Ensure authentication file permissions are set correctly
Details The key file is used for authentication in the sharded cluster. Implementing proper file permissions on the key file...
- Home
- Security Hardening
- CIS MongoDB 3.6L1 Unix V1.0.0
CIS MongoDB 3.6L1 Unix V1.0.0
Ensure Authentication is configured
Details This setting ensures that all clients, users, and/or servers are required to authenticate prior to being granted access to...Ensure authentication is enabled in the sharded cluster
Details Authentication is enabled in a sharded cluster when the certificate or key files are created and configured for all...Ensure Encryption of Data in Transit TLS/SSL (Transport Encryption)
Details Use TLS or SSL to protect all incoming and outgoing connections. This should include using TLS or SSL to...Ensure that audit filters are configured properly
Details MongoDB Enterprise supports auditing of various operations. When enabled, the audit facility, by default, records all auditable operations as...Ensure that database file permissions are set correctly
Details MongoDB database files need to be protected using file permissions. Rationale: This will restrict unauthorized users from accessing the...Ensure that logging captures as much information as possible
Details The SystemLog.quiet option stops logging of information such as: connection events authentication events replication sync activities evidence of some...Ensure that MongoDB does not bypass authentication via the localhost exception
Details MongoDB should not be set to bypass authentication via the localhost exception. The localhost exception allows the user to...Ensure that MongoDB is run using a Least Privileges, dedicated service account
Details The MongoDB service should not be run using a privileged account such as ‘root’ because this unnecessarily exposes the...Ensure that MongoDB only listens for network connections on authorized interfaces
Details Ensuring that MongoDB runs in a trusted network environment involves limiting the network interfaces on which MongoDB instances listen...