1

As long as my mongo port is not accessible to the outside world and only available locally, can I go about without securing my database with a username and password?

4 Answers 4

2

Yes, lots of people run Mongo this way.

Authentication does have one useful feature, though, it makes it a bit harder to accidentally do something destructive from the shell when you think you're connected elsewhere. We tend to have different usernames/passwords on development and production DBs, and you have to jump through some level of hoops to get connected to a production Mongo.

1

Yes you can but I wouldn't do that.
Sure, there is no imminent threat but having proper permissions setup adds another layer of security.

There is always the possibility you accidentally expose the port in the future (e.g. shut down firewall to debug a connectivity problem).
Also if another service gets compromised on the same server or a server behind your firewall, then the data in MongoDB is practically also compromised - or could be very easily.

0

Preventing unauthorized access to a database is not the responsibility of a DBMS. Proper firewall rules, VLANs, etc do much more for security than a username and password, which have to be distributed to your application servers anyway.

0

Why not do both? Defense in depth is a good strategy. Use Cloud firewalls (E.g. EC2 security groups) or OS firewalls to restrict access to your Mongo instances. You can still have auth enabled to challenge in case there is ever a problem with your firewall configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .