Argentina
Australia
Austria
Belgium
Brazil
Bulgaria
Canada
Chile
Colombia
Cyprus
Czechia
Denmark
Ecuador
Egypt
Estonia
Finland
France
Germany
Great Britain
Greece
Hungary
India
Indonesia
Ireland
Italy
Japan
Latvia
Lithuania
Luxembourg
Malaysia
Malta
Mexico
Netherlands
New Zealand
Norway
Philippines
Poland
Portugal
Romania
Russia
Singapore
Slovakia
Slovenia
South Africa
South Korea
Spain
Sweden
Switzerland
Taiwan
Thailand
Turkey
Ukraine
United States
Doug Bierer
This chapter explains how to secure the database itself, add users, and adjust permissions to specific collections. You will also learn how to enforce authentication and create an admin user. In addition, we will address how to configure MongoDB to use SSL/TLS.
The topics that are going to be covered in this chapter are as follows:
By default, after first installing the MongoDB database, there will be no security. Unlike earlier versions, however, as of MongoDB version 4.0, mongod binds to localhost, which provides a limited measure of safety. This lack of security facilitates initial administration and development. A production server, of course, will need a full measure of security.
Before deploying any measures (for example, replication or sharding) which would cause the database to be exposed to the company network, you should first implement proper security measures. MongoDB security encompasses several aspects, all of which are covered in this chapter. These include transport layer security, authentication, and access control.
The basic checklist for establishing security is as follows:
Contrary to what you would expect from its name, Transport Layer Security (https://en.wikipedia.org/wiki/Transport_Layer_Security) does not concern the TCP (Transmission Control Protocol) layer of the TCP/IP protocol stack. Instead, TLS in this context applies to the application (https://en.wikipedia.org/wiki/Application_layer) (top) layer. The data at this layer is transmitted using end-to-end encryption based on a secret which the sender and receiver share, thus ensuring the privacy of the communication. In addition, depending on how the protocol is configured, one or both sides can be authenticated, and a message integrity check can be enabled to ensure the reliability of the message.
Two protocols are used to ensure transport layer security: SSL (Secure Sockets Layer) and TLS . Of the two, only TLS should be used, and even at that, the later the version...
Authentication is the process of determining are you who you say you are?. Authentication is not required until you enable access control (covered in the next section). At first, it might appear that authentication and access control are the same thing. They are both aspects of security, but authentication occurs before access control. In other words, MongoDB needs to first confirm you are who you say you are before deciding what actions you are allowed to perform.
Authentication itself takes different forms. In one case, you might be a user who wishes to run commands via the mongo shell. Another case would be a series of database commands being issued by an application using a MongoDB programming language driver. There is yet a third form of authentication whereby you can configure authentication between servers in a replica set or a sharded cluster (see Chapter...
Access control (also referred to as authorization) defines and enforces what actions a database user is allowed to perform once authenticated. Access control follows authentication: you cannot have one without the other! As you may recall from our previous discussion, authentication is the process of determining the identity of a user. Access control, on the other hand, determines what the user can do.
You establish access control over one or more databases by assigning privilege actions (https://docs.mongodb.com/manual/reference/privilege-actions/#privilege-actions) to roles. Privileges fall into three general categories: CRUD (Create Read Update Delete) operations, Database Management (for example, managing database users), and Infrastructure Management (for example, replication and sharding operations).
In this chapter, you learned about the different aspects of security in a MongoDB installation. After an initial overview, you learned about transport layer security, and how to configure MongoDB for TLS/SSL. After that, you learned about the different authentication mechanisms available, including SCRAM and x.509 certificates. You also learned about Kerberos and LDAP, which are only available in the MongoDB Enterprise Edition. After that, you learned how to enable authentication and create an admin user. You then learned about the various database privilege actions which can be applied to roles. You also learned about some of the built-in roles and how to define your own. Finally, you learned how to create database users and assign them to one or more roles.
In the next chapter, you will be given a walkthrough of a complete application based upon MongoDB, including capturing...
The rest of the chapter is locked
© 2018 Packt Publishing Limited All Rights Reserved
