STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

MongoDB must protect its audit features from unauthorized access.

DISA Rule

SV-96565r1_rule

Vulnerability Number

V-81851

Group Title

SRG-APP-000121-DB-000202

Rule Version

MD3X-00-000220

Severity

CAT II

CCI(s)

• CCI-001493 - The information system protects audit tools from unauthorized access.
• CCI-001494 - The information system protects audit tools from unauthorized modification.
• CCI-001495 - The information system protects audit tools from unauthorized deletion.

Weight

10

Fix Recommendation

Run these commands:

"chown mongod <MongoDB configuration file>"
"chgrp mongod <MongoDB configuration file>"
"chmod 700 <<MongoDB configuration file>"

(The name and location for the MongoDB configuration file will vary according to local circumstances. The default name and location is '/etc/mongod.conf'.)

Using the default name and location the commands would be:

> chown mongod /etc/mongod.conf
> chgrp mongod /etc/mongod.conf
> chmod 700 /etc/mongod.conf

Check Contents

Verify User ownership, Group ownership, and permissions on the “<MongoDB configuration file>":

(default name and location is '/etc/mongod.conf')

(The name and location for the MongoDB configuration file will vary according to local circumstances.)

Using the default name and location the command would be:

> ls –ald /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "700", this is a finding.

Vulnerability Number

V-81851

Documentable

False

Rule Version

MD3X-00-000220

Severity Override Guidance

Verify User ownership, Group ownership, and permissions on the “<MongoDB configuration file>":

(default name and location is '/etc/mongod.conf')

(The name and location for the MongoDB configuration file will vary according to local circumstances.)

Using the default name and location the command would be:

> ls –ald /etc/mongod.conf

If the User owner is not "mongod", this is a finding.

If the Group owner is not "mongod", this is a finding.

If the filename is more permissive than "700", this is a finding.

Check Content Reference

M

Target Key

3265

Comments