Securing MongoDB (Brief Notes)

So, Sitecore uses MongoDB, a product that has an interesting approach to security. When you install it, by default, it doesn’t have any. By Default:

  • Mongo does not require authentication
  • Communication is unencrypted
  • In fact, if you can connect to it, you can bugger about with the data

This is, ahem, “suboptimal”. It is, however, possible to to set it up. Options:

  • Restrict IP address access at the firewall. Good practice, to be honest, and not covered here.
  • Configure to use SSL
  • Configure to use a username/password in connection strings

To Configure SSL:

For configuring SSL, read this post by Guy Harwood. It’s good, and addresses the difficulty of create a .pem file in Windows.

If you are running windows and haven’t installed bash just create the cert.pem file, paste in the contents of server.crt, then the contents of server.key.

You’ll also need OpenSSL to create a certificate. Unfortunately, OpenSSL don’t provide compiled code; I downloaded mine from Shining List Productions. Alternatively, you have to built it yourself. (I’m sure this is the most secure option, but for me, well, when I’m building a house, I don’t want to start by firing my own bricks.)

Set up your MongoDB configuration file:

Configuration File

Note the net section turns on requiring SSL, sets the PEM file, and in the case (as it’s a test system with a self-signed cert) allows invalid certificates.

Restart MongoDB

Connect to MongoDB with the command prompt client:

mongo --ssl --sslAllowInvalidCertificates server.local:12345

This should work. Now add this into your connection strings:

mongodb://server.local:12345/sitecore_tracking_live?ssl=true&sslVerifyCertificate=false

To set up Usernames and Passwords:

It’s worth understanding that:

  • Mongo Users are per-database – i.e. analytics, tracking_contact, tracking_live are separate.
  • You need to create your user for connection in each database.
  • Without credentials you can still connect to MongoDB – but not interact with data.
Command Line showing an anonymous user unable to get data.
Command Line showing an anonymous user unable to get data.

To do this:

Connect to MongoDB and create a new ‘root’ user:

use admin
db.createUser({user:"admin",pwd:"password",roles:["root"]})

In YAML config file, enable authorization:

security:
authorization: "enabled"

Restart MongoDB

Connect to MongoDB from Command Prompt:

mongo --ssl --sslAllowInvalidCertificates server.local:12345 -u admin -p password --authenticationDatabase admin

Now, for each of your databases, create your user:

db.createUser({user:"myuser",pwd:"password",roles:["dbOwner"]})

Check it works. Connect as that user, to that database, and try getting data.

mongo --ssl --sslAllowInvalidCertificates server.local:27017 -u myuser -p password --authenticationDatabase sitecore_analytics

Put credentials into connection strings:

mongodb://myuser:password@server.local:12345/sitecore_analytics?ssl=true&sslVerifyCertificate=false

That should be it. Don’t forget to try with an incorrect username/password and confirm that you don’t have access to the data.

Advertisements
Securing MongoDB (Brief Notes)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s