only allow internal user with --keyFile option SERVER-3666

Author: kchodorow

db/cmdline.cpp

@@ -272,8 +272,12 @@ namespace mongo {
                 dbexit(EXIT_BADOPTIONS);
             }
 
+            cmdLine.keyFile = true;
             noauth = false;
         }
+        else {
+            cmdLine.keyFile = false;
+        }
 
 
         {

db/cmdline.h

@@ -100,6 +100,8 @@ namespace mongo {
 
         string socket;         // UNIX domain socket directory
 
+        bool keyFile;
+
         static void addGlobalOptions( boost::program_options::options_description& general ,
                                       boost::program_options::options_description& hidden );
 

db/security_commands.cpp

@@ -139,6 +139,7 @@ namespace mongo {
             string pwd;
 
             if (user == internalSecurity.user) {
+                uassert(15889, "key file must be used to log in with internal user", cmdLine.keyFile);
                 pwd = internalSecurity.pwd;
             }
             else {