CIS MongoDB 8.0 Benchmark

This recommendation verifies that MongoDB Is Installed from Official Repositories on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mongoDB Is Installed from Official Repositories may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

mongod --version
apt list --installed 2>/dev/null | grep mongodb-org
yum list installed 2>/dev/null | grep mongodb-org

# Add the official MongoDB repository:
# For RHEL/CentOS:
cat <<EOF > /etc/yum.repos.d/mongodb-org-8.0.repo
[mongodb-org-8.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/\$releasever/mongodb-org/8.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://pgp.mongodb.com/server-8.0.asc
EOF

# For Debian/Ubuntu:
# Import the MongoDB public GPG key and add the repository
wget -qO - https://pgp.mongodb.com/server-8.0.asc | sudo apt-key add -
echo "deb https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/8.0 multiverse" | \
  sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list

# Install from the official repository:
sudo yum install -y mongodb-org   # RHEL/CentOS
sudo apt-get install -y mongodb-org  # Debian/Ubuntu

This recommendation verifies that MongoDB Runs as a Dedicated Service Account on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mongoDB Runs as a Dedicated Service Account may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps -ef | grep mongod | grep -v grep
# Should run as 'mongod' user, not root

# /etc/mongod.conf:
processManagement:
  fork: true

# Start with: sudo -u mongod mongod --config /etc/mongod.conf

This recommendation verifies that the Latest Stable Version Is Installed on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Latest Stable Version Is Installed may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

mongod --version
# Compare against https://www.mongodb.com/docs/manual/release-notes/

# Update MongoDB to the latest stable version:
# RHEL/CentOS:
sudo yum update -y mongodb-org

# Debian/Ubuntu:
sudo apt-get update && sudo apt-get install -y mongodb-org

# Verify the installed version:
mongod --version

# After updating, restart the mongod service:
sudo systemctl restart mongod

This setting controls whether Authentication is enabled on the MongoDB 8 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via mongod.conf, mongosh, or database configuration.

Without Authentication enabled, the MongoDB 8 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -E "^\s*authorization:" /etc/mongod.conf
# Should be: authorization: enabled

# Or from mongo shell:
db.adminCommand({getParameter: 1, authenticationMechanisms: 1})

# /etc/mongod.conf:
security:
  authorization: enabled

This recommendation verifies that No Default or Empty Passwords is present on the MongoDB 8 database server. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Default or Empty Passwords leaves the MongoDB 8 database server without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

db.system.users.find({}, {user: 1, db: 1})
# Review each user account exists with a password

db.changeUserPassword("username", "<strong_password>")

This recommendation verifies that SCRAM-SHA-256 Is the Authentication Mechanism on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sCRAM-SHA-256 Is the Authentication Mechanism may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

db.adminCommand({getParameter: 1, authenticationMechanisms: 1})
# Should include SCRAM-SHA-256

# /etc/mongod.conf:
setParameter:
  authenticationMechanisms: SCRAM-SHA-256

This recommendation verifies that X.509 Certificate Authentication Is Used for Clients on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to x.509 Certificate Authentication Is Used for Clients may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if x509 authentication is configured:
db.adminCommand({getParameter: 1, authenticationMechanisms: 1})
# Should include MONGODB-X509

# /etc/mongod.conf:
net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongo/server.pem
    CAFile: /etc/ssl/mongo/ca.pem
    clusterFile: /etc/ssl/mongo/cluster.pem

This recommendation verifies that LDAP Authentication Is Configured Where Applicable on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to lDAP Authentication Is Configured Where Applicable may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Enterprise only; check LDAP config:
grep -A5 "ldap:" /etc/mongod.conf

# Configure LDAP authentication in mongod.conf:
security:
  authorization: enabled
  ldap:
    servers: "ldap.example.com"
    transportSecurity: tls
    bind:
      method: simple
      queryUser: "cn=admin,dc=example,dc=com"
      queryPassword: "<secure_password>"
    userToDNMapping:
      '[{ match: "(.+)", substitution: "uid={0},ou=users,dc=example,dc=com" }]'

setParameter:
  authenticationMechanisms: PLAIN

# Restart MongoDB after configuration:
sudo systemctl restart mongod

This recommendation verifies that Least Privilege Principle for User Roles on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to least Privilege Principle for User Roles may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

db.getUsers({showPrivileges: true})
# Review each user's roles — avoid root, dbOwner where not needed

db.revokeRolesFromUser("appUser", ["dbOwner"])
db.grantRolesToUser("appUser", ["readWrite"])

This recommendation verifies that the 'root' Role Is Only Assigned to Admin Users on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the 'root' Role Is Only Assigned to Admin Users may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

db.adminCommand({usersInfo: 1})
# Inspect each user's roles[] array for 'root'

use admin
db.revokeRolesFromUser("non_admin_user", [{role: "root", db: "admin"}])

This recommendation verifies that Custom Roles Are Used for Application Access on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to custom Roles Are Used for Application Access may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

db.getRoles({showPrivileges: true})

db.createRole({
  role: "appReadOnly",
  privileges: [
    { resource: { db: "appdb", collection: "" }, actions: ["find"] }
  ],
  roles: []
})

This recommendation verifies that TLS Is Enabled for All Connections on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Enabled for All Connections may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -A3 "net:" /etc/mongod.conf | grep -E "mode:|tls:"
# net.tls.mode should be 'requireTLS'

# /etc/mongod.conf:
net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongo/server.pem
    CAFile: /etc/ssl/mongo/ca.pem

This recommendation verifies that TLS 1.2 or Higher Is Used on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS 1.2 or Higher Is Used may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "disabledProtocols" /etc/mongod.conf
# Should disable TLS1_0,TLS1_1

# /etc/mongod.conf:
net:
  tls:
    disabledProtocols: TLS1_0,TLS1_1

This recommendation verifies that Certificate Validation Is Enforced on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to certificate Validation Is Enforced may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "allowConnectionsWithoutCertificates" /etc/mongod.conf
# Should be false or absent

# /etc/mongod.conf:
net:
  tls:
    allowConnectionsWithoutCertificates: false

This setting controls whether Encryption at Rest is enabled on the MongoDB 8 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via mongod.conf, mongosh, or database configuration.

Without Encryption at Rest enabled, the MongoDB 8 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -A5 "encryptionAtRest:" /etc/mongod.conf
# Enterprise: encryptionCipherMode should be AES256-CBC or AES256-GCM

# /etc/mongod.conf (Enterprise only):
security:
  enableEncryption: true
  encryptionCipherMode: AES256-CBC
  encryptionKeyFile: /etc/ssl/mongo/encryption-key

This recommendation verifies that Client-Side Field Level Encryption Is Used for Sensitive Data on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to client-Side Field Level Encryption Is Used for Sensitive Data may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review application code for CSFLE or Queryable Encryption implementation on fields containing PII, PHI, or payment data.

Implement MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption in application code. Use the MongoDB driver's encryption library to define encrypted field mappings for sensitive data including PII, PHI, and payment information. Create a Customer Master Key (CMK) through a supported KMS provider (AWS KMS, Azure Key Vault, GCP KMS, or a local key for testing). Generate data encryption keys and configure the AutoEncryptionSettings with the appropriate schema map. Update application connection logic to use the encryption-aware client. Test by verifying that sensitive fields are stored as Binary subtype 6 in the database rather than plaintext.

This setting controls whether Auditing is enabled on the MongoDB 8 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via mongod.conf, mongosh, or database configuration.

Without Auditing enabled, the MongoDB 8 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# Enterprise only:
grep -A5 "auditLog:" /etc/mongod.conf

# /etc/mongod.conf:
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json

This recommendation verifies that Audit Filters Capture Auth Events on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to audit Filters Capture Auth Events may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "filter" /etc/mongod.conf

# /etc/mongod.conf:
auditLog:
  filter: '{ atype: { $in: ["authenticate", "createUser", "dropUser", "grantRole", "revokeRole"] } }'

This recommendation verifies that Log Output Uses a File Destination on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Output Uses a File Destination may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -A3 "systemLog:" /etc/mongod.conf
# systemLog.destination should be 'file'

# /etc/mongod.conf:
systemLog:
  destination: file
  path: /var/log/mongodb/mongod.log
  logAppend: true

This recommendation verifies that Log Verbosity Is Appropriate on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Verbosity Is Appropriate may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

db.adminCommand({getParameter: 1, logLevel: 1})
# Default 0 is acceptable; increase for troubleshooting

db.adminCommand({setParameter: 1, logLevel: 0})

This recommendation addresses the proper configuration of Log Rotation on the MongoDB 8 database server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Log Rotation can lead to security gaps that may be exploited by attackers. A properly configured MongoDB 8 database server reduces exposure to both known vulnerabilities and configuration drift.

grep "logRotate" /etc/mongod.conf
# Or check logrotate.d config:
cat /etc/logrotate.d/mongod

# /etc/mongod.conf:
systemLog:
  logRotate: rename

# Or use logrotate:
# /etc/logrotate.d/mongod
/var/log/mongodb/mongod.log {
  daily
  rotate 30
  compress
  missingok
  notifempty
  postrotate
    /bin/kill -SIGUSR1 $(cat /var/run/mongodb/mongod.pid)
  endscript
}

This recommendation verifies that Data Directory Has Appropriate Permissions on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to data Directory Has Appropriate Permissions may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /var/lib/mongodb
# Should be 750 mongod:mongod

chmod 750 /var/lib/mongodb
chown mongod:mongod /var/lib/mongodb

This recommendation verifies that Configuration File Has Appropriate Permissions on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to configuration File Has Appropriate Permissions may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /etc/mongod.conf
# Should be 640 root:mongod

chmod 640 /etc/mongod.conf
chown root:mongod /etc/mongod.conf

This recommendation verifies that Key File Has Appropriate Permissions on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to key File Has Appropriate Permissions may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /etc/ssl/mongo/*.pem
# Should be 600 mongod:mongod

chmod 600 /etc/ssl/mongo/*.pem
chown mongod:mongod /etc/ssl/mongo/*.pem

This recommendation verifies that MongoDB Binds to Specific Interfaces on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mongoDB Binds to Specific Interfaces may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "bindIp" /etc/mongod.conf
# Should NOT be 0.0.0.0

# /etc/mongod.conf:
net:
  bindIp: 127.0.0.1

This recommendation verifies that the Default Port Is Changed on the MongoDB 8 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Default Port Is Changed may leave the MongoDB 8 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "port:" /etc/mongod.conf
# Default 27017 — consider changing

# /etc/mongod.conf:
net:
  port: 27018

This setting controls whether HTTP Interface and REST API is disabled on the MongoDB 8 database server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving HTTP Interface and REST API enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the MongoDB 8 database server.

# Deprecated in 3.6+, but verify:
grep "httpEnabled\|RESTInterfaceEnabled" /etc/mongod.conf
# Should not be present or should be false

# Disable the HTTP interface and REST API in mongod.conf:
net:
  http:
    enabled: false
    RESTInterfaceEnabled: false

# Or start mongod with the flags:
mongod --nohttpinterface

# Restart MongoDB to apply changes:
sudo systemctl restart mongod

# Verify the HTTP interface is not accessible:
curl -s http://localhost:28017/ | head -1
# Should return connection refused

This setting controls whether Server-Side JavaScript Execution is disabled on the MongoDB 8 database server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Server-Side JavaScript Execution enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the MongoDB 8 database server.

db.adminCommand({getParameter: 1, javascriptEnabled: 1})
# Should be false if not needed

# /etc/mongod.conf:
security:
  javascriptEnabled: false