1

What's the most painless way to create something like a proxy server so that my dev team can access a database from anywhere?

The server in question is a managed MongoDB database. Currently, I am just whitelisting IP addresses in the dashboard for the managed database as needed, but this is not sustainable, especially as the team grows. I would like to whitelist a single IP address to a proxy server, and do something like add a public SSH key to that proxy server for each machine.

But here are my obstacles:

  1. I am not a networking expert or sysadmin - I'd be worried about making a mistake and creating a security hole in the proxy server. I also just don't like doing networking stuff. I wish there was some kinda SaaS service for this exact purpose
  2. How do I enable MongoDB GUI access through the proxy server?

Closest thin I could find here is this, which is what I'm trying to move away from

Improve this question
3
  • 1) You are simply moving a security weakness to another server. Plus you are adding another layer that can fail. 2) Mongo supports X.509 client certificates. That is the security equivalent of SSH keypairs. 3) The dev team should have its own database so that the production database is never exposed to the world. 4) For MongoDB GUI deploy multi-factor authentication. 5) I would not implement your solution in the manner you described. Security would not be improved, manageability would not be improved, and performance would probably decrease.
    – John Hanley
    Jul 16, 2022 at 2:38
  • @JohnHanley I guess I forgot to add that this is for a super early stage startup. We have two engineers that need access to the DB to fix fires in production. Our goal is not strictly speaking to increase the security protection, but simply to make it more manageable. Why wouldn't manageability be improved? ssh access between two devices is way easier than constantly updating ip addresses when devices switch networks
    – Anson Kao
    Jul 16, 2022 at 18:59
  • Because you are trading managing IP addresses at one location (mongo) for another (ssh server). Plus you then need to manage SSH keypairs, user access rights, operating system patches, etc. etc.
    – John Hanley
    Jul 16, 2022 at 22:50

1 Answer 1

Reset to default
2

Have you thought of something like humongous.io (disclaimer I'm a co-founder)?

It's an online GUI for MongoDB. You whitelist one IP address (Humongous' server) and your team can access MongoDB through its web interface.

It can also be deployed on-premise in your own VPC so your production database is never directly exposed to the internet.

You can enforce 2FA for your entire dev team for an additional layer of security.

Improve this answer
2
  • This is exactly the type of solution I was looking for, thank you!
    – Anson Kao
    Jul 16, 2022 at 19:00
  • For management, your company looks promising. Does this solve his question about proxying database connections as well?
    – John Hanley
    Jul 16, 2022 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.