Ensure that MongoDB does not bypass authentication via the localhost exception

高级别 1自动化mongodb

说明

MongoDB should not be set to bypass authentication via the localhost exception. The localhost exception allows the user to enable authorization before creating the first user in the system. When active, the localhost exception allows all connections from the localhost interface to have full access to that instance. The exception applies only when there are no users created in the MongoDB instance. Checks the YAML config file /etc/mongod.conf (SKIP when it does not exist). The localhost exception is enabled by default, so the setting must be present and false.

检查方式

审计方法: 文件正则匹配

文件: /etc/mongod.conf
匹配模式: (?m)^[ \t]*enableLocalhostAuthBypass:[ \t]*['\x22]?(?:false|0)\b

修复方式

修复方法: 操作指南或基础设施补丁

Add 'setParameter: {enableLocalhostAuthBypass: false}' to /etc/mongod.conf (or start mongod with --setParameter enableLocalhostAuthBypass=0) and restart mongod.

属性

操作系统: 任意
标签: mongodbauthentication
参考: CIS MongoDB 8 Benchmark v2.0.0 - 2.2 Ensure that MongoDB does not bypass authentication via the localhost exception

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target mongodb