/
MongoDB Authentication

MongoDB Authentication

Security hardening for NMIS and OMK found the following findings

 

A single identity (username and password) was used for NMIS and all OMK products:

Username

Role

Used by

Password

Username

Role

Used by

Password

opUserRW

the pre-NMIS 9.7.0 shared identity, root on admin, plus dbOwner per OMK database

NMIS and every other OMK product on the host

op42Flow42

The solution is to implement the following policies:

  • least privilege principle

  • separate identities for each product

  • no shared secrets

 

From NMIS 9.7.0 the following identities are used:

Username

Role

Used by

Password

Username

Role

Used by

Password

nmis9admin

root on admin

nothing at runtime; bootstrap and administration only

generated, stored in the handoff file

nmis9RW

dbOwner on nmisng only

NMIS at runtime

generated, stored in conf/Config.nmis

omkadmin

userAdminAnyDatabase, plus dbAdmin on each OMK database

bootstrap and administration only

 

omkRW

readWrite on each OMK database

the OMK apps at runtime

 

opUserRW

the pre-NMIS 9.7.0 shared identity, root on admin

left exactly as found; nothing removes it