> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Security Checklist for Self-Managed Deployments

This page lists security measures to protect your MongoDB installation. The list is not exhaustive.

## Pre-production Checklist/Considerations

### ➤ Enable Access Control and Enforce Authentication

- Enable access control and specify an authentication mechanism.

  MongoDB Community supports the following [authentication mechanisms:](https://www.mongodb.com/docs/manual/core/authentication.md#std-label-security-authentication-mechanisms)

  - [SCRAM](https://www.mongodb.com/docs/manual/core/security-scram.md#std-label-authentication-scram) (*Default*)

  - [X.509 Certificate Authentication.](https://www.mongodb.com/docs/manual/core/security-x.509.md#std-label-security-auth-x509)

  In addition to the preceding mechanisms, MongoDB Atlas and MongoDB Enterprise support the following mechanisms:

  - [LDAP proxy authentication](https://www.mongodb.com/docs/manual/core/authentication.md#std-label-security-auth-ldap), and

  - [Kerberos authentication.](https://www.mongodb.com/docs/manual/core/authentication.md#std-label-security-auth-kerberos)

  These mechanisms allow MongoDB to integrate into your existing authentication system.

**See also:**

- [Authentication on Self-Managed Deployments](https://www.mongodb.com/docs/manual/core/authentication.md)

- [Enable Access Control on Self-Managed Deployments](https://www.mongodb.com/docs/manual/tutorial/enable-authentication.md)

### ➤ Configure Role-Based Access Control

- Create a [user administrator](https://www.mongodb.com/docs/manual/tutorial/configure-scram-client-authentication.md#std-label-create-user-admin) **first**, then create additional users. Create a unique MongoDB user for each person/application that accesses the system.

- Follow the principle of least privilege. Create roles that define the exact access rights required by a set of users. Then create users and assign them only the roles they need to perform their operations. A user can be a person or a client application.

  **Note:**

  A user can have privileges across different databases. If a user requires privileges on multiple databases, create a single user with roles that grant applicable database privileges instead of creating the user multiple times in different databases.

**See also:**

- [Role-Based Access Control in Self-Managed Deployments](https://www.mongodb.com/docs/manual/core/authorization.md)

- [Create a User on Self-Managed Deployments](https://www.mongodb.com/docs/manual/tutorial/create-users.md)

- [Manage Users and Roles on Self-Managed Deployments](https://www.mongodb.com/docs/manual/tutorial/manage-users-and-roles.md)

### ➤ Encrypt Communication (TLS/SSL)

- Configure MongoDB to use TLS/SSL for all incoming and outgoing connections, including between [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) and [`mongos`](https://www.mongodb.com/docs/manual/reference/program/mongos.md#mongodb-binary-bin.mongos) components and between all applications and MongoDB.

  MongoDB uses the native TLS/SSL OS libraries:

  | Platform | TLS/SSL Library |
  | --- | --- |
  | Windows | Secure Channel (Schannel) |
  | Linux/BSD | OpenSSL |
  | macOS | Secure Transport |

**See also:**

[Configure MongoDB Instances for TLS/SSL Encryption.](https://www.mongodb.com/docs/manual/tutorial/configure-ssl.md)

### ➤ Encrypt and Protect Data

- You can encrypt data in the storage layer with the WiredTiger storage engine's native [Encryption at Rest.](https://www.mongodb.com/docs/manual/core/security-encryption-at-rest.md)

- If you are not using WiredTiger's encryption at rest, MongoDB data should be encrypted on each host using file-system, device, or physical encryption (for example dm-crypt). You should also protect MongoDB data using file-system permissions. MongoDB data includes data files, configuration files, auditing logs, and key files.

- You can use [Queryable Encryption](https://www.mongodb.com/docs/manual/core/queryable-encryption.md#std-label-qe-manual-feature-qe) or [Client-Side Field Level Encryption](https://www.mongodb.com/docs/manual/core/csfle.md#std-label-manual-csfle-feature) to encrypt fields in documents application-side prior to transmitting data over the wire to the server.

- Collect logs to a central log store. These logs contain database authentication attempts including source IP addresses.

### ➤ Limit Network Exposure

- Ensure that MongoDB runs in a trusted network environment and configure firewall or security groups to control inbound and outbound traffic for your MongoDB instances.

- Disable direct SSH root access.

- Allow only trusted clients to access the network interfaces and ports on which MongoDB instances are available.

**See also:**

- [Self-Managed Network and Configuration Hardening](https://www.mongodb.com/docs/manual/core/security-hardening.md)

- the [`net.bindIp`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-net.bindIp) configuration setting

- the [`security.clusterIpSourceAllowlist`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-security.clusterIpSourceAllowlist) configuration setting

- the [authenticationRestrictions](https://www.mongodb.com/docs/manual/reference/method/db.createuser.md#std-label-db-createUser-authenticationRestrictions) field to the [`db.createUser()`](https://www.mongodb.com/docs/manual/reference/method/db.createuser.md#mongodb-method-db.createUser) command to specify a per-user IP allow list.

### ➤ Audit System Activity

- [MongoDB Enterprise](http://www.mongodb.com/products/mongodb-enterprise-advanced) includes a system auditing facility that can record system events (including user operations and connection events) on a MongoDB instance. Audit records permit forensic analysis and allow administrators to exercise proper controls. You can set up filters to record only specific events, such as authentication events.

**See also:**

- [Auditing](https://www.mongodb.com/docs/manual/core/auditing.md)

- [Configure Auditing](https://www.mongodb.com/docs/manual/tutorial/configure-auditing.md)

### ➤ Run MongoDB with a Dedicated User

- Run MongoDB processes with a dedicated operating system user account. Ensure that the account has permissions to access data but no unnecessary permissions.

**See also:**

[Install MongoDB Community and Enterprise Editions](https://www.mongodb.com/docs/manual/installation.md)

### ➤ Run MongoDB with Secure Configuration Options

- MongoDB supports the execution of JavaScript code for certain server-side operations: [`mapReduce`](https://www.mongodb.com/docs/manual/reference/command/mapreduce.md#mongodb-dbcommand-dbcmd.mapReduce), [`$where`](https://www.mongodb.com/docs/manual/reference/operator/query/where.md#mongodb-query-op.-where), [`$accumulator`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/accumulator.md#mongodb-group-grp.-accumulator), and [`$function`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/function.md#mongodb-expression-exp.-function). If you do not use these operations, disable server-side scripting by using the [`--noscripting`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#std-option-mongod.--noscripting) option.

### ➤ Request a Security Technical Implementation Guide (where applicable)

- The Security Technical Implementation Guide (STIG) contains security guidelines for deployments within the United States Department of Defense. MongoDB Inc. provides its STIG, upon [request](http://www.mongodb.com/lp/contact/stig-requests).

### ➤ Consider Security Standards Compliance

- To learn how to build HIPAA or PCI-DSS compliant application infrastructure using MongoDB security capabilities, see the [MongoDB Security Reference Architecture](https://www.mongodb.com/collateral/mongodb-security-architecture).

## Antivirus and Endpoint Detection and Response Scanning

If you use an antivirus (AV) scanner or an endpoint detection and response (EDR) scanner, configure your scanner to exclude the [`database storage path`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-storage.dbPath) and the [`database log path`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-systemLog.path) from the scan.

The data files in the `database storage path` are compressed. Additionally, if you use the [encrypted storage engine](https://www.mongodb.com/docs/manual/core/security-encryption-at-rest.md#std-label-security-encryption-at-rest), the data files are also encrypted. The I/O and CPU costs to scan these files may significantly decrease performance without providing any security benefits.

If you don't exclude the directories in your `database storage path` and `database log path`, the scanner could quarantine or delete important files. Missing or quarantined files can corrupt your database and crash your MongoDB instance.

## Periodic/Ongoing Production Checks

- Periodically check for [MongoDB Product CVE](https://www.mongodb.com/alerts) and upgrade your products .

- Consult the [MongoDB end of life dates](https://www.mongodb.com/support-policy) and upgrade to the latest version.

- Ensure that your information security management system policies and procedures extend to your MongoDB installation, including performing the following:

  - Periodically apply patches to your machine.

  - Review policy/procedure changes, especially changes to your network rules to prevent inadvertent MongoDB exposure to the Internet.

  - Review MongoDB database users and periodically rotate them.

- If you're using Queryable Encryption, compact the metadata collections as directed in [Scheduling Metadata Compaction](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/manage-collections.md#std-label-qe-metadata-compaction) to reduce storage space.

## Report Suspected Security Bugs

If you suspect that you have identified a security bug in any MongoDB products, please report the issue through the MongoDB [Bug Submission Form](https://www.mongodb.com/security).