I using aws linux freetier

When I entered my site today, mongodb all collection was drop... OTL

(I checked the global log and confirmed that the Chinese ip dropped...)

When I installed mongodb, my /etc/mongod.conf setting

# network interfaces
  port: change my port num
    authorization: enabled

next i was aws security group open and write my port num and anywhere setting

Is this a problem? What should I add more? Please teach me

  • After enabling authorization, did you create the super user? (and then other users) – JJussi Aug 22 '17 at 17:04
  • 1
    The MongoDB Security Checklist in the manual provides a list of security measures you can take. – Stennie Aug 22 '17 at 22:06
  • yes! i made adminuser and dbuser @@JJussi – young Aug 23 '17 at 2:27

Here is a few things to read up upon: https://docs.mongodb.com/manual/administration/security-checklist/

In your mongo.conf its good to disable the REST API and http interface.

Use a non default Mongo port e.g not 27017 and use AWS security groups to only allow that port to a given IP not to the world.

|improve this answer|||||
  • hi @ollieB I'm sorry, can you please explain it more easily? i don't know mongo,conf rest api and http interface and port ip(mean my ip? or anywhere?) but i'm not use 27017 – young Aug 23 '17 at 14:45
  • FYI, the REST API and HTTP interfaces are disabled by default in MongoDB 2.6+ and deprecated since MongoDB 3.2. Definitely recommended not to enable either of these options (especially for a production deployment). – Stennie Aug 24 '17 at 1:20
  • I agree but I have seen people in the past with little knowledge of Mongo enable things such as the HTTP interface because it looks nice. – OllieB Aug 24 '17 at 15:53
  • Also please can you link me to a piece of literature which that states that the REST API is deprecated? – OllieB Aug 24 '17 at 15:56
  • @OllieB REST/HTTP interface deprecation is mentioned in the MongoDB manual, including the Security Checklist you suggested. For more information see MongoDB Configuration Hardening. These interfaces should never be enabled on a production deployment (or really, any deployment). There are more secure (and feature rich) admin UIs available for RESTful interaction and monitoring. – Stennie Sep 1 '17 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.