I have a local Mongo database for which I have created users and authenticating through my code. But the authentication is only valid if mongo instance is run with "--auth" parameter. If mongod.exe is run without "--auth" param, the data can be accessible by any MongoDB GUI editor. Is there a way that I can prevent this unauthorized access to my database by preventing the running of mongod.exe instance without "--auth" parameter?

  • 1
    Usually mongod runs on a server and is started by an administrator/system account. If you run a MongoDB on your local PC as administrator then you can do whatever you like to do - it's your machine. – Wernfried Domscheit Jan 21 at 9:02
  • Mongodb supports enabling auth via a config file, but I don't know if that was already available back in 3.0. – CodesInChaos Jan 30 at 14:53
  • @CodesInChaos Enabling authentication via a config file has been an option as long as auth as been available (which is at least as far back as MongoDB 1.4 in 2010, maybe earlier). The authentication option only affects network access to a MongoDB deployment and does not encrypt or prevent access to the data files from outside the mongod process. Admin access to data files and service definitions needs to be restricted by security in the host environment. – Stennie Feb 1 at 7:04
  • @Stennie I read the OP as wanting to prevent accidentally running mongod without requiring authentication. – CodesInChaos Feb 6 at 21:56

You need to secure the administrative host environment to prevent someone from gaining access to reconfigure your MongoDB service or getting direct access to the data files or backups. Anyone who gains admin access has full control over the environment and services, so there should be multiple layers of protection and monitoring.

You can mitigate the risk of admin access or compromise using appropriate security measures like firewalls, intrusion detection systems, strong passwords, and following the Principle of least privilege when setting up user and service accounts.

MongoDB's data files are not encrypted at rest by default, but you could encrypt your files at rest using file system encryption or the Encrypted Storage Engine in MongoDB Enterprise 3.2+. However, you still have to properly secure admin access to your environment or a rogue admin will also have access to the keys to decrypt.

For general security measures I recommend reviewing the MongoDB Security Checklist.

I would also strongly recommend upgrading from 3.0.3 (released in May, 2015) to the final 3.0.15 release (May, 2017) and plan to upgrade to a modern (and non end-of-life) version of MongoDB server. There have been many security, stability, and performance improvements in successive server releases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.