Allow connection to mongo only from my server droplet

Question

Recently I created a server with MongoDB preinstalled on a DigitalOcean droplet following these tutorials

• DigitalOcean - Initial server setup
• DigitalOcean - How to secure MongoDB on Ubuntu
• Medium - How to quickly setup MongoDB on DigitalOcean

It was my first time doing this. Today I received this email from DigitalOcean:

A recent network security scan suggests your Droplet droplet-name is running a MongoDB instance and that it may be unintentionally exposing data, or misconfigured to allow unauthorized access. MongoDB listens for traffic from everywhere on port 27107 and you can validate this report by attempting to connect to your MongoDB instance on via a simple telnet command: telnet xxx.xxx.xx.xx 27107 If the connection is successful you will receive output like the following, which will confirm that your service is visible to the public Internet

Trying xxx.xxx.xx.xx...
Connected to xxx.xxx.xx.xx.

Remediation of this issue will take just a few minutes and is relatively straightforward. You will need to open mongodb instance and run below command adding IP you want to connect from: sudo mongod --bind_ip localhost, ip-or-Associated-Hostname-you-connect-from

After connecting to my server, I tried sudo mongod --bind_ip localhost and sudo mongod --bind_ip xxx.xxx.xx.xx commands (xxx.xxx.xx.xx is my server IP, the one I have to put on ssh [email protected] command to connect to my server), but they didn't work, they threw me

I CONTROL  [main] Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'
I CONTROL  [initandlisten] MongoDB starting : pid=16339 port=27017 dbpath=/data/db 64-bit host=host-name
I CONTROL  [initandlisten] db version v4.0.3       
I CONTROL  [initandlisten] git version: xxxxxxxxxxxxxxxxxxxxx
I CONTROL  [initandlisten] OpenSSL version: OpenSSL 1.1.1  11 Sep 2018
I CONTROL  [initandlisten] allocator: tcmalloc     
I CONTROL  [initandlisten] modules: none
I CONTROL  [initandlisten] build environment:      
I CONTROL  [initandlisten]     distmod: ubuntu1804 
I CONTROL  [initandlisten]     distarch: x86_64    
I CONTROL  [initandlisten]     target_arch: x86_64 
I CONTROL  [initandlisten] options: { net: { bindIp: "localhost" } }
E STORAGE  [initandlisten] Failed to set up listener: SocketException: Address already in use
I CONTROL  [initandlisten] now exiting
I CONTROL  [initandlisten] shutting down with code:48

So I remembered my mongod.conf was:

net:
  port: 27017
  bindIp: 0.0.0.0

security:
  authorization: enabled

I changed the 0.0.0.0 to localhost,xxx.xxx.xx.xx, and now when I try to connect with telnet xxx.xxx.xx.xx 27107 (I didn't try this command before to check if the connection was successful, my bad) I receive

Connecting To xxx.xxx.xx.xx...Could not open connection to the host, on port 27107: Connect failed

My service is not visible to the public internet I guess (if I set again bindIp: 0.0.0.0 I get the same output)

But I noticed DigitalOcean email telnet command says 27107 and all my settings (and DigitalOcean docs) are based on port 27017. Is the email port wrong? If I put telnet xxx.xxx.xx.xx 27017 the output is Trying xxx.xxx.xx.xx... and then the console is totally cleaned (even the prompt), and the title bar is changed to Telnet xxx.xxx.xx.xx. If I press a key nothing happens, but after pressing any key many times the console backs as it was at the beginning. I don't know if the connection is successful or not.

If I check ufw status as root, the output is

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
27017                      ALLOW       Anywhere
OpenSSH                    ALLOW       Anywhere
22/tcp (v6)                LIMIT       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
27017 (v6)                 ALLOW       Anywhere (v6)
OpenSSH (v6)               ALLOW       Anywhere (v6)

I think this is not good. If I try to connect to mongo on a Nodejs app running on my pc using mongoose with mongodb://xxx.xxx.xx.xx:27017 the connection is successful, but when I try to create a new document, it throws MongoServerError: command insert requires authentication which looks good but I'm not sure.

What am I doing wrong? I want to allow connections to Mongo only from my pc and my Nodejs app, deployed on DigitalOcean via App Platform (App Platform app doesn't have static IP address)

Thanks in advance

Answer 1

Answer is "tune" your firewall settigs. You need to change that "27017 ALLOW Anywhere" line to much stricter.

First let's get rid of those MongoDB port settings. Give command "ufw status numbered"

Then delete those lines what start with port 27017 with commands (guessing now right line numbers):

• ufw delete 4
• ufw delete 9

Then with command "ufw allow from xxx.xxx.xx.xx to any port 27017" we will allow connections only from your server.