Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it.
There is some basic information in Mongodb.org. All the steps in here should be followed including enabling security. The site itself states MongoDB only has a very basic level of security. http://www.mongodb.org/display/DOCS/Security+and+Authentication
MongoDB and other NoSQL databases also have a lot less (especially security) features than mature SQL databases, so you are unlikely to find fine-grained permissions or data encryption, it uses MD5 for password hashing with the username as the seed. There are also limitations such as authentication not being available with sharding before version 1.9.1 so as always performing a risk assessment and building a threat model to work out your security needs and threats faced is good idea. Based on this output MongoDB or NoSQL databases in general may not be suitable for your needs, or you may need to use it in a different way that maximizes its advantages and minimizes its weaknesses (e.g. for extracts of data rather than your most sensitive information, or on behind a number of layers of network controls rather than directly connected to your web application).
That said, I firmly believe security principles are technology agnostic. If you analyse even the latest attacks, and a good list on datalossdb.org it is amazing how many are still related to default passwords and missing patches. With defense in depth if you follow the following practices should have sufficient security to protect most assets (e.g. individual, commercial) maybe probably not military.
Database hardening principles:
Few very initial things to remember are:
actually they are applicable on all DataStorage Services
PS: very limited mongodb experience
Full disclosure: I work for Gazzang, so this reply is related to how our product works with MongoDB.
One thing we talk to our customers a lot about is protecting the data stored on disk for mongo and further securing the access to that data via file based encryption, process-based access controls and secure controlled key provisioning and management.
With MongoDB the flexible document, json storage capabilities allow data to flow in. Since there aren't the static model controls/contraints like in a traditional database likely sensitive data that needs to be protected might flow in. The "client" apps accessing and doing analysis will constrain much of that data getting out; however, if other access is attained via apps, or access to mongo servers or to backup date, this information can be exposed.
Databases like Oracle, SQL Server, and DB2 offer TDE (Transparent Data Encryption) within their top of the line enterprise data center editions.
Our Gazzang Encryption Platform for Big Data creates the equivalent level of protection for your MongoDB data, but also encrypts other files for other security hardening needs. For example encrypting configuration or properties files that contain user/password, authentication or authorization controls, trusted nodes lists, backups, ...
It’s sort of like a firewall with rules for clients, ports, protocols, and servers. The difference is we rely on processes (exes, scripts, etc) accessing encrypted areas of the disk transparently and without key knowledge but being transparently "provisioned" by the key (because of the ACL)
I won't post all the how-to steps here – it’s not complicated - but if you’re interested in looking deeper I have blogged how to do it.