How to modify MongoDB unauthorized access vulnerability in Linux

Recently, the security team detected that some Aliyun users exist MongoDB database unauthorized access vulnerabilities, vulnerabilities serious, easy to lead to database leaks. In order to ensure your business and application of security, please the vast number of users to repair the vulnerability as soon as possible.
The specific issues are as follows:

1. Vulnerability Hazard

When you turn on the MongoDB service without adding any parameters, the default is not permission to authenticate, the user can log on through the default port without password to the database arbitrary operation and can remotely access the database!

2. The cause of the loophole

At the beginning of the installation of the MongoDB has a default admin database, at this time the admin database is empty, there is no record permissions related information! When Admin.system.users is not available to a user, even if the--auth parameter is added when the Mongod is started, if the user is not added to the admin database, no authentication can be done at this time (whether or not it is started with the--auth parameter). Until a user was added to the admin.system.users. The core of the reinforcement is only after adding the user in the Admin.system.users, the MongoDB authentication, the authorization service can take effect!

3. Vulnerability strengthening scheme (for reference only)

Method One:
can modify ports and specify Access IP
Specific according to the actual situation to set, can also be done directly on the server firewall.

Method Two:

Add a user to the Admin.system.users and start authentication.

Create a user in #在admin database! Supper Password is SUP (here are examples)

[Mongodb@rac3 bin]$./mongo 127.0.0.1:27017
MongoDB shell version:2.0.1
Connecting to:127.0.0.1:27017/test< br> > Use admin
switched to DB admin

> Db.adduser ("supper", "sup")  
{"n": 0, "Connectio NId ": 4, err": null, "OK": 1}
{
        "user": "supper",
   ;      "ReadOnly": false,
        "pwd": " 51a481f72b8b8218df9fee50b3737c44 ",
       " _id ": ObjectId (" 4f2bc0d357a309043c6947a4 ")
}
> Db.auth (" supper "," sup ")
1
> Exit
Bye