How to make a secure MongoDB server?

Question

I'm wanting my website to use MongoDB as it's datastore. I've used MongoDB in my development environment with no worries, but I'm worried about security with a public server.

My server is a VPS running Arch Linux. The web application will also be running on it, so it only needs to accept connections from localhost. And no other users(by ssh or otherwise) will have direct access to my server.

What should I do to secure my instance of MongoDB?

Answer 1

Mongo supports only very basic security:

• configuring authentication. Create user with strong password(one username and password in the database context)
• bind MongoDB to 127.0.0.0(the loopback interface)
• change default port

Answer 2

Security and Authentication MongoDB documentation.

Answer 3

same query has been well discussed here ~ http://security.stackexchange.com/questions/7610/how-to-secure-a-mongodb-instance/7655#7655

Few very initial things to remember are:

Remove IP Binding from all to just the IP (private or localhost), you expect to get Connection Request
Change the default Port Bindings
Give only required permissions (like no update/delete permissions to select query users)
Setup ssh keys for required master-slave connection, removing involvement of passwords
You can even setup an encrypted tunnel for connection between your application and mongodb

actually they are applicable on all DataStorage Services

PS: very limited mongodb experience