Secure MongoDB¶

For security reasons, SEAL Systems strongly recommends configuring the TLS encryption and changing the token used for encrypting the credentials. For even more security, activate the user authentication for MongoDB.

Configure the TLS Encryption¶

In order to secure the connection with MongoDB, you need a combined PEM file containing both the TLS certificate and the private key.

Combine the file containing the certificate:
```
/opt/seal/etc/tls/cert.pem
```
and the file containing the private key:
```
/opt/seal/etc/tls/key.pem
```

Save the combined file as:

/opt/seal/etc/tls/cert-key-combined.pem

Specify the CA Certificate (If Available)¶

This step is only required if your certificate contains a CA certificate. If the certificate exists, it is checked for validity when the connection is established.

Open the configuration file of MongoDB:
```
/opt/seal/etc/mongod.conf
```

Replace the following line:

allowInvalidCertificates: true

by the following line:

CAFile: /opt/seal/etc/tls/ca.pem

Save the configuration file.
Restart the following service:
- seal-mongodb

Change the Token for Encrypting the Credentials¶

If you keep the standard installation, MongoDB is used as credential store. For security reasons, change the pre-configured token used for encrypting the credentials. The token may be any string.

In the configuration of SEAL Operator, specify the token with MONGO_TOKEN.
Stop all SEAL Operator services.
Delete the complete data directory of MongoDB:
```
/opt/seal/data/seal-mongodb
```
Start the following service:
- seal-mongodb
Start the Complete SEAL Operator System.

Enable the User Authentication¶

After the installation, the user authentication of MongoDB is disabled. In order to make MongoDB more secure, activate the user authentication.

Open a shell and change to the following directory:
```
/opt/seal/seal-mongodb
```
Execute the following script:
```
./secure-mongo.sh
```