MongoDB
TMA-MONGODB-4.1
Ensure legacy TLS protocols are disabled
MediumLevel 2Automatedmongodb
Description
Only modern TLS protocols should be enabled in MongoDB for all client connections and upstream connections. Removing legacy TLS and SSL protocols (SSL 3.0, TLS 1.0 and 1.1), and enabling emerging and stable TLS protocols (TLS 1.2, and TLS 1.3), ensures users are able to take advantage of strong security capabilities and protects them from insecure legacy protocols. Checks the YAML config file /etc/mongod.conf (SKIP when it does not exist).
How it is checked
Audit method: File pattern
- File
/etc/mongod.conf- Pattern
(?m)^[ \t]*disabledProtocols:[^\n]*(?:TLS1_0[^\n]*TLS1_1|TLS1_1[^\n]*TLS1_0)
How it is fixed
Fix method: Guidance or infrastructure patch
Add 'disabledProtocols: TLS1_0,TLS1_1' under net.tls in /etc/mongod.conf and restart mongod/mongos.
Properties
- Operating systems
- Any
- Tags
- mongodbtlsencryption
- Reference
- CIS MongoDB 8 Benchmark v2.0.0 - 4.1 Ensure legacy TLS protocols are disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target mongodb --level 2