Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As long as my mongo port is not accessible to the outside world and only available locally, can I go about without securing my database with a username and password?

share|improve this question

4 Answers 4

Yes, lots of people run Mongo this way.

Authentication does have one useful feature, though, it makes it a bit harder to accidentally do something destructive from the shell when you think you're connected elsewhere. We tend to have different usernames/passwords on development and production DBs, and you have to jump through some level of hoops to get connected to a production Mongo.

share|improve this answer

Yes you can but I wouldn't do that.
Sure, there is no imminent threat but having proper permissions setup adds another layer of security.

There is always the possibility you accidentally expose the port in the future (e.g. shut down firewall to debug a connectivity problem).
Also if another service gets compromised on the same server or a server behind your firewall, then the data in MongoDB is practically also compromised - or could be very easily.

share|improve this answer

Preventing unauthorized access to a database is not the responsibility of a DBMS. Proper firewall rules, VLANs, etc do much more for security than a username and password, which have to be distributed to your application servers anyway.

share|improve this answer

Why not do both? Defense in depth is a good strategy. Use Cloud firewalls (E.g. EC2 security groups) or OS firewalls to restrict access to your Mongo instances. You can still have auth enabled to challenge in case there is ever a problem with your firewall configuration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.