Securing MongoDB¶

For security reasons we strongly recommend configuring the TLS encryption:

Configure the TLS encryption.

For enhancing the security activate the user authentication for MongoDB in addition:

Activate the user authentication

Configuring the TLS Encryption¶

... in a PLOSSYS 5 Sytem¶

In order to secure the connection to MongoDB you need a combined PEM file that contains both, the TLS certificate and the private key.

Combine the file containing the certificate:
```
/opt/seal/etc/tls/cert.pem
```
and the file containing the private key:
```
/opt/seal/etc/tls/key.pem
```

Save the combined file as:

/opt/seal/etc/tls/cert-key-combined.pem

... in a PLOSSYS 5 Cluster¶

If you run PLOSSYS 5 in a cluster, execute the above configuration steps on each PLOSSYS 5 server.

Changing the Token for Encrypting the Credentials¶

In the standard installation, MongoDB is used as credential store. For security reasons, change the pre-configured token used for encrypting the credentials. The token may be any string.

In the configuration of SEAL Print Client, specify the token with MONGO_TOKEN, see SEAL Print Client.
Stop all SEAL Print Client services.
Delete the complete data directory of MongoDB:
```
/opt/seal/data/seal-mongodb
```
Restart MongoDB:
- seal-mongodb
Start the complete SEAL Print Client System, see SEAL Print Client.

Activating the User Authentication¶

... in a Single System¶

After the installation the user authentication of MongoDB is disabled by default. Activate the user authentication to enhance the security.

Execute the following shell script as administrator:
```
/opt/seal/seal-mongodb/secure-mongo.sh
```

... in a Cluster¶

If you run PLOSSYS 5 in a cluster, execute the above step on the first cluster server. Then execute the following steps on any other cluster server:

Copy the key file created by secure-mongo.sh on the first cluster server
```
/opt/seal/etc/mongod.keyfile
```
into the following directory on your current cluster server:
```
/opt/seal/etc
```

Add the following lines to the /opt/seal/etc/mongod.conf file:

security:
  authorization: enabled
  keyFile: /opt/seal/etc/mongod.keyfile

Restart MongoDB:
```
seal-mongodb
```
Proceed with step 1 on the next cluster server.

Specifying a CA Certificate¶

This is necessary only, if a CA certificate has been specified.

In this case MongoDB requires a client certificate from each client, i. e. from all PLOSSYS 5 services that access MongoDB. This requires corresponding properties of the certificate.

This is how you configure a CA certificate with MongoDB:

On the PLOSSYS 5 server, edit the configuration file of MongoDB:
```
/opt/seal/etc/mongod.conf
```

Replace the following line:

allowInvalidCertificates: true

by this line:

CAFile: /opt/seal/etc/tls/ca.pem

Save the configuration file.
Restart MongoDB:
```
seal-mongodb
```