> ## Content Index
> Fetch the complete content index at: https://blog.borodutch.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to secure the hell out of your MongoDB in 2021
- URL: https://blog.borodutch.com/how-to-secure-the-hell-out-of-your-mongodb-in-2021/
- Published: 2021-02-15T16:41:48.000Z
- Updated: 2021-02-15T16:42:28.000Z
- Description: 7 easy steps how to secure a MongoDB so that no data is ever leaked
- Author: Nikita Kolmogorov
- Tags: General, Development, #Import 2025-04-04 22:42

Hi everyone! Even though my databases have always been secured with a complex password and access control, I kept seeing failing connections from various shady servers on the Internet. Today I decided to put an end to these filthy and unsuccessful attempts to access my MongoDB instances once and for all. And I'll show you how I've done it.

I'm going to assume that you run a Debian-based server (e.g. Ubuntu). This tutorial will work best for this typical configuration. Also, I won't go over how you can install MongoDB, for that check out the "Setting up MongoDB" section of [another tutorial of mine](https://blog.borodutch.com/how-to-deploy-node-js-app-to-digital-ocean-droplet-with-free-continuous-integration/). Also, if you remove the MongoDB parts of this tutorial, you can get a pretty well-secured general purpose server!

1. Make sure [to add password-protected users](https://docs.mongodb.com/manual/tutorial/create-users/?ref=blog.borodutch.com) to the MongoDB with the correct permissions that your services will use to access the databases. E.g. if you have a statistics server that just reads the DB from time to time, don't give it `write` rights.
2. Make sure that you have `security.authorization` in the `/etc/mongod.conf` set to `enabled`. Here are the [docs](https://docs.mongodb.com/manual/reference/configuration-options/?ref=blog.borodutch.com#security.authorization).
3. Your services will probably require access to the database over the Internet, so feel free to set `net.bindIp` to the correct IP addresses, including `127.0.0.1`. Here are the [docs](https://docs.mongodb.com/manual/reference/configuration-options/?ref=blog.borodutch.com#net.bindIp). We will restrict the IP addresses that can access the database a bit later.
4. [Install](https://linuxhandbook.com/fail2ban-basic/?ref=blog.borodutch.com) `fail2ban`. You can also configure it, but even the default configuration is most likely sufficient.
5. From now on, only connect to the database for the debug purposes from your local machine [through an SSH tunnel](https://www.digitalocean.com/community/tutorials/how-to-securely-configure-a-production-mongodb-server?ref=blog.borodutch.com). No more unrestricted dynamic IP addresses that can access the database.
6. Make sure you have password SSH authentication off and you're connecting to the VPS as a well-restricted user, almost never as `root`! Find the instructions on how to set it up in the "Setting up the VPS" section of [my other tutorial](https://blog.borodutch.com/how-to-deploy-node-js-app-to-digital-ocean-droplet-with-free-continuous-integration/).
7. [Configure and enable](https://www.digitalocean.com/community/tutorials/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server?ref=blog.borodutch.com) `ufw`. You would want to restrict all incoming traffic, allow SSH port incoming traffic (the default port is `22`), allow MongoDB connection port incoming traffic (the default port is `27017`) from specific IP's that will need access (e.g. the statistics server and your backend). See the command below to do so. Then just restart the `ufw`. If you're running other things that should be accessible from the Internet, adjust `ufw` accordingly.

```bash
sudo ufw allow from trusted_server_ip to any port 27017
```

That's it! Your MongoDB is as secure as you'd want it to be. What to read next? I'd suggest checking out [this great tutorial](https://www.digitalocean.com/community/tutorials/how-to-configure-remote-access-for-mongodb-on-ubuntu-20-04?ref=blog.borodutch.com) on the same topic in case I missed anything. Cheers!