Hacker News Reader

Comment by kennysmoothx | Hacker News Reader

Does anyone know of a "security checklist" one could follow for mongodb?

I have not used mongodb in any production environment but it would be nice to know what one should do to make it secure.

View on HN

I don't use MongoDB but other, generic recommendations apply and would likely go a long way towards preventing this:

- deny (all) incoming traffic by default

- permit only desired traffic (to specific ports) from specific hosts

- avoid binding (listening) to interfaces you don't need to

- set up / verify authentication is in place

In addition to the link to the security manual that cpolis posted, there's also a MongoDB Security Checklist [0].

[0]: https://docs.mongodb.com/manual/administration/security-chec...

Thanks! I appreciate your recommendations!

"Does anyone know of a "security checklist" one could follow for mongodb?"

Firewall, on the local machine ALL ports except for the ones that you expect to be accessed remotely.

This is for all hosts - even your laptop. Never mind mongo.

There is no reason at all to leave inbound ports open for requests you don't expect to service.

Further, and I know this makes peoples heads spin and they foam at the mouth, but for ports you do need open, but don't serve the public (ssh, for instance) set up a port knock. Now it's invisible and you don't care about the 0day for that service.[1]

[1] Stop. Take a deep breath. Re-read the above post and realize that I did not say to remove your login passwords and keys and rely on only the port knock for security. Take another deep breath. It's going to be OK.

https://docs.mongodb.com/manual/security/ is a good start(not being glib).

Awesome! Thanks for the heads up

https://docs.mongodb.com/manual/administration/security-chec...

The trick is to never assume that anything you're running is secure. Because nothing ever is these days.

So the usual rules apply: (1) have a firewall with only the bare minimum ports open, (2) make sure everything you are running is on unusual ports especially SSH, (3) VPN, jump hosts or port knocking if you need remote access, (4) use something like Fail2Ban or Sentry.

Only allow SSH login using keys, never passwords.

The unusual ports thing is just a total waste of time. If someone wants in they are not going to brute force your ssh password over the network unless you've use stupidly simple passwords. They might get a targeted attack via reused passwords, which an unusual port won't stop either. If you can't control that then use 2FA or force use of ssh keys.

True, but it doesn't stop people (and worms) from trying endlessly and filling you logs with tons of rubbish that makes it hard to spot the real threats.

Fail2Ban helps there.

There's a helpful post here http://tgrall.github.io/blog/2015/02/04/introduction-to-mong...

Step 1: Uninstall mongo

Step 2: Spend thousands of dollars / hundreds of hours rewriting your entire app just because you didn't think to have a firewall on your server.

But seriously thank you for that stellar contribution.

Reply on news.ycombinator.com