1

As the title suggests. If I set the net.bindIp setting in mongod.conf to 0.0.0.0 on port 27017 this should open it up to all incoming connections. However, if in my ec2 instance I whitelist only my local IP on 27017, will this block all other incoming connections?

I should also note I have a mongodb user with a password set for my db with security.authorization: 'enabled' also set in mongod.conf

Asking for a friend... Thanks

1

A few thoughts in no particular order:

  1. It is as secure as your (or your companies) ability to leave the firewall configuration unchanged and not come back later and open it up to the whole world because, "This is inconvenient".
  2. It is as secure as your machine is.
  3. It is secure until your IP changes, you forget to update the firewall rule, and your current IP is reassigned
  4. It is secure until someone is doing something else and accidentally changes the configuration without realizing it.
  5. It is not as secure as putting the instance in a private subnet and connecting through a bastion host
  6. It is not as secure as a database server that has no internet access at all and is sunk to the bottom of the sea after being encased in 10 feet of solid concrete

The key is to accept the fact that there is never perfect security, understand the risks posed by your chosen configuration, and find the right balance between security and usability for you.

3
  • Message received. Taking that into account, I will conclude that it is relatively secure for my needs. At least good enough for the girls I hangout with. Nov 3 '20 at 20:13
  • Edit: my friend's needs... Nov 3 '20 at 20:17
  • 1
    @luckyging3r :) It's not as secure as some options, but it is more secure than most configurations I've seen. Fortunately security isn't a contest, it's just a matter of finding what works for you. Nov 4 '20 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.