21–30 of 45 posts
We take security seriously at MongoDB. Here is a response on security best practices from the MongoDB CTO & Co-Founder: http://www.mongodb.com/blog/post/mongodb-security-best-pract...
This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default. This is part of the Sliceh…
No one else binds to all interfaces by default.
This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default. This is part of the Sliceh…
> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.
We take security seriously at MongoDB. Here is a response on security best practices from the MongoDB CTO & Co-Founder: http://www.mongodb.com/blog/post/mongodb-security-best-pract...
> "The most popular installer for MongoDB (RPM) limits network access to localhost by default."
The first download for Linux at https://www.mongodb.org/downloads is:
> https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-2.6.7....
At the bottom of the page there are alternate links to packages. Here is the description:
> "MongoDB is included in several different package managers. Generally speaking, it is easier to simply install the prebuilt binaries from above."
If the properly packaged versions have secure defaults, maybe you should steer people towards them?
This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default. This is part of the Sliceh…
> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.
Earlier quoted context omitted.
> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.
Memcached does, for one. This is (sensibly) turned off if you do "apt-get install memcached" or similar.
MongoDB fucks this balance up by recommending you use their package repositories instead of distro maintained packages.
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 27017 -j ACCEPT
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 28017 -j ACCEPT
# 2nd: drop from all others
iptables -A INPUT -p tcp --dport 27017 -j DROP
iptables -A INPUT -p tcp --dport 28017 -j DROP
Please spend a little bit more money and hire a professional who knows what he is doing instead of just following installation tutorials.
We take security seriously at MongoDB. Here is a response on security best practices from the MongoDB CTO & Co-Founder: http://www.mongodb.com/blog/post/mongodb-security-best-pract...
As I understand things based on the OP it seems however your documentation promotes the insecure way of setting up mongodb. It's even true that mongodb doesn't even ask to create db credentials during the installation,something it should do by default.