5 ms·
Does anyone know of a "security checklist" one could follow for mongodb? I have not used mongodb in any production environment but it would be nice to know wha
by kennysmoothx 10y ago
Does anyone know of a "security checklist" one could follow for mongodb?
I have not used mongodb in any production environment but it would be nice to know what one should do to make it secure.
- cpolis 10y agohttps://docs.mongodb.com/manual/security/ https://docs.mongodb.com/manual/security/ is a good start(not being glib).
- kennysmoothx 10y agoAwesome! Thanks for the heads up https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec...
- jlgaddis 10y agoI don't use MongoDB but other, generic recommendations apply and would likely go a long way towards preventing this: - deny (all) incoming traffic by default - permit only desired traffic (to specific ports) from specific hosts - avoid binding (listening) to interfaces you don't need to - set up / verify authentication is in place In addition to the link to the security manual that cpolis posted, there's also a MongoDB Security Checklist [0]. [0]: https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec...
- kennysmoothx 10y agoThanks! I appreciate your recommendations!
- elchief 10y agoStep 1: Uninstall mongo
- threeseed 10y agoStep 2: Spend thousands of dollars / hundreds of hours rewriting your entire app just because you didn't think to have a firewall on your server. But seriously thank you for that stellar contribution.
- threeseed 10y agoThe trick is to never assume that anything you're running is secure. Because nothing ever is these days. So the usual rules apply: (1) have a firewall with only the bare minimum ports open, (2) make sure everything you are running is on unusual ports especially SSH, (3) VPN, jump hosts or port knocking if you need remote access, (4) use something like Fail2Ban or Sentry.
- semi-extrinsic 10y agoOnly allow SSH login using keys, never passwords.
- angry_octet 10y agoThe unusual ports thing is just a total waste of time. If someone wants in they are not going to brute force your ssh password over the network unless you've use stupidly simple passwords. They might get a targeted attack via reused passwords, which an unusual port won't stop either. If you can't control that then use 2FA or force use of ssh keys.
- rsync 10y ago"Does anyone know of a "security checklist" one could follow for mongodb?" Firewall, on the local machine ALL ports except for the ones that you expect to be accessed remotely. This is for all hosts - even your laptop. Never mind mongo. There is no reason at all to leave inbound ports open for requests you don't expect to service. Further, and I know this makes peoples heads spin and they foam at the mouth, but for ports you do need open, but don't serve the public (ssh, for instance) set up a port knock. Now it's invisible and you don't care about the 0day for that service.[1] [1] Stop. Take a deep breath. Re-read the above post and realize that I did not say to remove your login passwords and keys and rely on only the port knock for security. Take another deep breath. It's going to be OK.
- astonex 10y agoThere's a helpful post here http://tgrall.github.io/blog/2015/02/04/introduction-to-mongodb-security/ http://tgrall.github.io/blog/2015/02/04/introduction-to-mong...