0

Is it so easy to hack mongodb database?

I created a mongodb database and added users. If I want to allow access only to these users I need to add the following parameters to the config file:

security:
  authorization: enabled

setParameter:
  authenticationMechanisms: SCRAM-SHA-1

After adding those parameters to the config file, the database requires authentication.

But a hacker can simply remove the security section from the config file and access all the stored data. Am I missing something?

  • This depends on quite a lot of things. However, file and directory permissions is something that should be configured properly. Users that have SSH access to your machine can't tamper with the configuration if these permissions are properly set. – Jeroen Sep 9 at 8:46
  • 13
    Windows are not effective at keeping thieves out. A thief could simply go into my house, open the windows from inside and then use the open window to enter my house. – MechMK1 Sep 9 at 8:47
  • 3
    "But a hacker can simply remove the security section from the config file" -- how? – duskwuff Sep 9 at 20:11
  • @Codey I didn't downvote it, and I don't know who did. I think the question is fine as it is. – MechMK1 Sep 10 at 13:34
13

While this is true, that is true for many applications. If the attacker already has access to the file system it is far too late to worry about your database server. In unix-type operating systems, the configuration file should be accessible only as root (as it is in /etc/mongodb/mongodb.conf). If the attacker has root privileges to change that file, you're boned anyway. Alternatively, the attacker could simply copy the underlying database-files, run his own mongo database server and create his own user or use it without authentication to get to your data. To prevent this, only the user that the database runs under should have access to those files.

So the issue, in this case, isn't mongo, but the security of the whole system and the stack of controls, of which securing the configuration file is one. Authentication checking is useful only when the access is coming from outside and can't be bypassed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.