Security

After the recent waves of ransomware locking MongoDB administrators out of their servers and asking for cryptocurrency payments to unlock them, many developers have become more security-conscious. Security is one of the items on a checklist that we as developers may not prioritize highly enough due to the optimistic belief that it won't happen to us. The truth is that, in the modern internet landscape, everyone may become a target of automated or directed attacks, so security should always be taken into account from the early stages of design until after production deployment.

Enabling security by default

Every database, other than maybe local development servers, should be set up with the following in the mongod.conf file:

auth = true

Note

SSL should be always enabled, as described in the relevant Chapter 7, Monitoring, Backup and Security.

REST and HTTP status interfaces should be disabled by adding the following lines in mongod.conf:

nohttpinterface = true
rest = false

Access should...