I've just been recently playing with MongoDB on one of my Dev servers not doing anything too serious and despite knowing better I allowed remote connections from any IP. Within a few days the database was 'hacked' with a ransom attempt. I shrugged it off and decided to go ahead and bind the IP to my personal public IP and the local server thinking it would shut down the breach.
Nope. Database has once again been compromised so I decided to take a look at the log and it clear as day shows that connection was completed from an IP that was not included in my config. How could this still be happening?
Additionally I did execute service mongodb restart after making the ipbind changes.
Here is the network interface section of my config
# network interfaces
net:
port: 27017
bindIp: [127.0.0.1,90.207.xxx.xxx,76.94.xxx.xxx,23.23.xxx.xxx]
The bindIp setting is a list of the IP addresses your MongoDB server listens to, not a firewall to limit remote access. If your server has a private and a public IP, the bindIp list should be at most three entries: 127.0.0.1 (localhost), the private IP, and the public IP.
Ideally you should limit your MongoDB deployment to only listen to localhost or a private IP, and connect remotely via SSH or VPN.
Security in depth requires multiple measures as outlined in the MongoDB security checklist.
For example, in addition to correcting your bindIp setting you should:
mongod and mongos servers to require SSL for all network communication.try
netstat -tulpn | grep mongod
then you will come to know on which ip's the mongo service is binded...
I found the problem. [xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx] must not be the correct syntax for IP binding. For testing I changed the IP bind back to
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
Which did infact block my connection attempts so I then tried
# network interfaces
net:
port: 27017
bindIp: [127.0.0.1,1.1.1.1]
Which is a blatantly wrong IP and it let me connect no questions asked. I had copied this syntax off a previous stackoverflow question. Now I just need to find the appropriate way to do this.