MongoDB Documentation, Release 3.0.4 For MongoDB deployments on Amazon’s web services, see the Amazon EC2 16 page, which addresses Amazon’s Security Groups and other EC2-specific security features. Virtual private networks, or VPNs, make it possible to link two networks over an encrypted and limited-access trusted network. Typically, MongoDB users who use VPNs use TLS/SSL rather than IPSEC VPNs for performance issues. Depending on configuration and implementation, VPNs provide for certificate validation and a choice of encryption protocols, which requires a rigorous level of authentication and identification of all clients. Furthermore, because VPNs provide a secure tunnel, by using a VPN connection to control access to your MongoDB instance, you can prevent tampering and “man-in-the-middle” attacks. The following section contains strategies to limit risks related to MongoDB’s available interfaces including JavaScript, HTTP, and REST interfaces. The following JavaScript evaluation behaviors of the mongo shell represents risk exposures. The mongo program can evaluate JavaScript expressions using the command line --eval option. Also, the mongo program can evaluate a JavaScript file ( .js ) passed directly to it (e.g. mongo someFile.js ). Because the mongo program evaluates the JavaScript directly, inputs should only come from trusted sources. Virtual Private Networks 6.2.5 Security and MongoDB API Interfaces JavaScript and the Security of the mongo Shell JavaScript Expression or JavaScript File .mongorc.js File If a .mongorc.js file exists $^{17}$, the mongo shell will evaluate a .mongorc.js file before starting. You can disable this behavior by passing the mongo --norc option. Warning: Ensure that the HTTP status interface, the REST API, and the JSON API are all disabled in production environments to prevent potential data exposure and vulnerability to attackers. HTTP Status Interface The HTTP status interface provides a web-based interface that includes a variety of operational data, logs, and status reports regarding the mongod or mongos instance. The HTTP interface is always available on the port numbered 1000 greater than the primary mongod port. By default, the HTTP interface port is 28017 , but is indirectly set using the port option which allows you to configure the primary mongod port. Without the net.http.RESTInterfaceEnabled setting, this interface is entirely read-only, and limited in scope; nevertheless, this interface may represent an exposure. To disable the HTTP interface, set the enabled run time option or the --nohttpinterface command line option. See also Configuration Options (page 327). $^{16}$https://docs.mongodb.org/ecosystem/platforms/amazon-ec2 17 On Linux and Unix systems, mongo reads the .mongorc.js file from $HOME /.mongorc.js (i.e. ~/.mongorc.js ). On Windows, mongo.exe reads the .mongorc.js file from %HOME% .mongorc.js or %HOMEDRIVE%%HOMEPATH% .mongorc.js . 329 6.2. Security Concepts