MongoDBsecuritytutorial

1. authenticationauthorization

MongoDB默认circumstances under is 无authentication , 任何人都可以访问datalibrary. for 了保护datasecurity, 必须启用authenticationmechanism并设置适当 userpermission.

1.1 启用authentication

启用authentication 步骤:

// 1. 首先 in 无authentication模式 under 启动MongoDB
mongod --dbpath /data/db

// 2. 连接 to MongoDB并creationmanagement员user
mongo
use admin
db.createUser({
  user: "admin",
  pwd: "adminPassword",
  roles: [{ role: "userAdminAnyDatabase", db: "admin" }]
});

// 3. 重启MongoDB并启用authentication
mongod --dbpath /data/db --auth

// 4. usingmanagement员user连接
mongo -u admin -p adminPassword --authenticationDatabase admin

1.2 in 置role

MongoDBproviding了 many 种 in 置role, 用于不同级别 访问控制:

1.3 creationuser

// creationdatalibraryuser
use mydatabase
db.createUser({
  user: "appUser",
  pwd: "appPassword",
  roles: [{ role: "readWrite", db: "mydatabase" }]
});

// creation只读user
use mydatabase
db.createUser({
  user: "readUser",
  pwd: "readPassword",
  roles: [{ role: "read", db: "mydatabase" }]
});

// creation具 has  many 个role user
use admin
db.createUser({
  user: "opsUser",
  pwd: "opsPassword",
  roles: [
    { role: "readWrite", db: "mydatabase" },
    { role: "clusterMonitor", db: "admin" }
  ]
});

2. encryption

encryption is 保护MongoDBdatasecurity important 措施, including传输encryption and 静态encryption.

2.1 传输encryption (TLS/SSL)

configurationMongoDBusingTLS/SSLencryption客户端 and server之间 通信:

// 1. 生成certificate
openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb.pem -keyout mongodb.pem

// 2. configurationMongoDBusingTLS
mongod --dbpath /data/db --auth --sslMode requireSSL --sslPEMKeyFile /path/to/mongodb.pem

// 3. usingTLS连接
mongo --ssl -u admin -p adminPassword --authenticationDatabase admin --sslCAFile /path/to/mongodb.pem

2.2 静态encryption

MongoDB Enterpriseversionsupport静态encryption, 保护store in disk on data:

// 启用静态encryption
mongod --dbpath /data/db --auth --enableEncryption --encryptionKeyFile /path/to/keyfile

2.3 keymanagement

• using强随机key
• 定期轮换key
• securitystorekeyfile, permission设置 for 600
• 考虑using硬件securitymodule (HSM) managementkey

3. 访问控制

除了authenticationauthorization out , 还需要throughnetwork访问控制 and 防火墙规则来限制 for MongoDB 访问.

3.1 network绑定

限制MongoDB只监听specific networkinterface:

// 只监听本地interface
mongod --dbpath /data/db --auth --bind_ip 127.0.0.1

// 监听 many 个interface
mongod --dbpath /data/db --auth --bind_ip 127.0.0.1,192.168.1.100

3.2 防火墙规则

using防火墙限制 for MongoDB端口 (默认27017) 访问:

// Linux iptablesexample
iptables -A INPUT -p tcp --dport 27017 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 27017 -j DROP

// Windows防火墙example
New-NetFirewallRule -DisplayName "MongoDB" -Direction Inbound -LocalPort 27017 -Protocol TCP -Action Allow -RemoteAddress 192.168.1.0/24

3.3 copy集 and shardcluster 访问控制

for 于copy集 and shardcluster, 需要:

• for cluster in 部通信configurationkeyfile
• 确保所 has node之间 通信都经过authentication
• 限制configurationserver and routingnode 访问

// creationkeyfile
openssl rand -base64 756 > mongodb-keyfile
chmod 600 mongodb-keyfile

//  in 所 has node on using相同 keyfile
mongod --replSet rs0 --dbpath /data/db --auth --keyFile /path/to/mongodb-keyfile

4. securitybest practices

遵循以 under securitybest practices, 确保MongoDBdeployment security性:

4.1 basicsecurity措施

• 始终启用authentication: 不允许无authentication访问
• using强password: 定期轮换password
• 最 small permissionprinciples: 只授予user必要 permission
• 启用TLS/SSL: encryption所 has network通信
• 限制network访问: using防火墙 and 绑定IP

4.2 operationsecurity

• 定期backup: 确保data可以restore
• monitorauditlog: 跟踪可疑活动
• 定期update: installation最 new securitypatch
• 禁用不必要 service: such asHTTPinterface, RESTinterfaceetc.
• using专用serviceaccount: 不usingrootaccountrunMongoDB

4.3 application程序security

• parameter化query: 防止注入攻击
• encryption敏感data: such aspassword, 信用卡informationetc.
• securitystore凭证: 不 in codein硬编码password
• verification输入data: 防止恶意data注入
• 限制连接池 big small : 防止DoS攻击

4.4 securityaudit

定期forsecurityaudit, check:

• userpermission is 否适当
• is 否 has 未using useraccount
• securityconfiguration is 否符合best practices
• is 否 has 可疑 访问模式

// 启用auditlog
mongod --dbpath /data/db --auth --auditDestination file --auditFormat JSON --auditPath /path/to/audit.log