Detections
Analytics

MD7X-00-000400 MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.

Information

MongoDB must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components.

Satisfies: SRG-APP-000080-DB-000063, SRG-APP-000089-DB-000064, SRG-APP-000090-DB-000065, SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000092-DB-000208, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000109-DB-000049, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000494-DB-000344, SRG-APP-000494-DB-000345, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000498-DB-000346, SRG-APP-000498-DB-000347, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000502-DB-000348, SRG-APP-000502-DB-000349, SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000505-DB-000352, SRG-APP-000506-DB-000353, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the MongoDB configuration file (default location: /etc/mongod.conf) and add a configured "auditLog" setting:

auditLog:
 destination: file
 format: BSON
 path: <mongodb audit log directory>/auditLog.bson

-OR-

auditLog:
 destination: syslog

Add the following entry to the MongoDB configuration file:

setParameter:
 auditAuthorizationSuccess: true

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures.

If the "auditLog" setting was present and contained a "filter:" parameter, ensure the "filter:" expression does not prevent the auditing of events that should be audited. The filter can be modified accordingly to ensure it complies. Alternatively, remove the "filter:" parameter to enable auditing for all events.

Refer to the MongoDB documentation for details of audit operations and event configuration:
https://www.mongodb.com/docs/v7.0/core/auditing/

https://www.mongodb.com/docs/v7.0/tutorial/configure-audit-filters/

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MongoDB_Enterprise_Advanced_7-x_V1R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-3(2), 800-53|AU-5b., 800-53|AU-10, 800-53|AU-12a., 800-53|AU-12b., 800-53|AU-12c., 800-53|AU-14(1), 800-53|CM-5(1), CAT|II, CCI|CCI-000130, CCI|CCI-000131, CCI|CCI-000132, CCI|CCI-000133, CCI|CCI-000134, CCI|CCI-000135, CCI|CCI-000140, CCI|CCI-000166, CCI|CCI-000169, CCI|CCI-000171, CCI|CCI-000172, CCI|CCI-001464, CCI|CCI-001487, CCI|CCI-001814, CCI|CCI-001844, Rule-ID|SV-265907r1028717_rule, STIG-ID|MD7X-00-000400, Vuln-ID|V-265907

Plugin: Unix

Control ID: 54467753591e56a3a7e3137703702b14c42ddeea1b082826a4372b13641bc9e9