Skip to main content
Back To Top
Got Questions?
Get in touch with us!

How to Secure MongoDB and Get the Most Out of the Sitecore Experience Platform

by: Derek Barka Chief Technology Officer

SilverTech works heavily in the financial services and healthcare verticals. Both of these industries are risk averse for obvious reasons and this plays heavily into their technology decisions. In most of our engagements with financial services clients, we have to go through a risk assessment with their Information Security and Risk Management teams. These typically involve reviewing hosting architectures, data flows, security assessments, and SOC2 reviews at the least.

In many cases, MongoDB is flagged as a risk in these engagements because of its relative newness, unfamiliarity, and the fact that it’s relatively insecure out of the box. These concerns were exacerbated by recent reports that tens of thousands of MongoDB instances have been compromised. Reports like that tend to worry people whose job entails mitigating risk in an organization.

“MongoDB, like other NoSQL databases, has suffered from security shortcomings for years. Trustwave called out MongoDB in 2013. Security researcher John Matherly did so again in 2015. Where MySQL, PostgreSQL, and other relational databases tend to default to local installation and some form of authorization, MongoDB databases are exposed to the internet by default, and don’t require credentials immediately by default.”

All of this said, the Sitecore Experience Platform and the use of MongoDB as the data store is the ideal architecture for enterprise websites that rely on data analytics, visitor profiling, and personalization to drive a unique customer journey. MongoDB can scale quickly and the external analytics database allows SQL Server to focus on driving the website’s content. The answer to these security concerns isn’t to avoid the technology, one must simply understand how to implement it in a secure fashion. At SilverTech, we have extensive experience working with risk averse organizations and leading them through technology and implementation plans that meet tough security and compliance guidelines.

Hardening MongoDB involves two main courses of action.

Protecting the Server

First and foremost, in a secure implementation, the MongoDB should not be stored on the web server. MongoDB should be installed on a separate server that is not open to web traffic. The server’s ports should be locked down to just the MongoDB required ports and traffic should be IP restricted to just the web server(s). This will effectively limit external hacking threats and mitigate most of the risks of exposing the MongoDB data.

Enabling Authentication

By default, MongoDB is installed to allow anonymous access and no authenticated users are configured. This is very poor practice. Authentication should be setup and required for MongoDB access before deploying any production database. Our best practice is to set up two users. The first user is an admin user with “dbowner” access to the admin database and all Sitecore databases. This user is required for administration after authentication is enabled. Next, we configure a Sitecore_user user with read/write access to the 4 Sitecore databases. This user, with limited privileges, is used to connect from the Sitecore web servers. The MongoDB configuration is updated to require authentication and the Sitecore connection strings are updated to use the Sitecore_user credentials.

By completing these two simple hardening steps, your Sitecore Experience Platform will be secure from external threats and should mitigate any risks raised by security audits.

For details on how to technically enable MongoDB authentication for Sitecore, keep reading. In summary, you need to:

  • Create MongoDB Users and assign to roles
  • Update the MongoDB config to require authentication
  • Restart MongoDB service
  • Update Sitecore connection strings to use authenticated users

Detailed Steps

I prefer to use Robomongo for managing my Mongo instance, but you can also use the command line to execute these commands.

  1. First, Login to your MongoDB instance using no authentication. You should see all databases listed.
  2. Open a shell window and write scripts to create users.

a. First, we’ll create a global dbo user who can be your db owner after authentication is enabled.

b. Secondly, we’ll create a Sitecore user with read/write access to your Sitecore databasesuse admin
db.createUser({user: “mongo_dbo”, pwd: “mypassword”, roles: [ { role: “root”, db:”admin”} ] })
use scdemo_analytics db.createUser({user: “sitecore_user”,pwd: “mypassword”,roles: [ { role: “readWrite”, db:”scdemo_analytics” } ] })use scdemo_tracking_live
db.createUser({user: “sitecore_user”,pwd: “mypassword”,roles: [ { role: “readWrite”, db:”scdemo_tracking_live” } ] })


use scdemo_tracking_history
db.createUser({user: “sitecore_user”,pwd: “mypassword”,roles: [ { role: “readWrite”, db:”scdemo_tracking_history” } ] })

use scdemo_tracking_contact
db.createUser({user: “sitecore_user”,pwd: “mypassword”,roles: [ { role: “readWrite”, db:”scdemo_tracking_contact” } ] })

c. After running the scripts, you should see results confirming the users were created.

3. Next, we need to enable authentication for MongoDB

a. Log out of robomongo
b. Open the mongod.cgf config file in your mongo install folder.
c. Add the line:
authorization: enabled

d. Restart the mongo db service.
e. Login to robomongo and confirm you can access MongoDB with sitecore_user

4. Finally, open the Sitecore ConnectionStrings.config and update connection strings to include the username and password in the following format:

NOTE: this is a demo instance and mongoDB is local. We recommend having mongo on a separate secure server.

5. Browse the website and ensure that it loads and new interactions are appearing.
a. Open the mongoDB and get documents from [site]_analytics..Interactions collection 

Your MongoDB is now setup with authentication required and your Sitecore web server is configured to connect securely.

Has your Information Security or Risk Management team flagged MongoDB as a risk? Do you need help enabling MongoDB authentication for Sitecore? If so, please do not hesitate to connect with our team.