Detections
Analytics

6.1 Ensure that MongoDB uses a non-default port

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Changing the default port used by MongoDB makes it harder for attackers to find the database and target it.

Standard ports are used in automated attacks and by attackers to verify which applications are running on a server.

Solution

Change the port for MongoDB server to a number other than 27017.

In mongod.conf edit the below lines

# network interfaces
net:
 port: $Orginasation Defined port
 bindIp: $Orginasation Defined IP

Impact:

Hackers frequently scan IP addresses for commonly used ports, so it's not uncommon to use a different port to 'fly under the radar'. This is just to avoid detection, other than that there is no added safety by using a different port.

See Also

https://workbench.cisecurity.org/benchmarks/19909

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 9587b61099bf1dca751d64b45ec4be579507f1adce5f3b5913d38c324354b94c