How to secure MongoDB with authentication

A MongoDB install without authentication is an easy target, especially if it is exposed to the internet. Enabling authentication takes a few minutes.

1. Create an admin user

mongosh

use admin
db.createUser({
  user: "admin",
  pwd: "strong_password",
  roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
})

2. Enable authentication

In /etc/mongod.conf, add:

security:
  authorization: enabled

systemctl restart mongod

3. Connect authenticated

mongosh -u admin -p --authenticationDatabase admin

4. Important rules

• Keep MongoDB bound to 127.0.0.1 (in bindIp) unless you need remote access.
• Create dedicated per-application users with limited roles (only readWrite on the needed database).
• Never expose port 27017 directly to the internet without a firewall and authentication.