Archive Trac mongo security

Mongo Security

Legacy Trac archive page imported from mongo_security. Source: https://genapp.rocks/wiki/wiki/mongo_security. Review age, links, and examples before treating as current.

mongo security setup

• mongo requires some sort of security if accessible from other than localhost

• change dockerfile to use host genapp_docker_mongo

  • this works without "allInvalidHostname*

updated to do 8 nov 18

• mongo in container seems an issue, not working with ssl certs
  • double check this
  • YES it works, need to bind to 0.0.0.0, not 127.0.0.1
  • for connecting as another ip net.ssl.allowInvalidHostnames to avoid The server certificate does not match the host name.
  • better is host mode networking: e.g. docker run --network=host -h 127.0.0.1
  • maybe one key, multiple certs in PEM:
  • https://stackoverflow.com/questions/14464441/how-to-create-a-self-signed-x509-certificate-with-both-private-and-public-keys
  • e.g. tried this, but maybe my assembly is incorrect

openssl req -new -key mongodb.pem -out mongodb2.csr
openssl x509 -req -days 365 -in mongodb2.csr -signkey mongodb.pem -out mongodb2.crt

- tried various orders with that, but can't seem to work it.
- maybe https://www.mongodb.com/blog/post/secure-mongodb-with-x-509-authentication
- or http://pe-kay.blogspot.com/2016/02/securing-mongodb-using-x509-certificate.html

action plan

• test mongo ssl access
  • https://docs.mongodb.com/manual/tutorial/configure-x509-client-authentication/
  • https://medium.com/@rajanmaharjan/secure-your-mongodb-connections-ssl-tls-92e2addb3c89
  1. run mongod with command line args
  2. setup mongo without authentication but with ssl
  3. test local and remote access
• ssl alone works, cool
  • php with ssl

setup security

• base upon https://docs.mongodb.com/v3.6/tutorial/configure-ssl/
• generate certs

# generate a 365 day certificate
cd /etc/ssl/
openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key
# cert CN must match bind ip?
# create a pem combining the key and cert
cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
# start mongo from command line
mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --bind_ip xx.xx.xx.xx <additional options>
e.g. for gadocker.tacc
mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --bind_ip 0.0.0.0
# or maybe ? 172.18.228.12

# connect to mongo requiring encryption
mongo --ssl --host `hostname` --sslCAFile /etc/ssl/mongodb-cert.crt

php 5.x connect

<?php

$mc = new MongoClient(
    "mongodb://js-17-194.jetstream-cloud.org/?ssl=true",
    [], [ "context" => stream_context_create( [ "ssl" => [ "cafile" => "/etc/ssl/mongodb-cert.crt" ] ] ) ]
    );

initial questions

• question: can mongo run with certs and not users for public access? cert based roles without passwords?
  • maybe? https://docs.mongodb.com/manual/tutorial/configure-x509-client-authentication/
• have to setup auth for secure runs https://ianlondon.github.io/blog/mongodb-auth/
  • this works, but not using ssl, so pwd's are probably plaintext:
  • https://gist.github.com/davideicardi/f2094c4c3f3e00fbd490
  • setup certs
  • mongo has good security docs, e.g. https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/