how to disable access to mongo shell to anonymous users?
There is no access control enabled with MongoDB by default, so this is something you'll need to configure separately. Fortunately, it's not too difficult thanks to the well-written MongoDB Manual.
Here is the gist:

Start MongoDB without access control (which I believe you've already done)
Connect to the instance (which you've stated you've already done)
Create an administrator account:
use admin
db.createUser(
  {
    user: &quot;adminny&quot;,
    pwd: &quot;superSecretPassword!123&quot;,
    roles: [ { role: &quot;dbOwner&quot;, db: &quot;admin&quot; } ]
  }
)


Re-start the MongoDB instance with access control.
mongod --auth --port 27017 --dbpath /data/db1

Note the --auth option in the startup.
Authenticate as the admin account:
mongo --port 27017 -u &quot;adminny&quot; -p &quot;superSecretPassword!123&quot; --authenticationDatabase &quot;admin&quot;



Important Note About Roles
There are several roles that are available, and choosing the wrong one can result in unnecessary frustration.




Role
Detail




root
This would be a root-level role, allowing the creation of user accounts, databases, and all administration-level actions one might need to do.


dbAdmin
Provides the ability to perform administrative tasks such as schema-related tasks, indexing, and gathering statistics. This role does not grant privileges for user and role management.


dbOwner
The database owner can perform any administrative action on the database. This role combines the privileges granted by the readWrite, dbAdmin and userAdmin roles.


userAdmin
Provides the ability to create and modify roles and users on the current database. Since the userAdmin role allows users to grant any privilege to any user, including themselves, the role also indirectly provides superuser access to either the database or, if scoped to the admin database, the cluster.


userAdminAnyDatabase
Provides the same access to user administration operations as userAdmin on all databases except local and config.


readWrite
Provides all the privileges of the read role plus ability to modify data on all non-system collections and the system.js collection.




You can read more about each of the Built-In Roles in the MongoDB Manual, which is very approachable.