Connection Security

Securing your MongoDB connections protects sensitive data from unauthorized access and interception. MongoDash supports multiple security layers including encryption, authentication mechanisms, TLS/SSL, and network access controls.

Security Layers

A secure MongoDB connection uses multiple protection mechanisms:

1. Transport Encryption - TLS/SSL encrypts data in transit
2. Authentication - Verifies user identity
3. Authorization - Controls user permissions
4. Network Access Control - Restricts connection sources
5. Connection String Protection - Encrypts stored credentials

TLS/SSL Encryption

TLS (Transport Layer Security) encrypts all data transmitted between MongoDash and your MongoDB server.

Enabling TLS/SSL

Add tls=true or ssl=true to your connection string:

mongodb://user:pass@host:27017/db?tls=true

For Atlas connections, TLS is automatically enabled:

mongodb+srv://user:pass@cluster.mongodb.net/db

TLS Configuration Options

TLS Connection String Examples

Standard TLS:

mongodb://user:pass@host:27017/db?tls=true

TLS with custom CA:

mongodb://user:pass@host:27017/db?tls=true&tlsCAFile=/path/to/ca.pem

Mutual TLS (client certificate):

mongodb://user:pass@host:27017/db?tls=true&tlsCertificateKeyFile=/path/to/client.pem

Development (skip validation):

mongodb://user:pass@localhost:27017/db?tls=true&tlsAllowInvalidCertificates=true

Certificate Management

Uploading Certificates to MongoDash

Certificate Formats

MongoDash accepts these certificate formats:

• PEM - Privacy Enhanced Mail (.pem, .crt, .key)
• DER - Distinguished Encoding Rules (.der, .cer)
• PKCS#12 - Combined certificate and key (.p12, .pfx)

Converting Certificates

Convert DER to PEM:

openssl x509 -inform der -in certificate.cer -out certificate.pem

Combine certificate and key:

cat certificate.crt private.key > combined.pem

Extract from PKCS#12:

openssl pkcs12 -in certificate.p12 -out certificate.pem -nodes

Authentication Mechanisms

MongoDB supports multiple authentication mechanisms for different security requirements.

SCRAM-SHA-256 (Default)

Salted Challenge Response Authentication Mechanism using SHA-256.

mongodb://user:pass@host:27017/db?authMechanism=SCRAM-SHA-256&authSource=admin

When to use:

• Default for MongoDB 4.0+
• Standard username/password authentication
• Most common authentication method

SCRAM-SHA-1

Legacy SCRAM using SHA-1 (for older MongoDB versions).

mongodb://user:pass@host:27017/db?authMechanism=SCRAM-SHA-1&authSource=admin

When to use:

• MongoDB 3.x compatibility
• Legacy systems requiring SHA-1

MONGODB-X509

Certificate-based authentication using X.509 certificates.

mongodb://host:27017/db?authMechanism=MONGODB-X509&tls=true&tlsCertificateKeyFile=/path/to/client.pem

When to use:

• High-security environments
• Automated systems (no password rotation)
• Mutual TLS requirements

LDAP (SASL)

Enterprise-only LDAP authentication.

mongodb://user@REALM:pass@host:27017/db?authMechanism=PLAIN&authSource=$external

When to use:

• Enterprise MongoDB installations
• Active Directory integration
• Centralized user management

Kerberos (GSSAPI)

Enterprise-only Kerberos authentication.

mongodb://user@REALM@host:27017/db?authMechanism=GSSAPI&authSource=$external

When to use:

• Enterprise MongoDB installations
• Kerberos infrastructure environments
• Single sign-on requirements

AWS IAM

MongoDB Atlas AWS IAM authentication.

mongodb://host:27017/db?authMechanism=MONGODB-AWS&authSource=$external

When to use:

• MongoDB Atlas on AWS
• IAM role-based access
• Temporary credentials

IP Whitelisting

Restrict MongoDB access to specific IP addresses or CIDR ranges.

MongoDB Atlas IP Whitelist

Self-Hosted MongoDB Firewall

Configure firewall rules on your MongoDB server:

Linux (iptables):

# Allow MongoDash IP
sudo iptables -A INPUT -p tcp -s 203.0.113.10 --dport 27017 -j ACCEPT
 
# Block all other connections
sudo iptables -A INPUT -p tcp --dport 27017 -j DROP

Linux (ufw):

# Allow specific IP
sudo ufw allow from 203.0.113.10 to any port 27017
 
# Deny all other
sudo ufw deny 27017

Windows Firewall:

1. Open Windows Firewall with Advanced Security
2. Create new Inbound Rule
3. Select Port → TCP → 27017
4. Select "Allow the connection"
5. Specify remote IP addresses

MongoDash Static IPs

Standard and Professional plans use dynamic IPs and require alternative access methods:

• VPN connections
• SSH tunnels
• Private network peering (Enterprise)

Connection String Encryption

MongoDash encrypts all connection strings at rest to protect credentials.

Encryption Details

• Algorithm: AES-256-GCM
• Key Storage: Hardware security module (HSM) in Enterprise
• Scope: All connection URIs, passwords, and certificates
• Access: Decrypted only during active connections

Best Practices

1. Use environment-specific credentials - Separate users for dev/staging/production
2. Rotate credentials regularly - Change passwords every 90 days
3. Use read-only users for dashboards - Minimize permissions
4. Enable audit logging - Track connection usage (Enterprise)

Database User Permissions

Configure appropriate MongoDB user permissions for MongoDash access.

Read-Only User (Recommended for Dashboards)

use admin
db.createUser({
  user: "mongodash_readonly",
  pwd: "securePassword123",
  roles: [
    { role: "readAnyDatabase", db: "admin" },
    { role: "clusterMonitor", db: "admin" }
  ]
})

Permissions:

• Read all databases
• View cluster status and metrics
• No write or admin capabilities

Read-Write User

use admin
db.createUser({
  user: "mongodash_readwrite",
  pwd: "securePassword123",
  roles: [
    { role: "readWriteAnyDatabase", db: "admin" },
    { role: "clusterMonitor", db: "admin" }
  ]
})

Permissions:

• Read and write all databases
• View cluster status
• No user management or admin

Database-Specific User

use myDatabase
db.createUser({
  user: "mongodash_mydb",
  pwd: "securePassword123",
  roles: [
    { role: "read", db: "myDatabase" }
  ]
})

Permissions:

• Read only specific database
• No access to other databases

Network Security

Additional network-level security measures:

VPC Peering (Enterprise)

Establish private network connection between MongoDash and your MongoDB:

• No internet exposure
• Dedicated private link
• Sub-millisecond latency
• Enhanced security

PrivateLink (AWS/Azure/GCP)

Connect to MongoDB Atlas via cloud provider PrivateLink:

Benefits:

• Traffic stays within cloud provider network
• No internet exposure
• Simplified network configuration
• Lower latency

Setup:

1. Enable PrivateLink in Atlas
2. Create endpoint in your VPC
3. Use private endpoint in connection string
4. Configure DNS resolution

SSH Bastion

Use SSH tunnels for secure access:

MongoDash → SSH Tunnel → Bastion → MongoDB (Private Network)

See SSH Tunnels documentation for detailed configuration.

Security Compliance

MongoDash security features support compliance requirements:

SOC 2 Compliance

• Encrypted connections (TLS 1.2+)
• Encrypted data at rest
• Access logging and audit trails (Enterprise)
• Regular security audits

GDPR Compliance

• Data encryption in transit and at rest
• Access controls and authentication
• Audit logging for data access (Enterprise)
• Data retention policies

HIPAA Compliance

• End-to-end encryption
• Access logging and monitoring (Enterprise)
• BAA available (Enterprise)
• PHI data handling procedures

Security Checklist

Ensure your MongoDB connections are secure:

• Enable TLS/SSL for all connections
• Use certificate validation (no tlsAllowInvalidCertificates)
• Configure IP whitelisting or firewall rules
• Use strong authentication (SCRAM-SHA-256 or X.509)
• Create dedicated users with minimal permissions
• Rotate credentials every 90 days
• Enable MongoDB authentication and authorization
• Use SSH tunnels or VPN for private networks
• Monitor connection audit logs (Enterprise)
• Disable unnecessary MongoDB ports and services

What's Next?

• SSH Tunnels
• Connection Troubleshooting
• Connection Types