4.1 Ensure Encryption of Data in Transit TLS/SSL (Transport Encryption)

Information

Use TLS or SSL to protect all incoming and outgoing connections. This should include using TLS or SSL to encrypt communication between the mongod and mongos components of a MongoDB client as well as between all applications and MongoDB.

MongoDB supports TLS/SSL (Transport Layer Security/Secure Sockets Layer) to encrypt all of MongoDB's network traffic. TLS/SSL ensures that MongoDB network traffic is only readable by the intended client.

Rationale:

This prevents sniffing of cleartext traffic between MongoDB components or performing a man-in-the-middle attack for MongoDB.

Solution

Configure MongoDB servers to require the use of SSL or TLS to encrypt all MongoDB network communications.
To implement SSL or TLS to encrypt all MongoDB network communication, perform the following steps:
For mongod ('Primary daemon process for the MongoDB system')
In the configuration file /etc/mongod.conf, set the PEMKeyFile option to the certificate file's path and then start the component with this command:

ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/ca.pem

And restart monogdb instance with

mongod --config /etc/mongod.conf

Or

mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --sslCAFile /etc/ssl/ca.pem

Default Value:

Not configured

See Also

https://workbench.cisecurity.org/files/3560

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: bf04ac322048cc9a3d92e21391316411f34e00882121fd36403eb70dc800ec5c