2

I have a MongoDB database installed and configured, but I have a very big problem regarding security.

I have enabled authentication and created a bunch of users, each with its own permissions, everything ok there, now my problem is that if a bad guy gets access to my server, he can simply restart the service without specifying the authentication parameter, and access all my databases just by logging in with the localhost.

In the documentation it says:

The localhost exception applies only when there are no users created in the MongoDB instance.

Well, I have already created users, and I am still able to access my database using the localhost exception. Am I doing anything wrong? Or is the documentation wrong? If so, this seems to be a major security problem.

The Mongo version I am using is 3.4.

These are the steps I followed to enable authentication:

  1. Joined Mongo without the --auth parameter
  2. Created an Admin User

     use admin
    
     var user = {
       "user" : "Admin",
       "pwd" : "1234",
       roles : [
         {
           "role" : "root",
           "db" : "admin"
         }
       ]}
    
     db.createUser(user);
    
  3. Restarted Mongo with the --auth parameter

  4. Created a database and some collections

    use TestDB
    db.createCollection( "TestCollection1" );
    db.createCollection( "TestCollection2" );
    
  5. Created a custom role:

    use TestDB
    
    db.runCommand({ createRole:"TestUserRole",
      privileges : [
         { "resource": {"db" : "TestDB", "collection" : "TestCollection1"}, "actions": ["insert", "update"] },
         { "resource": {"db" : "TestDB", "collection" : ""}, "actions": ["insert"] }
       ],
       "roles" : [ { role: "read", db: "TestDB" } ]
     })
    
  6. Created a regular user

    use TestDB
    
    var user = {
      "user" : "TestUser",
      "pwd" : "1234",
       roles : [
          {
              "role" : "TestUserRole",
              "db" : "TestDB"
          }
    ]}
    
    db.createUser(user);
    

After this, I can access Mongo with both users, with the Admin account I can find, insert, update and delete in both collections of the database TestDB. With the user TestUser, I can only see the database TestDB (can't see the System collections) and can only find, insert and update TestCollection1, and can only find and insert in TestCollection2.

This is the behaviour I want, all working fine. Now, if I restart Mongo without the --auth parameter, I shouldn't be able to connect to Mongo using the localhost exception because users are already created. Yet I am able to connect.

  • The tutorial for Enable Auth in the MongoDB manual has the steps for correctly enabling authentication. Extra details that would be helpful are the steps or output that suggest unauthenticated data access is still possible after you enabled auth. – Stennie Aug 31 '17 at 8:13
  • Posted the edit. Yes, that was the tutorial that I followed, I don't know if it is important, but I am using Mongo as a windows service. – lulas Aug 31 '17 at 8:40
4

Authentication only controls access to clients connecting to a MongoDB deployment. Securing remote access to your server or encrypting your data files are separate security measures.

If an attacker is able to gain access to a shell on your server and run privileged commands (like restarting the mongod service), access control is irrelevant. Similarly, even if your data files were encrypted an attacker with privileged access will be a major security problem.

As the administrator of a server, it is your responsibility to have appropriate access control, firewalls, auditing, and other security measures in place. Security involves multiple layers of defense, and access control is only a starting point. At a minimum you should also enable network encryption (TLS/SSL) and appropriately limit network exposure.

For a list of recommended security measures, see the MongoDB Security Checklist.

Now, if I restart Mongo without the --auth parameter, I shouldn't be able to connect to Mongo using the localhost exception.

If you restart MongoDB without the --auth parameter (or equivalent configuration file directive), you are explicitly disabling access control and allowing clients to connect without requiring authentication. This may be useful for administrative intervention, such as resetting a forgotten admin password.

  • Hmn, if that is the expected behaviour of Mongo DB the documentation is wrong, and in my opinion is a security problem. Are you sure that its the expected behaviour? – lulas Aug 31 '17 at 11:18
  • 1
    Access control is disabled by default as at MongoDB 3.4, so as per the Enable Auth tutorial you need to have access control enabled and authentication configured. Presence of authentication data does not automatically enable access control, so if a system administrator restarts MongoDB without enabling access control (or uses a backup of the data on another deployment without access control) is is expected that clients will be able to connect without auth. – Stennie Aug 31 '17 at 11:54
  • 1
    The localhost exception only enables creating the initial user when access control is enabled. Which documentation link(s) would you suggest improving? FYI, you can also provide feedback directly on docs pages (there's a green "Was this page helpful?" prompt in the bottom right corner leading to "fix this page") or add feedback in the DOCS project in MongoDB's Jira issue tracker. – Stennie Aug 31 '17 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.