If to run mongo with authorization (i.e mongod --auth) it still allows to connect using client mongo and get to mongo cli where one will get refused to execute any command.

But I wonder if it is possible to close such connection for the unauthenticated user so one does not see mongo cli at all?


A new connection to MongoDB has two key aspects:

  1. establishing a connection
  2. authenticating the connection

As at MongoDB 3.4, the source IPs that are able to establish a connection are determined by your firewall settings. There is also a bindIp setting for MongoDB which determines which network interface(s) mongod listens to.

Once a connection is established, access control and authentication is managed by your MongoDB configuration.

In your example, you are able to connect via the mongo shell because the source IP is not blocked by firewall configuration. Assuming access control is enabled and authentication has been properly configured, establishing a connection to MongoDB does not provide any access to data.

For more information on best practices, see the MongoDB Security Checklist.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.