STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must protect its audit features from unauthorized access, modification, and removal.

DISA Rule

SV-279337r1179178_rule

Vulnerability Number

V-279337

Group Title

SRG-APP-000123-DB-000204

Rule Version

MD8X-00-002300

Severity

CAT II

CCI(s)

• CCI-001495 - Protect audit tools from unauthorized deletion.
• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.

Weight

10

Fix Recommendation

Run these commands:

"chown mongod <MongoDB configuration file>"
"chgrp mongod <MongoDB configuration file>"
"chmod 600 <MongoDB configuration file>"

Note: The name and location for the MongoDB configuration file will vary according to local circumstances. The default name and location is /etc/mongod.conf.

Using the default name and location the commands would be:

$ chown mongod /etc/mongod.conf
$ chgrp mongod /etc/mongod.conf
$ chmod 600 /etc/mongod.conf

Check Contents

To ensure audit configurations are protected from unauthorized access, modification, and removal, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the <MongoDB configuration file>:

Note: Default name and location is: /etc/mongod.conf. The name and location for the MongoDB configuration file will vary according to local circumstances.

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Vulnerability Number

V-279337

Documentable

False

Rule Version

MD8X-00-002300

Severity Override Guidance

To ensure audit configurations are protected from unauthorized access, modification, and removal, the default installation of MongoDB restricts permission on the configuration file.

Verify User ownership, Group ownership, and permissions on the <MongoDB configuration file>:

Note: Default name and location is: /etc/mongod.conf. The name and location for the MongoDB configuration file will vary according to local circumstances.

Using the default name and location the command would be:

$ stat /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "600", this is a finding.

Note that the audit destination cannot be modified at runtime.

Check Content Reference

M

Target Key

5728