STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

The audit information produced by MongoDB must be protected from unauthorized access, modification, and deletion.

DISA Rule

SV-279336r1179505_rule

Vulnerability Number

V-279336

Group Title

SRG-APP-000120-DB-000061

Rule Version

MD8X-00-002000

Severity

CAT II

CCI(s)

CCI-000164 - Protect audit information from unauthorized deletion.
CCI-000162 - Protect audit information from unauthorized access.
CCI-000163 - Protect audit information from unauthorized modification.

Weight

Fix Recommendation

It is recommended to use the official installation packages provided by MongoDB. In the event the software was installed manually and permissions need to be restricted, consider a clean reinstallation.

To correct a finding where auditLog.destination is set to "file", run these commands:

$ chown mongod <MongoDB auditLog directory>
$ chgrp mongod <MongoDB auditLog directory>
$ chmod 600 <MongoDB auditLog directory>

The path for the MongoDB auditLog directory will vary according to local circumstances. The auditLog directory will be found in the MongoDB configuration file, whose default location is /etc/mongod.conf.

To find the auditLog directory name, view and search for the entry in the MongoDB configuration file for the auditLog.path:

Example:

auditLog:
destination: file
format: BSON
path: /var/log/mongodb/audit/auditLog.bson

Given the example above, the "MongoDB auditLog directory" is "/var/log/mongodb/audit".

Check Contents

MongoDB must not permit access to its audit logs by unprivileged users. The official installation packages restrict which operating system users and groups may read or modify files. The audit log destination is not configured or created at installation time and must be manually done with appropriate ownership and permissions applied with the MongoDB user and MongoDB group.

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "auditLog:" with "destination" set to "file".

Example shown below:

auditLog:
destination: file
format: BSON
path: <MongoDB auditLog directory>/auditLog.bson

If "auditLog" does not exist this is a finding.

If the auditLog.destination is "file" in the MongoDB configuration file (default location /etc/mongod.conf) then the following will check ownership and permissions of the MongoDB auditLog directory:

Verify User ownership, Group ownership, and permissions on the "<MongoDB auditLog directory>":

$ stat <MongoDB auditLog directory>

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the directory is more permissive than "600", this is a finding.

To find the auditLog directory name, view and search for the entry in the MongoDB configuration file (default location /etc/mongod.conf) for auditLog.destination. If this parameter's value is "file", then use the directory portion of the auditLog.path setting as the MongoDB auditLog directory location.

Example:

auditLog:
destination: file
format: BSON
path: /var/log/mongodb/audit/auditLog.bson

Given the example above, to find the auditLog directory ownership and permissions, run the following command:

> stat /var/log/mongodb/audit

The output will look similar to the following:

File: '/var/log/mongodb/audit'
Size: 48 Blocks: 0 IO Block: 4096 directory
Device: 808h/2056d Inode: 245178 Links: 2
Access: (0600/drw-------) Uid: ( 997/ mongod) Gid: ( 996/ mongod)
Context: unconfined_u:object_r:mongod_log_t:s0
Access: 2020-03-16 12:51:16.816000000 -0400
Modify: 2020-03-16 12:50:48.722000000 -0400
Change: 2020-03-16 12:50:48.722000000 -0400
Birth: -

Vulnerability Number

V-279336

Documentable

False

Rule Version

MD8X-00-002000

Severity Override Guidance

Check Content Reference

Target Key

5728