STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.

DISA Rule

SV-96583r1_rule

Vulnerability Number

V-81869

Group Title

SRG-APP-000172-DB-000075

Rule Version

MD3X-00-000340

Severity

CAT II

CCI(s)

• CCI-000185 - The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

In the MongoDB database configuration file (default location: /etc/mongod.conf) ensure the following parameters following parameter are set and configured correctly:

net:
ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/mongodbca.pem

Remove any occurrence of the "allowInvalidCertificates" parameter:

net:
ssl:
allowInvalidCertificates: true

Stop/start (restart) the mongod or mongos instance using this configuration.

Check Contents

In the MongoDB database configuration file (default location: /etc/mongod.conf), review the following parameters:

net:
ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/mongodbca.pem

If the "CAFile" parameter is not present, this is a finding.

If the "allowInvalidCertificates" parameter is found, this is a finding.

net:
ssl:
allowInvalidCertificates: true

Vulnerability Number

V-81869

Documentable

False

Rule Version

MD3X-00-000340

Severity Override Guidance

In the MongoDB database configuration file (default location: /etc/mongod.conf), review the following parameters:

net:
ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/mongodbca.pem

If the "CAFile" parameter is not present, this is a finding.

If the "allowInvalidCertificates" parameter is found, this is a finding.

net:
ssl:
allowInvalidCertificates: true

Check Content Reference

M

Target Key

3265

Comments