Securing our clusters
Security is a multifaceted goal in a MongoDB cluster. For the rest of this chapter, we will examine different attack vectors and how we can protect against them. In addition to these best practices, developers and administrators must always use common sense so that security interferes only as much as is required for operational goals.
Authentication
Authentication refers to verifying the identity of a client. This prevents the impersonation of someone in order to gain access to their data.
Username/password client-based authentication
The simplest way to authenticate is by using a username and password pair. This can be done via the shell in two ways, the first of which is as follows:
> db.auth( <username>, <password> )
Passing in a comma-separated username and password will assume the default values for the rest of the fields as follows:
> db.auth( {
user: <username>,
pwd: <password>,
mechanism: <...