"Does anyone know of a "security checklist" one could follow for mongodb?" Firewall, on the local machine ALL ports except for the ones that you expect to be a

"Does anyone know of a "security checklist" one could follow for mongodb?" Firewall, on the local machine ALL ports except for the ones that you expect to be accessed remotely. This is for all hosts - even your laptop. Never mind mongo. There is no reason at all to leave inbound ports open for requests you don't expect to service. Further, and I know this makes peoples heads spin and they foam at the mouth, but for ports you do need open, but don't serve the public (ssh, for instance) set up a port knock. Now it's invisible and you don't care about the 0day for that service.[1] [1] Stop. Take a deep breath. Re-read the above post and realize that I did not say to remove your login passwords and keys and rely on only the port knock for security. Take another deep breath. It's going to be OK.