1

Recently I created a server with MongoDB preinstalled on a DigitalOcean droplet following these tutorials

It was my first time doing this. Today I received this email from DigitalOcean:

A recent network security scan suggests your Droplet droplet-name is running a MongoDB instance and that it may be unintentionally exposing data, or misconfigured to allow unauthorized access. MongoDB listens for traffic from everywhere on port 27107 and you can validate this report by attempting to connect to your MongoDB instance on via a simple telnet command: telnet xxx.xxx.xx.xx 27107 If the connection is successful you will receive output like the following, which will confirm that your service is visible to the public Internet

Trying xxx.xxx.xx.xx...
Connected to xxx.xxx.xx.xx.

Remediation of this issue will take just a few minutes and is relatively straightforward. You will need to open mongodb instance and run below command adding IP you want to connect from: sudo mongod --bind_ip localhost, ip-or-Associated-Hostname-you-connect-from

After connecting to my server, I tried sudo mongod --bind_ip localhost and sudo mongod --bind_ip xxx.xxx.xx.xx commands (xxx.xxx.xx.xx is my server IP, the one I have to put on ssh [email protected] command to connect to my server), but they didn't work, they threw me

I CONTROL  [main] Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'
I CONTROL  [initandlisten] MongoDB starting : pid=16339 port=27017 dbpath=/data/db 64-bit host=host-name
I CONTROL  [initandlisten] db version v4.0.3       
I CONTROL  [initandlisten] git version: xxxxxxxxxxxxxxxxxxxxx
I CONTROL  [initandlisten] OpenSSL version: OpenSSL 1.1.1  11 Sep 2018
I CONTROL  [initandlisten] allocator: tcmalloc     
I CONTROL  [initandlisten] modules: none
I CONTROL  [initandlisten] build environment:      
I CONTROL  [initandlisten]     distmod: ubuntu1804 
I CONTROL  [initandlisten]     distarch: x86_64    
I CONTROL  [initandlisten]     target_arch: x86_64 
I CONTROL  [initandlisten] options: { net: { bindIp: "localhost" } }
E STORAGE  [initandlisten] Failed to set up listener: SocketException: Address already in use
I CONTROL  [initandlisten] now exiting
I CONTROL  [initandlisten] shutting down with code:48

So I remembered my mongod.conf was:

net:
  port: 27017
  bindIp: 0.0.0.0

security:
  authorization: enabled

I changed the 0.0.0.0 to localhost,xxx.xxx.xx.xx, and now when I try to connect with telnet xxx.xxx.xx.xx 27107 (I didn't try this command before to check if the connection was successful, my bad) I receive

Connecting To xxx.xxx.xx.xx...Could not open connection to the host, on port 27107: Connect failed

My service is not visible to the public internet I guess (if I set again bindIp: 0.0.0.0 I get the same output)

But I noticed DigitalOcean email telnet command says 27107 and all my settings (and DigitalOcean docs) are based on port 27017. Is the email port wrong? If I put telnet xxx.xxx.xx.xx 27017 the output is Trying xxx.xxx.xx.xx... and then the console is totally cleaned (even the prompt), and the title bar is changed to Telnet xxx.xxx.xx.xx. If I press a key nothing happens, but after pressing any key many times the console backs as it was at the beginning. I don't know if the connection is successful or not.

If I check ufw status as root, the output is

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
27017                      ALLOW       Anywhere
OpenSSH                    ALLOW       Anywhere
22/tcp (v6)                LIMIT       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
27017 (v6)                 ALLOW       Anywhere (v6)
OpenSSH (v6)               ALLOW       Anywhere (v6)

I think this is not good. If I try to connect to mongo on a Nodejs app running on my pc using mongoose with mongodb://xxx.xxx.xx.xx:27017 the connection is successful, but when I try to create a new document, it throws MongoServerError: command insert requires authentication which looks good but I'm not sure.

What am I doing wrong? I want to allow connections to Mongo only from my pc and my Nodejs app, deployed on DigitalOcean via App Platform (App Platform app doesn't have static IP address)

Thanks in advance

1 Answer 1

0

Answer is "tune" your firewall settigs. You need to change that "27017 ALLOW Anywhere" line to much stricter.

First let's get rid of those MongoDB port settings. Give command "ufw status numbered"

Then delete those lines what start with port 27017 with commands (guessing now right line numbers):

  • ufw delete 4
  • ufw delete 9

Then with command "ufw allow from xxx.xxx.xx.xx to any port 27017" we will allow connections only from your server.

6
  • Thanks for your response. I just updated the last lines of my question. On ufw allow from xxx.xxx.xx.xx to any port 27017 I have to put my Nodejs app server IP and my local pc IP, right? Or am I missing something?
    – Fernando
    Feb 26, 2023 at 17:20
  • I also noticed DigitalOcean email telnet command says 27107 and all the MongoDB documentation on DigitalOcean says 27017. Is it wrong? If I put telnet xxx.xxx.xx.xx 27017 looks like the connection is successfull, there's no output, but the console is cleaned
    – Fernando
    Feb 26, 2023 at 17:37
  • Your mongodb.conf says that port is 27017, so you open that port from outside to the mongodb server. And yes, that xxx.xxx.xx.xx is your nodejs app server IP; i.e. server what should have access to that DB server. You can have multiple allow from -lines for port 27017 with different source IPs
    – JJussi
    Feb 27, 2023 at 18:34
  • ...and with ufw you shoud have deny everthing from everywhere as last line.
    – JJussi
    Feb 27, 2023 at 18:36
  • Thanks. I realized my Nodejs app server doesn't have static IP address, as it is deployed on DigitalOcean via App Platform. I have to keep 27017 open to anywhere I guess. The net.bindIp setting is localhost,xxx.xxx.xx.xx (xxx.xxx.xx.xx is the server IP where is running the mongo instance). Everything is working fine, but I'm not sure if my server is secured. The security.authorization is enabled. The telnet response keeps me concerned (I've added an update just before the ufw status output to give more details about it).
    – Fernando
    Feb 28, 2023 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.