mongo-hardened-fips
Data
Fips
Hardened
Stig
docker pull reg.mini.dev/mongo-hardened-fips
Data
Fips
Hardened
Stig
Updated 9 hours ago
docker pull reg.mini.dev/mongo-hardened-fips
CIS Mongo
CIS Mongo Compliance
100%
Passed
Scan Date
Image Tag
Checks
Analyzed
9Passed
9Failed
0CIS MongoDB 8 Benchmark v1.0.0
Ensure the appropriate MongoDB software version/patches are installed
CIS ID
1.1Status
Passed
Notes
Minimus updates the image's MongoDB package regularly to incorporate the latest official security releases and validates versions against supported vendor baselines. View the Minimus new version SLA for further information.
Ensure authentication is configured
CIS ID
2.1Status
Passed
Hardened configuration
Notes
Authorization is explicitly enabled in the image configuration.
Ensure that MongoDB does not bypass authentication via the localhost exception
CIS ID
2.2Status
Passed
Hardened configuration
Notes
Localhost authorization bypass is explicitly disabled by default (setParameter.enableLocalhostAuthBypass: false).
Ensure that MongoDB is run using a non-privileged, dedicated service account
CIS ID
3.3Status
Passed
Notes
Minimus verified the configuration to ensure the mongod/mongos process owner is a dedicated non-root, non-privileged account.
Ensure federal information processing standard (FIPS) is enabled
CIS ID
4.4Status
Passed
Notes
This image uses a NIST CMVP certified FIPS 140-3 cryptographic provider. The Minimus implementation is functionally equivalent to the MongoDB CIS Benchmark recommendation. See the FIPS tab for further information.
Ensure that logging captures as much information as possible
CIS ID
5.3Status
Passed
Hardened configuration
Notes
Configured to disable quiet logging (systemLog.quiet: false).
Ensure that new entries are appended to the end of the log file
CIS ID
5.4Status
Passed
Hardened configuration
Notes
Configured to append new entries to the end of log files as required (systemLog.logAppend: true).
Ensure that MongoDB uses a non-default port
CIS ID
6.1Status
Passed
Hardened configuration
Notes
This image is configured to use a non-default port (net.port is not configured to 27017).
Ensure that server-side scripting is disabled if not needed
CIS ID
6.3Status
Passed
Hardened configuration
Notes
The default configuration is set to disable server-side JS features with security.javascriptEnabled: false.