STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must protect its audit features from unauthorized access.

DISA Rule

SV-265909r1028719_rule

Vulnerability Number

V-265909

Group Title

SRG-APP-000121-DB-000202

Rule Version

MD7X-00-002300

Severity

CAT II

CCI(s)

• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

10

Fix Recommendation

Run these commands:

"chown mongod <MongoDB configuration file>"
"chgrp mongod <MongoDB configuration file>"
"chmod 600 <MongoDB configuration file>"

(The name and location for the MongoDB configuration file will vary according to local circumstances. The default name and location is /etc/mongod.conf.)

Using the default name and location the commands would be:

$ chown mongod /etc/mongod.conf
$ chgrp mongod /etc/mongod.conf
$ chmod 660 /etc/mongod.conf

Check Contents

To ensure audit configurations are protected from unauthorized modification, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the "<MongoDB configuration file>":

(default name and location is /etc/mongod.conf)

(The name and location for the MongoDB configuration file will vary according to local circumstances.)

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Vulnerability Number

V-265909

Documentable

False

Rule Version

MD7X-00-002300

Severity Override Guidance

To ensure audit configurations are protected from unauthorized modification, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the "<MongoDB configuration file>":

(default name and location is /etc/mongod.conf)

(The name and location for the MongoDB configuration file will vary according to local circumstances.)

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Check Content Reference

M

Target Key

5637