Skip to main content

Security

In this tutorial, we will be discussing one of the most crucial aspects of MongoDB: Security. As a MongoDB beginner, it's highly important to understand the security measures that can be implemented to protect your data. We will go through the different security features provided by MongoDB, and how to implement them to secure your MongoDB installations.

Authentication​

Authentication is the process of verifying the identity of a user, application or server. MongoDB supports a number of authentication mechanisms that clients can use to verify their identity. These include:

  • SCRAM (Salted Challenge Response Authentication Mechanism): The default authentication method used by MongoDB. It is a password-based authentication mechanism, which makes use of user credentials.
  • x.509 Certificate Authentication: It authenticates a user whose name derives from the distinguished subject field of the X.509 certificate presented by the driver during SSL negotiation.

To enable authentication in MongoDB, you have to start the MongoDB server with the --auth option. Then, you can create users using the db.createUser() method.

Authorization​

Authorization is the process of determining what actions an authenticated user can perform on a specified resource. MongoDB’s authorization model is role-based. Some of the built-in roles provided by MongoDB include:

  • read: Allows users to read data from the database.
  • readWrite: Allows users to read and modify data in the database.
  • dbAdmin: Allows users to perform administrative tasks such as schema-related operations, indexing, and gathering statistics.

You can assign roles to users using the db.grantRolesToUser() method.

Encryption​

MongoDB supports encryption at rest and encryption in transit.

Encryption at rest is about encrypting data that is stored physically in any digital form. MongoDB Enterprise includes a storage engine, WiredTiger, which allows the encryption of data at rest.

Encryption in transit is about encrypting data while it is being transferred from one network to another. MongoDB supports the use of Transport Layer Security (TLS) and Secure Sockets Layer (SSL) to encrypt connections between the client and the server.

Remember, enabling encryption might increase the CPU usage, but it is a necessary step to ensure your data is secure.

Auditing​

MongoDB Enterprise supports auditing of system activity by maintaining an audit log in JSON or BSON format. Auditing can be used to track system activity for deployments with multiple users and applications. The auditing capability allows administrators to verify proper controls and manage risk.

Firewalls​

By setting up firewalls, you can control traffic based on IP addresses. You can configure MongoDB to only accept connections from certain IP addresses, minimizing the risk of unauthorized access.

Conclusion​

Security is a vast topic and can never be taken lightly. While this tutorial provides an overview of some of the best practices to secure MongoDB, it's recommended to read the MongoDB manual for a deeper understanding. Ensuring your MongoDB databases are secure will help protect your data and keep your systems running smoothly.