Security Checklist安全性检查列表¶

Enable access control and specify the authentication mechanism.启用访问控制并指定身份验证机制。You can use MongoDB’s SCRAM or x.509 authentication mechanism or integrate with your existing Kerberos/LDAP infrastructure.您可以使用MongoDB的SCRAM或x.509身份验证机制，或者与现有的Kerberos/LDAP基础设施集成。Authentication requires that all clients and servers provide valid credentials before they can connect to the system.身份验证要求所有客户端和服务器在连接到系统之前提供有效的凭据。

See Authentication and Enable Access Control.请参阅身份验证和启用访问控制。

Create a user administrator first, then create additional users.首先创建用户管理员，然后创建其他用户。Create a unique MongoDB user for each person/application that accesses the system.为访问系统的每个人/应用程序创建一个唯一的MongoDB用户。

Follow the principle of least privilege.遵循最小特权原则。Create roles that define the exact access rights required by a set of users.创建定义一组用户所需的确切访问权限的角色。Then create users and assign them only the roles they need to perform their operations.然后创建用户并仅为其分配执行操作所需的角色。A user can be a person or a client application.用户可以是个人或客户端应用程序。

See Role-Based Access Control and Manage Users and Roles.请参见基于角色的访问控制和管理用户和角色。

Configure MongoDB to use TLS/SSL for all incoming and outgoing connections.将MongoDB配置为对所有传入和传出连接使用TLS/SSL。Use TLS/SSL to encrypt communication between mongod and mongos components of a MongoDB deployment as well as between all applications and MongoDB.使用TLS/SSL加密MongoDB部署的mongod和mongos组件之间以及所有应用程序和MongoDB之间的通信。

Starting in version 4.0, MongoDB uses the native TLS/SSL OS libraries:从版本4.0开始，MongoDB使用本机TLS/SSL OS库：

See Configure mongod and mongos for TLS/SSL.请参阅为TLS/SSL配置mongod和mongos。

Ensure that MongoDB runs in a trusted network environment and configure firewall or security groups to control inbound and outbound traffic for your MongoDB instances.确保MongoDB在受信任的网络环境中运行，并配置防火墙或安全组来控制MongoDB实例的入站和出站流量。

Allow only trusted clients to access the network interfaces and ports on which MongoDB instances are available.只允许受信任的客户端访问MongoDB实例所在的网络接口和端口。For instance, use IP whitelisting to allow access from trusted IP addresses (see )例如，使用IP白名单允许从受信任的IP地址进行访问（请参阅）

See:参阅：

• Network and Configuration Hardening网络和配置强化
• net.bindIp configuration setting配置设置
• security.clusterIpSourceWhitelist configuration setting配置设置
• authenticationRestrictions to specify per-user IP whitelist.指定每用户IP白名单。

Track access and changes to database configurations and data.跟踪对数据库配置和数据的访问和更改。MongoDB Enterprise includes a system auditing facility that can record system events (e.g. user operations, connection events) on a MongoDB instance.MongoDB企业版包括一个系统审计工具，可以记录MongoDB实例上的系统事件（例如用户操作、连接事件）。These audit records permit forensic analysis and allow administrators to verify proper controls.这些审计记录允许法医分析，并允许管理员验证适当的控制。You can set up filters to record specific events, such as authentication events.您可以设置筛选器来记录特定事件，例如身份验证事件。

See Auditing and Configure Auditing.

Run MongoDB processes with a dedicated operating system user account.使用专用操作系统用户帐户运行MongoDB进程。Ensure that the account has permissions to access data but no unnecessary permissions.确保帐户具有访问数据的权限，但没有不必要的权限。

See Install MongoDB for more information on running MongoDB.有关运行MongoDB的更多信息，请参阅安装MongoDB。