0

A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup

ufw allow 127017
ufw allow 127017/tcp

No user authentication configured for mongodb. Also no change was made to mongod.conf. This is the line in mongo.conf:

# network interfaces
net:
  port: 27017
  bindIp: 127.0.0.1

that I am betting on saved me from data hack. This line says only connections from localhost are allowed to mongodb server.

Assume that hacker is not able to login to my remote server and the only thing he came to know that I have mongodb running and port 127017 is open, is it safe to assume that my mongo data was safe?

I have now changed UFW rules to allow access to 127017 only tfrom my desktop IP address and updated mongod.conf to allow access from my desktop as well as from localhost.

  • TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017? – Teun Vink Jan 5 at 8:38
1

If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.