TMA-MONGODB-3.5

Review Superuser/Admin Roles

높음레벨 2수동 검토mongodb

설명

Roles provide several advantages that make it easier to manage privileges in a database system. Security administrators can control access to their databases in a way that mirrors the structure of their organizations (they can create roles in the database that map directly to the job functions in their organizations). The assignment of privileges is simplified.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

In mongosh run db.runCommand({rolesInfo: 1, showBuiltinRoles: true}) and db.getSiblingDB("admin").system.users.find({"roles.role": {$in: ["root", "dbOwner", "userAdmin", "userAdminAnyDatabase", "readWriteAnyDatabase", "dbAdminAnyDatabase", "clusterAdmin", "hostManager", "restore"]}}, {user: 1, roles: 1}). Confirm each holder of a superuser/admin role is approved; revoke the rest with db.revokeRolesFromUser().

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remove a user from one or more roles on the current database. use \<dbName\> db.revokeRolesFromUser( "\<username\>", [ \<roles\> ])

속성

운영 체제: 모두
태그: mongodbprivileges
참고 자료: CIS MongoDB 8 Benchmark v2.0.0 - 3.5 Review Superuser/Admin Roles