Skip to content

Secure MongoDB

For security reasons, SEAL Systems strongly recommends configuring the TLS encryption and changing the token used for encrypting the credentials. For even more security, activate the user authentication for MongoDB.

Configure the TLS Encryption

In order to secure the connection with MongoDB, you need a combined PEM file containing both the TLS certificate and the private key.

  1. Combine the file containing the certificate:

    C:\ProgramData\SEAL Systems\config\tls\cert.pem

    and the file containing the private key:

    C:\ProgramData\SEAL Systems\config\tls\key.pem

  2. Save the combined file as:

    C:\ProgramData\SEAL Systems\config\tls\cert-key-combined.pem

Specify the CA Certificate (If Available)

This step is only required if your certificate contains a CA certificate. If the certificate exists, it is checked for validity when the connection is established.

  1. Open the configuration file of MongoDB:

    C:\ProgramData\SEAL Systems\config\mongod.conf

  2. Replace the following line:

    allowInvalidCertificates: true

    by the following line:

    CAFile: C:\ProgramData\SEAL Systems\config\tls\ca.pem

  3. Save the configuration file.

  4. Restart the following service:

    • seal-mongodb

Change the Token for Encrypting the Credentials

If you keep the standard installation, MongoDB is used as credential store. For security reasons, change the pre-configured token used for encrypting the credentials. The token may be any string.

  1. In the configuration of SEAL Operator, specify the token with MONGO_TOKEN.

  2. Stop all SEAL Operator services.

  3. Delete the complete data directory of MongoDB:

    C:\ProgramData\SEAL Systems\data\seal-mongodb

  4. Start the following service:

    • seal-mongodb

  5. Start the Complete SEAL Operator System.

Enable the User Authentication

After the installation, the user authentication of MongoDB is disabled. In order to make MongoDB more secure, activate the user authentication.

  1. Open a PowerShell (Administrator) and change to the following directory:

    C:\Program Files\SEAL Systems\seal-mongodb

  2. Execute the following script:

    .\secure-mongo.ps1
Back to top