3 ms·
Mongo for years defaulted to being open to the internet, with no authentication.
by Sebguer 5y ago
Mongo for years defaulted to being open to the internet, with no authentication.
- patrec 5y agoAnd it's probably the main reason MongoDB is a thing at all.
- gqewogpdqa 5y agoAs, surprisingly, did so many other databases and operating systems. VAX/VMS was "FIELD/SERVICE" on all new systems for many years.Then all these systems got connected to DECNet/BITNET, etc and all heck broke loose. No real excuse for anybody to have ever configured their systems this way.
- new_guy 5y agoWhen I learnt Mongo, that was literally the first thing I had to lookup because the docs didn't explain it, or even mention it was insecure. But once it was set up it gives you a login, and I realized it was completely public, anyone could just login there. It's a horrible default to have, but it's weird more people didn't realise how insecure it was.
- MaBeuLux88 5y agoThis doc page has been up for as long as I can remember: https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec.... It's also stated in the production notes: https://docs.mongodb.com/manual/administration/production-notes/#networking https://docs.mongodb.com/manual/administration/production-no....