STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB software installation account must be restricted to authorized users.

DISA Rule

SV-265911r1028721_rule

Vulnerability Number

V-265911

Group Title

SRG-APP-000133-DB-000198

Rule Version

MD7X-00-002700

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

It is recommended to use the official installation packages provided by MongoDB. In the event the software was installed manually, and permissions need to be restricted, consider a clean reinstallation.

Alternatively, run the following commands to properly set permissions on the configuration file:

$ chown mongod <MongoDB configuration file>
$ chgrp mongod <MongoDB configuration file>
$ chmod 600 <<MongoDB configuration file>

The name and location for the MongoDB configuration file will vary according to local circumstances. The default name and location is /etc/mongod.conf.

Using the default name and location the commands would be:

$ chown mongod /etc/mongod.conf
$ chgrp mongod /etc/mongod.conf
$ chmod 600 /etc/mongod.conf

Check Contents

To ensure log, network, security, and other audit configurations are not modifiable by unauthorized operating system users, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the "<MongoDB configuration file>":

(default name and location is /etc/mongod.conf)

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Vulnerability Number

V-265911

Documentable

False

Rule Version

MD7X-00-002700

Severity Override Guidance

To ensure log, network, security, and other audit configurations are not modifiable by unauthorized operating system users, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the "<MongoDB configuration file>":

(default name and location is /etc/mongod.conf)

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Check Content Reference

M

Target Key

5637