path is a new Debian 13 server and a move of the data with mongodump and mongorestore, after reading MongoDB’s upgrade notes for your version.

Start mongod and connect with mongosh

sudo systemctl enable --now mongod
sudo systemctl status mongod --no-pager
mongosh --quiet --eval 'db.runCommand({ ping: 1 })'
{ ok: 1 }

mongosh without options connects to mongodb://127.0.0.1:27017. On a fresh install it greets you with startup warnings, among them that access control is not enabled and every client has unrestricted access to data and configuration. That is the next thing to fix. If systemctl answers Failed to start mongod.service: Unit mongod.service not found, MongoDB’s documentation says to run sudo systemctl daemon-reload and start it again.

Turn on authentication

While authorization is still off, any local client can create users. Create the administrator first, then switch authorization on. (If you enable authorization first, MongoDB’s localhost exception still lets a client on the server itself create the first user in the admin database.)

1. 1Create the admin user

   use admin
   db.createUser({
     user: "admin",
     pwd: passwordPrompt(),
     roles: [
       { role: "userAdminAnyDatabase", db: "admin" },
       { role: "readWriteAnyDatabase", db: "admin" }
     ]
   })

   passwordPrompt() asks for the password instead of leaving it in your shell history. userAdminAnyDatabase manages users and roles everywhere; readWriteAnyDatabase lets the same account work with data, as in MongoDB’s own tutorial.

2. 2Enable authorization in /etc/mongod.conf

   net:
     port: 27017
     bindIp: 127.0.0.1
   
   security:
     authorization: enabled

   The file is YAML: indent with spaces, never tabs. The package ships #security: commented out; replace that line rather than adding a second security block.

3. 3Restart and log in as admin

   sudo systemctl restart mongod
   mongosh --authenticationDatabase admin -u admin -p

4. 4Give each application its own user

   use appdb
   db.createUser({
     user: "app",
     pwd: passwordPrompt(),
     roles: [ { role: "readWrite", db: "appdb" } ]
   })

   mongodb://app:PASSWORD@127.0.0.1:27017/appdb?authSource=appdb

   The user lives in the database where you created it, and authSource has to name that database. Getting it wrong is the usual cause of Authentication failed with a correct password. Special characters in the password must be percent-encoded in the URI.

Remote access without exposing port 27017

Keep bindIp at 127.0.0.1 unless another machine really has to connect. To work with the database from your own computer, in mongosh or Compass, an SSH tunnel is enough:

ssh -N -L 27018:127.0.0.1:27017 you@203.0.113.10

# second terminal
mongosh "mongodb://admin@127.0.0.1:27018/?authSource=admin"

If an application server elsewhere needs a direct connection, open the port to that one address and nothing else:

# /etc/mongod.conf: add the server's own address the app connects to
net:
  bindIp: 127.0.0.1,203.0.113.10

# then
sudo systemctl restart mongod
sudo ufw allow from 198.51.100.7 to any port 27017 proto tcp

That assumes ufw is active with incoming traffic denied by default, as set up in the ufw guide. Over the public internet, also turn on TLS (net.tls.mode: requireTLS with a certificate) so passwords and data do not travel in clear text.

Memory on a small VPS

The default cache formula assumes MongoDB has the machine to itself. When the application runs on the same server, cap the cache so both fit:

storage:
  dbPath: /var/lib/mongodb
  wiredTiger:
    engineConfig:
      cacheSizeGB: 0.5

Restart mongod afterwards. MongoDB’s production notes also suggest vm.swappiness at 1 (or 0 on a server that runs nothing but MongoDB) and warn that a ulimit for open files under 64,000 produces a startup warning; the packaged systemd unit sets its own limits, so the warning mostly appears when mongod is started by hand. If the kernel has killed mongod for lack of memory, a bigger plan or a smaller cache are the fixes; swap only buys time.

Run MongoDB in Docker instead

A container avoids the repository setup and pins the version per project. Publish the port on localhost only: Docker’s published ports bypass ufw, so -p 27017:27017 puts the database on the internet whatever your firewall says.

docker run -d --name mongo --restart unless-stopped \
  -e MONGO_INITDB_ROOT_USERNAME=admin \
  -e MONGO_INITDB_ROOT_PASSWORD=change-me \
  -v mongodata:/data/db \
  -p 127.0.0.1:27017:27017 \
  mongo:8.0

docker exec -it mongo mongosh -u admin -p --authenticationDatabase admin

The two MONGO_INITDB_ROOT_* variables create a root user on the first start and switch authentication on. Pin a major-version tag your application is tested with rather than latest, and check the image’s tag list before you move to 9.0. The AVX requirement applies inside containers too. Docker itself is set up in installing Docker on Ubuntu and Debian.

Back up with mongodump

mongodump --uri "mongodb://admin@127.0.0.1:27017/?authSource=admin" \
  --gzip --archive=/var/backups/mongo-$(date +%F).gz

mongorestore --uri "mongodb://admin@127.0.0.1:27017/?authSource=admin" \
  --gzip --archive=/var/backups/mongo-2026-10-22.gz

Both tools come with mongodb-org. Without a password in the URI they prompt for one, which suits manual runs; for a nightly job from cron, keep the credentials in a file only root can read. Copy the archives off the server, and restore one into a test instance now and then.

Common installation errors

For the APT errors in more depth, see GPG error: NO_PUBKEY and Unable to locate package.

A note on the licence

MongoDB Community Server is published under the Server Side Public License (SSPL), which is not an OSI-approved open-source licence; it matters mainly if you plan to offer MongoDB itself as a service to others.

Running it on a VPS

A Linux VPS with root access is all MongoDB needs. Our newest Ubuntu image (24.04 LTS) and Debian image (13) are both on MongoDB 9.0’s supported list, so the steps above apply as written; run the AVX check first, as on any server. Size the plan by memory: the working set of your data plus the cache formula above decides more than CPU cores do.

Frequently asked