0

I started receiving MongoDB Management Service emails today saying this: "Host is exposed to the public Internet". Apparently these checks are run on the 1st and 15th of the month, and today is the 1st. I looked here for more information but it didn't really help me.

I have my personal website running at andrewkoroluk.com. I am running an Express NodeJS server there, hooked up to port 80. In it, I use a MongoDB database for various data such as authentication, website data, files, etc. I have mongod always running. I am making an API that manipulates the data in my MongoDB database, but I doubt that that is what triggered these alerts.

Should I be worried about these alerts?

  • I don't suppose the fact that your web server is currently down could be related? – gparent Oct 1 '14 at 17:27
  • No, I'm in the middle of an update ;) – Andrew Koroluk Oct 1 '14 at 17:32
  • 2
    to be fair, your question should probably asked to the people providing the service and running the check rather than us, but I can't seem to reach the standard ports usually used by mongodb from my end. I would try connecting from the internet to your mongodb instance if it uses a non-standard port, and seeing if in fact your instance is accessible to the public internet. – gparent Oct 1 '14 at 17:34
  • How would I go about testing that? Just pinging the mongo port? (it uses the standard port) Or could I try running something like mongo-express locally and have it try to connect to my server? – Andrew Koroluk Oct 1 '14 at 18:46
  • 1
    You would confirm the port mongodb is currently using by checking its configuration, or using the netstat command as per usual. You would then use telnet to test the TCP connection. At this point we're getting quite closer to questions for Superuser though. – gparent Oct 1 '14 at 19:02
4

It's pretty simple: Your MongoDB server is potentially accessible from the public internet.

A quick check showed that it's none of your hosts with a DNS entry.

Please make sure that the MongoDB port isn't accessible from the public internet by using a firewall and/or binding MongoDB to a private IP. Furthermore, you should use keyfiles and user authentication.

Not the answer you're looking for? Browse other questions tagged or ask your own question.