8

I'm wanting my website to use MongoDB as it's datastore. I've used MongoDB in my development environment with no worries, but I'm worried about security with a public server.

My server is a VPS running Arch Linux. The web application will also be running on it, so it only needs to accept connections from localhost. And no other users(by ssh or otherwise) will have direct access to my server.

What should I do to secure my instance of MongoDB?

5 Answers 5

5

Mongo supports only very basic security:

  • configuring authentication. Create user with strong password(one username and password in the database context)
  • bind MongoDB to 127.0.0.0(the loopback interface)
  • change default port
4
  • If my server will not be accessed by users, then should I still configure the authentication?
    – Earlz
    Feb 20, 2011 at 5:27
  • Yes, because vps with website isn't trusted environment. Running Mongo without authentication only for development.
    – ooshro
    Feb 20, 2011 at 5:34
  • ok yea that makes sense in case my server is somehow compromised, minimize damage. I'll give this question a couple more hours to see if anyone else has any interesting input
    – Earlz
    Feb 20, 2011 at 5:35
  • I had to face the same problem and solved it with SSH tunneling. I followed this article.
    – Jabba
    Aug 8, 2016 at 15:03
14

Here is a good checklist

  1. Enable auth – Even if you have deployed your Mongodb servers in a trusted network it is good security practice to enable auth. It provides you “Defense in depth” if your network is compromised. Edit your mongod configuration file to enable auth

  2. Don’t expose your production db to the internet – Restricting physical access to your database is an important aspect of security. If it is not necessary do not expose your production database to the internet. In case of any compromise if an attacker cannot physically connect to your MongoDB server, your data is that much more secure. If you are on AWS you can place your db’s in a VPC private subnet. Read the blog post Deploying MongoDB in a VPC for more information.

  3. Use firewalls – Use firewalls to restrict which other entities are allowed to connect to your mongodb server. Best practice is to only allow your application servers access to the database. If you are hosted on AWS use ‘Security groups’ to restrict access. If you are hosted on a provider that does not support firewall constructs you can easily configure it yourself using ‘iptables’. Refer to the mongodb documentation to configure iptables for your scenario.

  4. Use key files to setup the replica set – Specify a shared key file to enable communication between your mongodb instances in a replica set. To enable this add the keyfile parameter to the config file as below. The contents of the file need to be the same on all the machines.

  5. Disable HTTP status interface Mongodb by default provides a http interface running by default on port 28017 which provides the “home” status page. This interface is not recommended for production use and is best disabled. Use the “nohttpinterface” configuration setting to disable the http interface.

  6. Disable the REST interface The monogdb REST interface is not recommended for production. It does not support any authentication. It is turned off by default. If you have turned it on using the “rest” configuration option you should turn it off for production systems.

  7. Configure Bind_ip If your system has multiple network interfaces you can use the “bind_ip” option to restrict your mongodb server to listen only on the interfaces that are relevant. By default mongodb will bind to all the interfaces

  8. Enable SSL – If you don’t use SSL your data is traveling between your Mongo client and Mongo server unencrypted and is susceptible to eavesdropping, tampering and “man in the middle” attacks. This is especially important if you are connecting to your Mongodb server over unsecure networks like the internet.

  9. Role based authorization – MongoDB supports role based authentication to give you fine grained control over the actions that can be performed by each user. Use role based constructs to restrict access instead of making all your users admins. Refer to the roles documentation for more details.

  10. Enterprise mongodb & Kerberos Enterprise mongodb integrates with Kerberos for authentication. Refer to the mongodb documentation for more details. Username/password systems are inherently insecure – use kerb based authentication if possible.

https://scalegrid.io/blog/10-tips-to-improve-your-mongodb-security/

Disclaimer: I am the founder of scalegrid.io

11

Security and Authentication MongoDB documentation.

2

same query has been well discussed here ~ https://security.stackexchange.com/questions/7610/how-to-secure-a-mongodb-instance/7655#7655

Few very initial things to remember are:

Remove IP Binding from all to just the IP (private or localhost), you expect to get Connection Request
Change the default Port Bindings
Give only required permissions (like no update/delete permissions to select query users)
Setup ssh keys for required master-slave connection, removing involvement of passwords
You can even setup an encrypted tunnel for connection between your application and mongodb

actually they are applicable on all DataStorage Services

PS: very limited mongodb experience

0

For security, it is better to prevent any external access to the MongoDB node. You could run the app and MongoDB on different nodes. The app node is accessible from outside, while, the MongoDB node only opens the MongoDB port to the app node.

Also follow the MongoDB official security checklist to protect MongoDB.

FireCamp automates it for you on Cloud, such as AWS. FireCamp enforces security. 1) The AppAccessSecurityGroup is the only one allowed to access MongoDB. Please create your application node on the AppAccessSecurityGroup, and the VPC that MongoDB node runs on. 2) A Bastion node is created and is the only one that could SSH to the MongoDB nodes. 3) MongoDB user authentication and access control between members of a ReplicaSet are enabled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .