STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must enforce authorized access to all PKI private keys stored/used by the DBMS.

DISA Rule

SV-279351r1179509_rule

Vulnerability Number

V-279351

Group Title

SRG-APP-000176-DB-000068

Rule Version

MD8X-00-003900

Severity

CAT I

CCI(s)

CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

Fix Recommendation

Run these commands:

chown mongod:mongodb /etc/ssl/mongodb.pem
chmod 600 /etc/ssl/mongodb.pem
chown mongod:mongod /etc/ssl/mongodbca.pem
chmod 600 /etc/ssl/mongodbca.pem

Check Contents

In the MongoDB database configuration file (default location /etc/mongod.conf), review the following parameters:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/mongodbca.pem

Verify ownership, group ownership, and permissions for the MongoDB config file (default /etc/mongod.conf), the certificateKeyFile (default /etc/ssl/mongodb.pem), and the CAFile (default /etc/ssl/mongodbca.pem).

For each file, run following command and review its output:

ls -al <filepath>

Example output:
-rw------- 1 mongod mongod 566 Apr 26 20:20 <filepath>

If the user owner is not "mongod", this is a finding.

If the group owner is not "mongod", this is a finding.

If the file is more permissive than "600", this is a finding.

Vulnerability Number

V-279351

Documentable

False

Rule Version

MD8X-00-003900

Severity Override Guidance

Check Content Reference

Target Key

5728