Securing Your MongoDB Implementation
Download as PPTX, PDF1 like2,894 views
The document provides an overview of securing MongoDB implementations, highlighting changes in authentication and authorization from versions 2.2 to 2.4, including the introduction of roles for better access control. It discusses SSL encryption for secure data transmission, auditing capabilities, and the importance of logging user activity. Additionally, it touches on vulnerabilities, best practices for security, and outlines future developments in MongoDB security features.
![Authentication with Kerberos
(2.4)
I am
“mark@10gen.com”, help me
prove it to mongod KDC
UDP:88 - Here is a TGT
TCP:27017 Welcome, he
Here is a re is a
Kerberos Service
TGT Ticket! UDP:8
8
Mongod {
user: ”mark@10gen.com",
roles: ["readWrite"],
userSource: "$external"
}
Securing your MongoDB Implementation, Mark Hillick](https://image.slidesharecdn.com/7-securingmongodbmarkhillick-130408135122-phpapp02/85/Securing-Your-MongoDB-Implementation-10-320.jpg)
![I can Each DB’s userAdmin gets to
I can grant
create grant privileges separately
privileges to
indices, set
the App DB
profiling, co
only
mpact
DB App: UserAdmin DB App: dbAdmin
In App.system.users :
{ {
user: “fred” , user: “george” ,
usersource: “Accnts” , usersource: “Accnts” ,
roles: [ “userAdmin” ] roles: [ “dbAdmin“ ] ,
} Credentials
from Accnts DB }
Securing your MongoDB Implementation, Mark Hillick](https://image.slidesharecdn.com/7-securingmongodbmarkhillick-130408135122-phpapp02/85/Securing-Your-MongoDB-Implementation-20-320.jpg)
Securing Your MongoDB Implementation
- 1. #MongoDBLondon Securing your MongoDB Implementation Mark Hillick - @markofu Engineer, 10gen
- 2. Agenda 1. Securing MongoDB 2.2 2. Securing MongoDB 2.4 3. Outside of MongoDB 4. Vulnerabilities 5. Documentation 6. Futures 7. Q & A Securing your MongoDB Implementation, Mark Hillick
- 4. Securing MongoDB 2.2 Authentication – Simple user/password scheme stored in MongoDB Authorization – Per database: no access, read, or read-write Auditing – Authentication requests logged – Some actions / changes captured in log Securing your MongoDB Implementation, Mark Hillick
- 5. MongoDB SSL SSL encryption SSL encryption for client for inter-server connection traffic Primary Secondary Application Data Files Data Files Keyfile establishes trust http://docs.mongodb.org/manual/administration/ssl/ Securing your MongoDB Implementation, Mark Hillick
- 8. External Authentication Use common / standardized authentication SASL: Simple Authentication and Security Layer – Framework for building authentication Kerberos – GSSAPI, drivers will be updated – Mixed system.users can work during transition Securing your MongoDB Implementation, Mark Hillick
- 9. Authentication with only pwd hash • Use one-way function F I am “[email protected]”, let me in Knows Mongod only my Prove it, here is a random # N passwor d hash Here is F(N, hash(<mypwd>)) Nobody else could know Hash never that, welcome back marko! transmitted over the network! Securing your MongoDB Implementation, Mark Hillick
- 10. Authentication with Kerberos (2.4) I am “[email protected]”, help me prove it to mongod KDC UDP:88 - Here is a TGT TCP:27017 Welcome, he Here is a re is a Kerberos Service TGT Ticket! UDP:8 8 Mongod { user: ”[email protected]", roles: ["readWrite"], userSource: "$external" } Securing your MongoDB Implementation, Mark Hillick
- 11. Authenticating & Connecting # kinit mongouser …. # klist … 03/11/13 09:30:30 03/12/13 09:30:30 … # mongo mongodb.10gen.com/$external - -authenticationMechanism=GSSAPI -u [email protected] Securing your MongoDB Implementation, Mark Hillick
- 12. Starting the Database env KRB5_KTNAME=/etc/kserver1b.keytab /usr/local/bin/mongodb/bin/mongod --auth --setParameter authenticationMechanisms=GSSAPI --dbpath /data/db --fork --logpath /var/tmp/mongod_auth.log --replSet realm4 --keyFile /etc/keyfile Securing your MongoDB Implementation, Mark Hillick
- 13. Authorization
- 14. AUTHORIZATION • Issues with 2.2 • 2.4 introduces roles – Admin level roles • UserAdmin – DB level roles • ClusterAdmin • User Admin • DB Admin • Read • ReadWrite
- 15. AUTHORIZATION Corresponding • Issues with 2.2 Admin level roles for AllDatabases – Only Read / ReadWrite – Edge-case with possible privilege escalation • 2.4 introduces roles – Admin level roles – DB level roles • UserAdmin • User Admin • ClusterAdmin • DB Admin • Read • ReadWrite Securing your MongoDB Implementation, Mark Hillick
- 16. ADMIN DB • ClusterAdmin • AllDatabases Source:https://wellsted135.files.wordpress.com/2012/10/special.gif Securing your MongoDB Implementation, Mark Hillick
- 17. Password Admin DB Accnts DB hashes • UserAdmin • UserAdmin • ClusterAdmin App DB Product • UserAdmi DB n • UserAdmin • dbAdmin • dbAdmin Customer • ReadWrite BI DB • • Read ReadWrite DB • UserAdmi • Read • UserAdmin n • dbAdmin • dbAdmin • ReadWrite • ReadWrite • Read • Read Securing your MongoDB Implementation, Mark Hillick
- 18. I can do anything but I won’t be I can add and required to do much remove shards DB Admin: UserAdmin DB Admin: ClusterAdmin I can I can grant I can create new create privileges to users but I can’t indices, set the App DB grant them profiling, co only privileges to other mpact DB’s DB Accnts: userAdmin DB App: userAdmin DB App: dbAdmin Securing your MongoDB Implementation, Mark Hillick
- 19. Super-User userAdmin & userAdminAnyDatabase are Only these users can view details about other users – system.users collection Securing your MongoDB Implementation, Mark Hillick
- 20. I can Each DB’s userAdmin gets to I can grant create grant privileges separately privileges to indices, set the App DB profiling, co only mpact DB App: UserAdmin DB App: dbAdmin In App.system.users : { { user: “fred” , user: “george” , usersource: “Accnts” , usersource: “Accnts” , roles: [ “userAdmin” ] roles: [ “dbAdmin“ ] , } Credentials from Accnts DB } Securing your MongoDB Implementation, Mark Hillick
- 21. Auditing
- 22. Additional Logging Monitor user activity: – userID added to standard output – Not currently a separate audit log – Much more coming in 2.6
- 23. Validation
- 24. Validation Objcheck – Helps prevent DOS – Validates input – SERVER-7769 (default) Securing your MongoDB Implementation, Mark Hillick
- 25. JS Engine
- 26. JS Engine Move to V8 – Primarily performance reasons but some security benefits – Restrictions on $where & M/R/F – SERVER-8104 & Aaron Heckmann’s Blog Securing your MongoDB Implementation, Mark Hillick
- 28. Outside of MongoDB Firewalls – iptables & netsh – Ports, Addresses, Times, Throttle etc F/S – Encrypt (Gazzang) Best Practices – Internal Policies (Password Reuse, Scan etc)
- 29. MongoDB - Gazzang • File System Encryption • 5% performance hit with HDD, 10-15% with SSD Gazzang Key Mgmt OS Gazzang File System – All contents encrypted Securing your MongoDB Implementation, Mark Hillick
- 30. Vulnerabilities
- 31. Vulnerabilities (1) Notify – Let us know How, What, Where? – http://docs.mongodb.org/manual/administration/vulnerabili ty-notification/ – Jira (HTTPS) & (Secure) Email Securing your MongoDB Implementation, Mark Hillick
- 32. Vulnerabilities (2) How do YOU know? – MongoDB Alerts How, What, Where? – Vulnerability Notification – Jira (HTTPS) & (Secure) Email Securing your MongoDB Implementation, Mark Hillick
- 33. Documentation
- 34. Documentation Manual – http://docs.mongodb.org/manual/security/ • Security Features within MongoDB • Best Practices & Management • Strategies • Tutorials • Vulnerability Notifications • References Securing your MongoDB Implementation, Mark Hillick
- 35. Futures
- 36. Disclaimer Statements about future releases, availability dates, and feature content reflect plans only, and 10gen is under no obligation to include, develop or make available, commercially or otherwise, specific feature discussed a future MongoDB build. Information is provided for general understanding only, and is subject to change at the sole discretion of 10gen in response to changing market conditions, delivery schedules, customer requirements, and/or other factors. Securing your MongoDB Implementation, Mark Hillick
- 37. Futures Auditing – Logging to output userID associated with actions Passwords – Stronger Hashing Authorization – User Defined & More Granularity SSL – Client Cert Validation Securing your MongoDB Implementation, Mark Hillick
- 38. Thank You
Editor's Notes
- #2: Ok, so here are the presenters notes. Your first job is to add you name and other useful stuff so that your students can contact you afterwards.This is a good time to- introduce yourself- create a seating chart, get each student to say their name, company and what they want to learn... and write it on your seating chart
- #5: system.users collection with hash password
- #11: MongoD does not even need to know the password hash!You can centralize your authentication service – SPOF & SOS
- #16: read: access to read documentsreadWrite: access to read and write documentsuserAdmin: manage, modify user access to a dbdbAdmin: compact, repair, validate etc.clusterAdmin: stuff with shards
- #17: read: access to read documentsreadWrite: access to read and write documentsuserAdmin: manage, modify user access to a dbdbAdmin: compact, repair, validate etc.clusterAdmin: stuff with shards
- #30: With SSD, as the time spent processing data between OS and disk gets proportionally larger since SSD's are so much faster, it means the pert hit is 15%. You still get a major upgrade in speed, but encrypting and decrypting take a larger share.