By default, after first installing the MongoDB database, there will be no security. Unlike earlier versions, however, as of MongoDB version 4.0, mongod binds to localhost, which provides a limited measure of safety. This lack of security facilitates initial administration and development. A production server, of course, will need a full measure of security.
Before deploying any measures (for example, replication or sharding) which would cause the database to be exposed to the company network, you should first implement proper security measures. MongoDB security encompasses several aspects, all of which are covered in this chapter. These include transport layer security, authentication, and access control.
The basic checklist for establishing security is as follows:
- Configuring MongoDB for TLS (Transport Layer Security)
- Defining the authentication mechanism...