MongoDB Security Best Practices

Eliot Horowitz
February 10, 2015 | Updated: January 20, 2017
#Business#Company
Editor's note: This post was edited on June 23, 2015 to reflect the change from MongoDB Management Service to MongoDB Cloud Manager. Learn more here.

MongoDB takes security very seriously. Recently a team of German researchers discovered unsecured instances of MongoDB running openly on the internet. Readers who are concerned about access to their systems are reminded of the following resources:

  • The most popular installer for MongoDB (RPM) limits network access to localhost by default.
  • Security is addressed in detail in our Security Manual. The Security Checklist discusses limiting network exposure. Note that the method to do this will vary significantly depending on where the service is hosted (AWS, Azure, locally, etc).
  • Additionally, users of MongoDB Cloud Manager can enable alerts to detect if their deployment is internet exposed (see figure below).
  • A discussion on security is provided in two parts. Part 1 covers Design and Configuration. Part II covers 10 mistakes that can compromise your database.
  • We encourage users who have experienced a security incident for MongoDB to create a vulnerability report.

Create a new alert to notify of host being exposed to the public internet.

If you are interested in learning more about security best practices watch our on demand webinar.
Securing your MongoDB deployment

About the Author - Eliot Horowitz

Eliot Horowitz is CTO and Co-Founder of MongoDB. Eliot is one of the core MongoDB kernel committers. Previously, he was Co-Founder and CTO of ShopWiki. Eliot developed the crawling and data extraction algorithm that is the core of its innovative technology. He has quickly become one of Silicon Alley's up and coming entrepreneurs and was selected as one of BusinessWeek's Top 25 Entrepreneurs Under Age 25 nationwide in 2006. Earlier, Eliot was a software developer in the R&D group at DoubleClick (acquired by Google for $3.1 billion). Eliot received a BS in Computer Science from Brown University.

← Previous

Improved password-based authentication in MongoDB 3.0: SCRAM Explained (Part 2)

In MongoDB 3.0, SCRAM is now the default password-based authentication mechanism. In the first post in this series, we introduced the threat-model SCRAM is designed to counter, and explained the inner workings of the protocol. Now we can take a closer look at how SCRAM addresses the attacks that follow from this threat-model. For a more detailed discussion, please see the Security Considerations section of the SCRAM RFC. Resistance to Eavesdropping By capturing the full exchange of messages, an attacker can learn the username, salt, iteration count, nonces, ClientProof and ServerSignature . While there is no efficient way to learn the ClientKey or ServerKey from this information alone, an attacker could mount a dictionary attack by repeatedly picking a candidate password ‘ Guess ’ and checking the following equation: HMAC(HMAC(KeyDerive(Guess, salt, i), "Server Key"), AuthMessage) = ClientProof This attack can be mounted offline, and can be highly parallelized. As such SCRAM's resistance to eavesdropping is dependent on the iteration count supplied to the key derivation function (and the strength of the user's password) . While the default iteration count should suffice for most deployments, users who require increased security have the ability to increase it. It is also recommended that SCRAM is used in conjunction with Transport Layer Security (TLS) to further mitigate the risk of eavesdropping. Resistance to Replay SCRAM resists replay by randomizing each instance of the protocol using the ClientNonce and ServerNonce . The nonces are used as input to the ClientSignature and ServerSignature (via the AuthMessage ), so the signatures are only valid for a single session. The risk of nonce reuse, which would enable a replay attack, is reduced by using entropy from both the client and the server to compute the ClientSignature . Resistance to a Malicious Server SCRAM requires the server to prove its identity by sending a valid ServerSignature to the client as the final step of the protocol. Producing a valid ServerSignature requires knowledge of all messages sent in the SCRAM session and access to the ServerKey stored in the client’s credential. If an attacker poses a malicious server by eavesdropping on a prior session to learn the salt and the iteration count, the attacker will be unable to generate a valid ServerSignature . As a successful instance of SCRAM verifies the client and server’s identities to each other, we say that SCRAM provides mutual authentication . Resistance to Database Compromise In SCRAM, the server verifies the ClientProof without having the ability to generate it 11 (as it doesn't store the SaltedPassword ). If an attacker gains access to a server's stored credentials, it will learn the StoredKey and ServerKey . While the attacker will gain the ability compute a valid ServerSignature and thus impersonate the compromised server, the attacker still needs the ClientKey (or SaltedPassword ) to generate a valid ClientProof . Thus a server compromise alone does not reveal sufficient information for the attacker to impersonate a client. However, as with the eavesdropping attack, the attacker will have gained sufficient information to mount a computationally expensive dictionary attack. If in addition to compromising the server's credentials, the attacker eavesdrops on an instance of SCRAM, the attacker will be able to learn the ClientKey without performing a dictionary attack. Recall that the attacker will learn the ClientProof and AuthMessage , and can compute the ClientSignature using the AuthMessage and StoredKey . Then the attacker can simply compute: ClientKey = ClientProof ⊕ ClientSignature. Thus if an attacker can view the server's credential store and capture arbitrary network traffic, the attacker can impersonate a client. Again, we recommend using TLS in addition to SCRAM to mitigate this attack. Using SCRAM-SHA-1 Using SCRAM as an authentication mechanism is as simple as using the legacy MONGODB-CR mechanism. As SCRAM-SHA-1 (the mechanism name for SCRAM in MongoDB) is the default authentication mechanism in MongoDB 3.0, it is not necessary to specify it when starting the server. First we create a user on our test database. > use testdb > db.createUser({user: "testUser", … pwd: "testPassword", … roles: [ { role: "readWrite", db: "testdb" } … ]}) If we restart the server without the --auth flag (or authenticate as a user with readWrite on the admin database), we can see the SCRAM credential for our test user. > use admin > db.system.users.findOne({user: "testUser"}) { "_id" : "admin.testUser", "user" : "testUser", "db" : "testdb", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "+seF99VS0sZFe30VPBHA7A==", "storedKey" : "DYPbk/QJVowCNDPe2O2uWMmGq8U=", "serverKey" : "q4KAi4pVZNOLCgWcxcBr7jkM3m8=" } }, "roles" : [ { "role" : "readWrite", "db" : "testDb" } ] } Then we can authenticate to the server using SCRAM. > use testdb switched to db testdb > db.auth({user: "testUser", pwd: "testPassword"}) Upgrading to SCRAM from MONGODB-CR Assume that we start with an instance of MongoDB 2.6.x. We start by authenticating as an administrator, then we create a user. > db.createUser({user: "testUser", pwd: "testPassword", roles: [ { role: "readWrite", db: "myDb" } ] }) If we check the system.users collection, we can see the newly created MONGODB-CR credential. > use admin > db.system.users.findOne({user: "testUser"}) { "_id" : "myDb.testUser", "user" : "testUser", "db" : "myDb", "credentials" : { "MONGODB-CR" : "f050eba660da0d34bb60db5e13c2be32" }, "roles" : [ { "role" : "readWrite", "db" : "myDb" } ] } Now we stop the 2.6.x server and start a 3.0 server using the same data directory. We can see that the MONGODB-CR credentials are still in the system.users collection. > db.system.users.findOne({user: "testUser"}) { "_id" : "myDb.testUser", "user" : "testUser", "db" : "myDb", "credentials" : { "MONGODB-CR" : "f050eba660da0d34bb60db5e13c2be32" }, "roles" : [ { "role" : "readWrite", "db" : "myDb" } ] } We can run the authSchemaUpgrade command to replace the MONGODB-CR credentials with SCRAM credentials. > db.getSiblingDB("admin").runCommand({authSchemaUpgrade: 1 }); { "done" : true, "ok" : 1 } We can now see that a SCRAM credential has been created for the test user. > use admin > db.system.users.findOne({user: "testUser"}) { "_id" : "myDb.testUser", "user" : "testUser", "db" : "myDb", "credentials" : { "SCRAM-SHA-1" : { "iterationCount" : 10000, "salt" : "aCXRCYs9kgn5I3sliluXdQ==", "storedKey" : "2aDnf8OIv8dLeUDOZJwI15bRHWc=", "serverKey" : "9rqa5qYZzsl8SKU1CIOJgQh+j4Y=" } }, "roles" : [ { "role" : "readWrite", "db" : "myDb" } ] } For more information about securing your MongoDB deployment, download our Security Architecture Guide. It includes details about MongoDB’s security features and provides a security configuration checklist: Download the Security Guide About Adam Midvidy Adam Midvidy is an engineer on the MongoDB Platforms team with an interest in cryptography. 11 More formally, we say that SCRAM is a zero-knowledge proof of password. < Read Part 1

February 6, 2015
Next →

Congratulations to the 2023 APAC Innovation Award Winners

I’m thrilled to announce the nine winners of the 2023 MongoDB APAC Innovation Awards . The MongoDB Innovation Awards honor projects and people who dream big. They celebrate the groundbreaking use of data to build compelling applications and the creativity of professionals expanding the limits of technology with MongoDB. This year, we have broken the awards down regionally to celebrate organizations in APAC, from startups to industry-leading enterprises, across a wide variety of industries, who are delivering big results. We are delighted to announce the winners below: 2023 MongoDB APAC Innovation Award Winners: Positive Impact Open Government Products Open Government Products (OGP) is an in-house team of engineers, designers, and product managers, who is a part of the Singapore Government, and is responsible for building technologies for the public good. OGP used MongoDB’s developer data platform, MongoDB Atlas to create its digital form builder, FormSG. Used by the Singapore government and public healthcare institutions, FormSG securely collects data from residents and businesses and helps public officers to create digital government forms in minutes. It eliminates the use of paper forms and the manual process of transcribing physical documents, which had raised concerns around data privacy and protection. During the pandemic, FormSG enabled public officers to collect more than 100,000 daily temperature declarations nationwide. Today, FormSG has served more than 120,000 public officers from 155 agencies and it has created more than 500,000 digital forms to help the government collect data on travel and health declarations by visitors to the country, applications for COVID-19 swab tests, and applications for financial assistance. Organization Transformation Bendigo and Adelaide Bank Bendigo and Adelaide Bank is one of Australia’s largest banks, with around 7,000 employees helping more than 2.2 million customers achieve their financial goals. The bank has been on a multi-year journey of transformation using MongoDB's developer data platform to improve efficiency and deliver a better customer experience as they fulfill their vision to become Australia’s bank of choice. Recently, the cloud team launched Ready-Set-MongoDB (or RSM). This event-driven framework allows developers to streamline the consumption of internal or external APIs, and applies data transformations and storage automatically within a MongoDB collection of their choice. Using MongoDB Atlas Search, the bank also enabled developers to gain insights across its multi-cloud deployments, identifying cost savings, and providing inventory information to account owners and technical stakeholders. Within the first 18 months of launching these programmes, the automation had saved the organization more than 1,100 developers days. It also helped reduce human involvement, removed stale data, and allowed engineers to focus on the things that matter. The development of Ready-Set-MongoDB is ongoing and improving, as new Bendigo multi-cloud challenges arise and new MongoDB products are released. The application is a perfect representation of how Bendigo's Technology Department is using modern technology, rapid development, and innovation-led problem solving to drive organizational transformation. Heroes in Health Redcliffe Lifetech Private Limited Over the last few years, Redcliffe Labs has become India's fastest growing technology-driven diagnostics service provider. Redcliffe Labs is on a mission to serve 500 Million Indians by 2030 with fusion of technology and world- class laboratories. The company already serves thousands of people daily, with more than 73 labs and close to 1500 walk-in centers across 180 cities. Redcliffe Labs has relied on MongoDB Atlas’ flexible document model to power its innovative Smart Health Report, a patient resource that provides a number of indicators and trackers to gauge holistic health. The MongoDB developer data platform's best in class security, compliance, and privacy controls allows Redcliffe's team to confidently handle even the most sensitive patient data. MongoDB Atlas takes care of many of the traditional database management challenges, which means that developers can spend their time building diagnostics for patients, rather than managing databases. Redcliffe Labs is focusing on incorporating next-generation technologies in the diagnostics space with an AI platform that will make Interactive Diagnostics reports, Advanced Health Profiling and more detailed Diagnostics and Health Alerts. Industry Disruptor Cathay Pacific Cathay Pacific , Hong Kong’s home carrier operating in more than 60 destinations worldwide, has been on an impressive journey to become one of the very first airlines to create a truly paperless flight deck. Until recently, a flight from Hong Kong to New York would require a crew to review more than 150 pages of finely printed text and charts before their flight and make ongoing updates throughout the trip. In 2019, Cathay Pacific conducted the first zero paper flight, removing 50kg of manuals, charts, maps, and flight briefing paperwork. They achieved this enormous feat with the help of one seamless and highly customized iPad application: Flight Folder. Built on MongoDB Atlas, Flight Folder is designed to improve the pilot briefing experience. MongoDB helped consolidate dozens of different information sources into one place, and made it possible for flight crews to easily share their experiences with others. It also included a digital refueling feature that helps crews become much more efficient with fueling strategies – saving significant flight time and costs. The use of MongoDB Device Sync enables seamless syncing and no data loss even when the app goes on- and offline mid-flight. Since the Flight Folder launch, Cathay Pacific has completed more than 340,000 flights with full digital integration in the flight deck. In addition to the greatly improved flight crew experience, flight times have been reduced, and digital refueling saves eight minutes of ground time on average. All these efficiencies have helped the company avoid the release of 15,000 tons of carbon. From Batch to Real-Time Adani Digital Labs Adani Digital Labs is the India-based digital innovation arm of the larger Adani group. The lab’s team's mission is to create one single platform – a SuperApp called AdaniOne – to empower a billion stories in India. To address several use cases and the huge scale that will be required by the superapp, the Adani Digital team selected MongoDB Atlas as its the main transactional database that will further enhance the application. A key component of the app is how it can bring together disparate data in order to provide a single view of activity across the application. In the first process, developers had taken out the data in batches and sent it to their database However, this was too slow and unpredictable as far as business requirements are concerned. Also, the consolidated view of customer history, orders, inventory, and supply chain network updates was likely to impact their customer's ability to generate revenue. Therefore, in order to find a better solution, Adani Digital Labs built a more modern architecture in line with MongoDB. Using MongoDB's Change Streams and the data platform's native Kafka connector, they created an event-based architecture that pushes the data out in real-time for analysis. Adani Digital Labs is still in the early phases of the SuperApp's rollout and collaborating with MongoDB as its developer data platform continues to help the firm to grow and deliver insights in real time. Industry 4.0 Dongwha Founded in 1948, the Dongwha Group has evolved from a singular focus on the wood and timber industry into a global leader across a number of sectors including building materials, chemicals and media. As part of its wider digital transformation strategy, Dongwha required smarter factories that would improve and optimize their production efficiency. Dongwha built an innovative Smart Factory Software platform that collects and analyzes data to enhance quality and production management capabilities. Originally, the platform was built with the community version of MongoDB. However, in order to scale and adapt, the team recently migrated to MongoDB Atlas in the cloud. This enabled them to store large volumes in the fastest and most secure way, optimize their solution for time series data, and make it easy to run machine learning across their data. Dongwha completed the migration seamlessly, without any disruption or downtime to their factories, and it has now been launched across five different sites. Over the last year, the application has significantly increased its availability and reliability while performance has improved by as much as 6x . As they look to the future, Dongwha plans to roll out the software to more of its international factories. Digital Native myBillBook India is home to more than 60 million small and medium-sized businesses (SMBs) but only a small portion of those SMBs are taking advantage of digitization and many still operate using pen and paper. In addition, many businesses in India still struggle with fluctuations in internet services, outages, and latency. FloBiz is on a mission to change that with myBillBook , a one-stop solution that helps SMBs create professional invoices, manage stock, collect payments, automate reminders through smart banking, engage with their customers, manage staff attendance and payroll and generate more than 25 business reports for accounting and decision making. The app is also mobile-first, so businesses can access them from their mobile devices and allows users to manage billing and inventory in both online and offline environments. The myBillbook app is powered by MongoDB Atlas, providing the flexible and scalable foundation for the business to do everything from building new features to performing complex analytical queries. In addition, MongoDB Realm, the mobile database within the data platform, supports offline usage and syncing to ensure there is never data loss or functionality for users due to poor internet connection. Because of its success in supporting customers with business critical operations, more than 6.5 million business owners in India are now using myBillbook for their billing, accounting, collection and business growth. Customer Focused KASIKORN Business-Technology Group Established in 1945, Kasikornbank (KBank) is one of the largest and oldest banks in Thailand. Their mission is to strive towards service excellence and empower every customer’s life and business. One of KBank’s subsidiaries, KASIKORN Business-Technology Group (KBTG) , developed a mobile banking application – MAKE by KBank. MongoDB Atlas’ flexibility and ease of development enabled MAKE’s development team to choose the best type of database for its tasks, to automate data tiering with Atlas Online Archive, and to reduce hours spent on operational maintenance. With more time to focus on delivering new innovations to customers, they created unique features like Cloud Pocket which can allocate funds into unlimited customizable pockets for separate usage. They also built Pop Pay, a feature that allows users to easily search for nearby friends and transfer money by clicking their profile picture as well as “Expense Summary" a spending analysis services that helps inform and manage users’ financial habits. As of January 2023, MAKE has acquired more than 1 million users, and increased the number of transactions in MAKE from 900,000 to more than 7.5 million in a span of one year. Massive Scale China Mobile China Mobile provides mobile voice and multimedia services via its nationwide mobile telecommunications network across mainland China and Hong Kong. It is the world's largest mobile network operator by total number of subscribers. The telecommunications leader is using MongoDB to support one of its largest and most critical push services, which sends out billing details to more than 1 billion users every month. Prior to MongoDB, the tech team relied on Oracle, but as the user numbers increased, performance degraded. Despite large investments, it was still taking too long to do basic requests like finalize and deliver bills to users. In 2019, after comprehensive testing, China Mobile migrated to MongoDB. By taking advantage of MongoDB's native sharding, they were able to improve performance by 80% and go from 50 Oracle machines, to just 12 machines for the same workload. The service now handles all current requirements and is set up to scale with future growth. With the support of MongoDB, China Mobile is growing steadily,with more than 168 million monthly users and has one of the highest customer satisfaction scores in the China Mobile group.

March 30, 2023