How to secure MongoDB replica set environment?

Question

Currently, I have 3 servers running MongoDB 3.0 as part of a Replica Set, and no security is applied. To connect I simple use

mongodb://m01,m02,m03/analytics?replicaSet=rs0

Is it possible create users and roles that will be able to connect, read & write in MongoDB to increase security?

Answer 1

You'll want to follow the MongoDB security best practices:

• Enable Access Control and Enforce Authentication - You can use the default MongoDB authentication mechanism or an existing external framework. Authentication requires that all clients and servers provide valid credentials before they can connect to the system.
• Configure Role-Based Access Control - Create a user administrator first, then create additional users. Create a unique MongoDB user for each person and application that accesses the system. Create roles that define the exact access a set of users needs. Follow a principle of least privilege. Then create users and assign them only the roles they need to perform their operations.
• Encrypt Communication - Configure MongoDB to use TLS/SSL for all incoming and outgoing connections.
• Limit Network Exposure - Ensure that MongoDB runs in a trusted network environment and limit the interfaces on which MongoDB instances listen for incoming connections. Allow only trusted clients to access the network interfaces and ports on which MongoDB instances are available.
• Audit System Activity - Track access and changes to database configurations and data. Using Enterprise edition includes a system auditing facility that can record system events
• Encrypt and Protect Data - Configure the encrypted storage engine, or use application-level or 3rd party storage encryption.
• Run MongoDB with a Dedicated User - Run MongoDB processes with a dedicated operating system user account. Ensure that the account has permissions to access data but no unnecessary permissions.
• Run MongoDB with Secure Configuration Options - Disable server-side scripting if you are not using it. Do not enable the following, all of which enable the web server interface: net.http.enabled, net.http.JSONPEnabled, and net.http.RESTInterfaceEnabled. Keep input validation enabled.
• Don’t Ignore Security Best Practices - Review the MongoDB Security documentation to make sure you are following the best practices.