So, Sitecore uses MongoDB, a product that has an interesting approach to security. When you install it, by default, it doesn’t have any. By Default:

• Mongo does not require authentication
• Communication is unencrypted
• In fact, if you can connect to it, you can bugger about with the data

This is, ahem, “suboptimal”. It is, however, possible to to set it up. Options:

• Restrict IP address access at the firewall. Good practice, to be honest, and not covered here.
• Configure to use SSL
• Configure to use a username/password in connection strings

To Configure SSL:

For configuring SSL, read this post by Guy Harwood. It’s good, and addresses the difficulty of create a .pem file in Windows.

If you are running windows and haven’t installed bash just create the cert.pem file, paste in the contents of server.crt, then the contents of server.key.

You’ll also need OpenSSL to create a certificate. Unfortunately, OpenSSL don’t provide compiled code; I downloaded mine from Shining List Productions. Alternatively, you have to built it yourself. (I’m sure this is the most secure option, but for me, well, when I’m building a house, I don’t want to start by firing my own bricks.)

Set up your MongoDB configuration file:

Note the net section turns on requiring SSL, sets the PEM file, and in the case (as it’s a test system with a self-signed cert) allows invalid certificates.

Restart MongoDB

Connect to MongoDB with the command prompt client:

mongo --ssl --sslAllowInvalidCertificates server.local:12345

This should work. Now add this into your connection strings:

mongodb://server.local:12345/sitecore_tracking_live?ssl=true&sslVerifyCertificate=false

To set up Usernames and Passwords:

It’s worth understanding that:

• Mongo Users are per-database – i.e. analytics, tracking_contact, tracking_live are separate.
• You need to create your user for connection in each database.
• Without credentials you can still connect to MongoDB – but not interact with data.

To do this:

Connect to MongoDB and create a new ‘root’ user:

use admin
db.createUser({user:"admin",pwd:"password",roles:["root"]})

In YAML config file, enable authorization:

security:
authorization: "enabled"

Restart MongoDB

Connect to MongoDB from Command Prompt:

mongo --ssl --sslAllowInvalidCertificates server.local:12345 -u admin -p password --authenticationDatabase admin

Now, for each of your databases, create your user:

db.createUser({user:"myuser",pwd:"password",roles:["dbOwner"]})

Check it works. Connect as that user, to that database, and try getting data.

mongo --ssl --sslAllowInvalidCertificates server.local:27017 -u myuser -p password --authenticationDatabase sitecore_analytics

Put credentials into connection strings:

mongodb://myuser:password@server.local:12345/sitecore_analytics?ssl=true&sslVerifyCertificate=false

That should be it. Don’t forget to try with an incorrect username/password and confirm that you don’t have access to the data.