Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication configured for mongodb. Also no change was made to mongod.conf. This is the line in mongo.conf:
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
that I am betting on saved me from data hack. This line says only connections from localhost are allowed to mongodb server.
Assume that hacker is not able to login to my remote server and the only thing he came to know that I have mongodb running and port 127017 is open, is it safe to assume that my mongo data was safe?
I have now changed UFW rules to allow access to 127017 only tfrom my desktop IP address and updated mongod.conf to allow access from my desktop as well as from localhost.
linux mongodb
edited Jan 5 at 8:38
Teun Vink
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
migrated from superuser.com Jan 5 at 7:56
This question came from our site for computer enthusiasts and power users.
add a comment |
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication configured for mongodb. Also no change was made to mongod.conf. This is the line in mongo.conf:
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
that I am betting on saved me from data hack. This line says only connections from localhost are allowed to mongodb server.
Assume that hacker is not able to login to my remote server and the only thing he came to know that I have mongodb running and port 127017 is open, is it safe to assume that my mongo data was safe?
I have now changed UFW rules to allow access to 127017 only tfrom my desktop IP address and updated mongod.conf to allow access from my desktop as well as from localhost.
linux mongodb
edited Jan 5 at 8:38
Teun Vink
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
migrated from superuser.com Jan 5 at 7:56
This question came from our site for computer enthusiasts and power users.
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38
add a comment |
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication configured for mongodb. Also no change was made to mongod.conf. This is the line in mongo.conf:
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
that I am betting on saved me from data hack. This line says only connections from localhost are allowed to mongodb server.
Assume that hacker is not able to login to my remote server and the only thing he came to know that I have mongodb running and port 127017 is open, is it safe to assume that my mongo data was safe?
I have now changed UFW rules to allow access to 127017 only tfrom my desktop IP address and updated mongod.conf to allow access from my desktop as well as from localhost.
linux mongodb
edited Jan 5 at 8:38
Teun Vink
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication configured for mongodb. Also no change was made to mongod.conf. This is the line in mongo.conf:
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
that I am betting on saved me from data hack. This line says only connections from localhost are allowed to mongodb server.
Assume that hacker is not able to login to my remote server and the only thing he came to know that I have mongodb running and port 127017 is open, is it safe to assume that my mongo data was safe?
I have now changed UFW rules to allow access to 127017 only tfrom my desktop IP address and updated mongod.conf to allow access from my desktop as well as from localhost.
linux mongodb
linux mongodb
edited Jan 5 at 8:38
Teun Vink
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
edited Jan 5 at 8:38
Teun Vink
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
edited Jan 5 at 8:38
Teun Vink
5,41222129
edited Jan 5 at 8:38
Teun Vink
5,41222129
edited Jan 5 at 8:38
Teun Vink
5,41222129
5,41222129
asked Jan 5 at 6:03
user61766user61766
1052
asked Jan 5 at 6:03
user61766user61766
1052
asked Jan 5 at 6:03
user61766user61766
1052
1052
migrated from superuser.com Jan 5 at 7:56
This question came from our site for computer enthusiasts and power users.
migrated from superuser.com Jan 5 at 7:56
This question came from our site for computer enthusiasts and power users.
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38
add a comment |
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38
add a comment |
1 Answer
1
active
oldest
votes
If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f200844%2fis-my-mongodb-data-safe-given-that-by-mistake-i-left-the-default-port-127017-ope%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
add a comment |
If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
add a comment |
If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of additional forwarding or binding etc was setup you might enable the ufw rule again and then do a telnet your-ip 127017 from outside the machine. You should get Connection refused or similar which shows that the database is not reachable from outside even if the ufw rule might in theory allow it.
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
answered Jan 5 at 8:21
Steffen UllrichSteffen Ullrich
115k13199264
115k13199264
add a comment |
add a comment |
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f200844%2fis-my-mongodb-data-safe-given-that-by-mistake-i-left-the-default-port-127017-ope%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
TCP and UDP ports go up to 65535. Allowing TCP/127017 shouldn't work at all, but maybe you made a typo and meant 27017?
– Teun Vink
Jan 5 at 8:38