mongo-hardened
Data
Hardened
docker pull reg.mini.dev/mongo-hardened
Data
Hardened
Updated 10 hours ago
docker pull reg.mini.dev/mongo-hardened
CIS Mongo
100% compliance available withmongo-hardened-fips
CIS Mongo Compliance
89%
Passed
Scan Date
Image Tag
Checks
Analyzed
9Passed
8Failed
1CIS MongoDB 8 Benchmark v1.0.0
Ensure the appropriate MongoDB software version/patches are installed
CIS ID
1.1Status
Passed
Notes
Minimus updates the image's MongoDB package regularly to incorporate the latest official security releases and validates versions against supported vendor baselines. View the Minimus new version SLA for further information.
Ensure authentication is configured
CIS ID
2.1Status
Passed
Hardened configuration
Notes
Authorization is explicitly enabled in the image configuration.
Ensure that MongoDB does not bypass authentication via the localhost exception
CIS ID
2.2Status
Passed
Hardened configuration
Notes
Localhost authorization bypass is explicitly disabled by default (setParameter.enableLocalhostAuthBypass: false).
Ensure that MongoDB is run using a non-privileged, dedicated service account
CIS ID
3.3Status
Passed
Notes
Minimus verified the configuration to ensure the mongod/mongos process owner is a dedicated non-root, non-privileged account.
Ensure federal information processing standard (FIPS) is enabled
CIS ID
4.4Status
Notes
Switch to the FIPS 140-3 validated image to satisfy this benchmark.
Ensure that logging captures as much information as possible
CIS ID
5.3Status
Passed
Hardened configuration
Notes
Configured to disable quiet logging (systemLog.quiet: false).
Ensure that new entries are appended to the end of the log file
CIS ID
5.4Status
Passed
Hardened configuration
Notes
Configured to append new entries to the end of log files as required (systemLog.logAppend: true).
Ensure that MongoDB uses a non-default port
CIS ID
6.1Status
Passed
Hardened configuration
Notes
This image is configured to use a non-default port (net.port is not configured to 27017).
Ensure that server-side scripting is disabled if not needed
CIS ID
6.3Status
Passed
Hardened configuration
Notes
The default configuration is set to disable server-side JS features with security.javascriptEnabled: false.