Ensure authentication is enabled in the sharded cluster
Details Authentication is enabled in a sharded cluster when keyfiles are created and configured for all components. This ensures that...
- Home
- Security Hardening
- CIS MongoDB 3.4 L1 Unix V1.0.0
CIS MongoDB 3.4 L1 Unix V1.0.0
Ensure Federal Information Processing Standard (FIPS) is enabled
Details The Federal Information Processing Standard (FIPS) is a computer security standard used to certify software modules and libraries that...Ensure that audit filters are configured properly
Details MongoDB Enterprise supports auditing of various operations. When enabled, the audit facility, by default, records all auditable operations as...Ensure that authentication is enabled for MongoDB databases
Details This setting ensures that all clients, users, and/or servers are required to authenticate prior to being granted access to...Ensure that database file permissions are set correctly
Details MongoDB database files need to be protected using file permissions. Rationale: This will restrict unauthorized users from accessing the...Ensure that key file permissions are set correctly
Details The key file is used for authentication in the sharded cluster. Implementing proper file permissions on the key file...Ensure that MongoDB does not bypass authentication via the localhost exception
Details MongoDB should not be set to bypass authentication via the localhost exception. The localhost exception allows you to enable...Ensure that MongoDB is run using a non-privileged, dedicated service account
Details The MongoDB service should not be run using a privileged account such as ‘root’ because this unnecessarily exposes the...Ensure that MongoDB only listens for network connections on authorized interfaces
Details Ensuring that MongoDB runs in a trusted network environment involves limiting the network interfaces on which MongoDB instances listen...Ensure that MongoDB uses a non-default port
Details Changing the port used by MongoDB makes it harder for attackers to find the database and target it. Rationale:...