Detections
Analytics
MD8X-00-014100 - MongoDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.
Information
A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.Solution
Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".Example shown below:
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>
Run the following commands on the file indicated by this key:
chmod 600 /etc/ssl/caToValidateClientCertificates.pem
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MDB_Enterprise_Advanced_8-x_V1R1_STIG.zip
Item Details
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-28, CAT|II, CCI|CCI-004910, Rule-ID|SV-279412r1179403_rule, STIG-ID|MD8X-00-014100, Vuln-ID|V-279412
Plugin: Unix
Control ID: 78d7a07b25a4efc9a6397a6476e90ea53795ade2314af99ba8faae09c0810e5e