Port 27017: MongoDB — Complete Guide

Port 27017 is reserved for MongoDB. MongoDB database. Unauthenticated open = mass ransomware 2017-18. Loopback/VPC only.

Check port 27017 →

Close the port if the service isn't used. For admin ports, require IP whitelist or VPN. Monitor connection attempts via fail2ban.

MongoDB is a NoSQL database designed for scalability and flexibility, which has gained immense popularity due to its ability to handle large volumes of unstructured data. The default communication port for MongoDB is 27017. This port is used for client-server communication, allowing applications to connect to the database server to perform CRUD (Create, Read, Update, Delete) operations.

When a MongoDB server is launched without any configuration changes, it listens on 27017 for incoming connections. This default behavior means that if MongoDB is deployed in a public-facing environment without proper security measures, it can become a target for malicious actors. Particularly during the ransomware waves of 2017-2018, many MongoDB instances were found exposed on the internet with no authentication, leading to mass data breaches and ransom demands.

To mitigate these risks, it is advisable to limit access to port 27017 by implementing network security measures, such as:

• Using a Virtual Private Cloud (VPC) to restrict access to trusted IP addresses.
• Configuring firewall rules to allow connections only from specific sources.
• Implementing VPNs to ensure secure connections to the database.

Additionally, MongoDB provides built-in security features, such as authentication and authorization, which should be enabled to safeguard your data.

Securing MongoDB, especially when it operates on the default port 27017, is crucial to prevent unauthorized access and potential data breaches. Here are some best practices to enhance the security of your MongoDB deployment:

• Enable Authentication: By default, MongoDB does not require authentication, making it vulnerable. Enable authentication by setting security.authorization to enabled in the mongod.conf configuration file.
• Use Firewalls: Implement firewall rules to restrict access to 27017. Only allow connections from trusted IP addresses or networks.
• Bind IP Address: Configure MongoDB to listen only on localhost or specific IP addresses by modifying the bindIp setting in mongod.conf. For example:
net:
bindIp: 127.0.0.1,
• Enable TLS/SSL: Secure data in transit by enabling TLS/SSL. This encrypts the data exchanged between the MongoDB client and server, protecting it from interception.
• Regular Backups: Maintain regular backups of your data to ensure recovery in case of a ransomware attack or data loss.

By following these best practices, you can significantly reduce the risk associated with running MongoDB on port 27017 and protect your sensitive data from unauthorized access.

Configuring MongoDB to operate securely on port 27017 involves several command-line operations and modifications to the configuration file. Below are practical commands and configurations to enhance your MongoDB setup:

1. Starting MongoDB with Authentication

To start MongoDB with authentication enabled, you can use the following command:

Ensure that you have created an admin user before enabling authentication.

2. Modifying the Configuration File

Edit the mongod.conf file to include the following settings:

3. Creating an Admin User

After starting MongoDB without authentication, create an admin user with the following commands:

4. Enabling TLS/SSL

To enable TLS/SSL, start MongoDB with the following command:

These commands and configurations will help you set up a secure MongoDB environment on port 27017, ensuring that your database is protected from unauthorized access and potential attacks.