MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-265907 | MD7X-00-000400 | SV-265907r1028717_rule | Medium |
| Description |
| MongoDB must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components. Satisfies: SRG-APP-000080-DB-000063, SRG-APP-000089-DB-000064, SRG-APP-000090-DB-000065, SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000092-DB-000208, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000109-DB-000049, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000494-DB-000344, SRG-APP-000494-DB-000345, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000498-DB-000346, SRG-APP-000498-DB-000347, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000502-DB-000348, SRG-APP-000502-DB-000349, SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000505-DB-000352, SRG-APP-000506-DB-000353, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358 |
| STIG | Date |
| MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide | 2024-09-27 |
Details
| Check Text (C-69825r1028505_chk) |
| Check the MongoDB configuration file (default location: /etc/mongod.conf) for a key named "auditLog:". Examples shown below: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }' -OR- auditLog: destination: syslog If an "auditLog:" key is not present, this is a finding. If the "auditLog:" key is present, ensure the subkey of "destination:" is set to either "file" or "syslog". If not, this is a finding. If the "auditLog:" key is present and contains a subkey of "filter:", ensure the filter is valid. If the filter is invalid, this is a finding. The site auditing policy must be reviewed to determine if the "filter:" being applied meets the site auditing requirements. If not, this is a finding. Check the MongoDB configuration file (default location: /etc/mongod.conf) for the following entry: setParameter: auditAuthorizationSuccess: true If this setParameter entry does not have "auditAuthorizationSuccess: true", this is a finding. |
| Fix Text (F-69729r1028717_fix) |
| Edit the MongoDB configuration file (default location: /etc/mongod.conf) and add a configured "auditLog" setting: auditLog: destination: file format: BSON path: <mongodb audit log directory>/auditLog.bson -OR- auditLog: destination: syslog Add the following entry to the MongoDB configuration file: setParameter: auditAuthorizationSuccess: true Restart the MongoDB service from the OS. $ sudo systemctl restart mongod Setting of auditAuthorizationSuccess enables auditing of authorization success for the authCheck action. The parameter value must be true to audit read and write operations. However, when auditAuthorizationSuccess is false, auditing has less performance impact because the audit system only logs authorization failures. If the "auditLog" setting was present and contained a "filter:" parameter, ensure the "filter:" expression does not prevent the auditing of events that should be audited. The filter can be modified accordingly to ensure it complies. Alternatively, remove the "filter:" parameter to enable auditing for all events. Refer to the MongoDB documentation for details of audit operations and event configuration: https://www.mongodb.com/docs/v7.0/core/auditing/ https://www.mongodb.com/docs/v7.0/tutorial/configure-audit-filters/ |