Skip to content

Secure MongoDB


For security reasons, SEAL Systems strongly recommends configuring the TLS encryption and changing the token used for encrypting the credentials. For even more security, activate the user authentication for MongoDB.


Configure the TLS Encryption

In order to secure the connection with MongoDB, you need a combined PEM file containing both the TLS certificate and the private key.

  1. Combine the file containing the certificate:

    /opt/seal/etc/tls/cert.pem
    

    and the file containing the private key:

    /opt/seal/etc/tls/key.pem
    
  2. Save the combined file as:

    /opt/seal/etc/tls/cert-key-combined.pem
    

Specify the CA Certificate (If Available)

This step is only required if your certificate contains a CA certificate. If the certificate exists, it is checked for validity when the connection is established.

  1. Open the configuration file of MongoDB:

    /opt/seal/etc/mongod.conf
    
  2. Replace the following line:

    allowInvalidCertificates: true
    

    by the following line:

    CAFile: /opt/seal/etc/tls/ca.pem
    
  3. Save the configuration file.

  4. Restart the following service:

    • seal-mongodb

Change the Token for Encrypting the Credentials

If you keep the standard installation, MongoDB is used as credential store. For security reasons, change the pre-configured token used for encrypting the credentials. The token may be any string.

  1. In the configuration of SEAL Operator, specify the token with MONGO_TOKEN.

  2. Stop all SEAL Operator services.

  3. Delete the complete data directory of MongoDB:

    /opt/seal/data/seal-mongodb
    
  4. Start the following service:

    • seal-mongodb
  5. Start the Complete SEAL Operator System.


Enable the User Authentication

After the installation, the user authentication of MongoDB is disabled. In order to make MongoDB more secure, activate the user authentication.

  1. Open a shell and change to the following directory:

    /opt/seal/seal-mongodb
    
  2. Execute the following script:

    ./secure-mongo.sh
    

Back to top