安全加固：MongoDB / Redis / Elasticsearch

症状

目标：按 CIS 风格加固 NoSQL/数据存储——认证、网络限制、阻止危险命令、TLS、最小权限角色和审计。

1. 启用认证——切断未经认证的访问

这些产品往往默认禁用认证，一旦暴露在互联网上就会被攻破。启用认证并创建管理员用户。

MongoDB

// mongod.conf:
security:
  authorization: enabled
// Create an administrator user (first time, via the localhost exception):
use admin
db.createUser({ user: "admin", pwd: passwordPrompt(),
  roles: [ { role: "userAdminAnyDatabase", db: "admin" } ] })
// Then connect with: mongosh -u admin --authenticationDatabase admin

Redis

# redis.conf — ACL (Redis 6+): disable the default user, define named users:
user default off
user admin on >AdminPassword789! ~* &* +@all
user app on >AppPassword456! ~app:* +@read +@write
# Note: requirepass is a legacy compatibility setting that only sets the 'default' user's password;
# do not confuse it with ACL users. You can also keep users in an aclfile (persisted with ACL SAVE).

Elasticsearch

# 8.x: security (authentication + TLS) is configured automatically on first start; elasticsearch.yml:
xpack.security.enabled: true
# Set/reset the password of the 'elastic' user:
bin/elasticsearch-reset-password -u elastic
# (elasticsearch-setup-passwords is deprecated since 8.0)
# Create separate users with dedicated roles for Kibana/clients instead of 'elastic'.

2. 限制网络——只开放所需的接口和端口

避免服务在 0.0.0.0 上对全世界监听。将绑定地址固定到内部接口/回环地址，并启用保护模式。

MongoDB

# mongod.conf — internal interface + loopback only:
net:
  bindIp: 127.0.0.1,10.0.0.10
  port: 27017
# Never use bindIpAll: true; limit the port with a firewall.

Redis

# redis.conf:
bind 127.0.0.1 10.0.0.10
protected-mode yes
port 6379
# protected-mode blocks external access when no password is set;
# still limit 6379 with a firewall.

Elasticsearch

# elasticsearch.yml — pin the listening interface:
network.host: 10.0.0.10
http.port: 9200
transport.port: 9300
# Open only the required ports in the firewall;
# 9300 (transport) must never be exposed externally.

3. 限制危险命令

一条命令就可能清除所有数据。重命名或移除破坏性/管理类命令，或阻止通配符目标。

MongoDB

// Use role-based control instead of a separate command block:
// Grant destructive privileges (dropDatabase, dropCollection) only to
// dbAdmin/clusterAdmin roles; do not grant them to the application user.
db.grantRolesToUser("app", [ { role: "readWrite", db: "appdb" } ])
// Do NOT grant dbAdmin/root to the application user.

Redis

# For Redis 6+ the preferred way is ACLs (do not give the application user dangerous commands):
# ACL SETUSER app ... -@dangerous
# Legacy method — disable/rename commands in redis.conf:
rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command KEYS ""
rename-command DEBUG ""
# Caution: renaming CONFIG can break Sentinel, CONFIG REWRITE and management tools.

Elasticsearch

# elasticsearch.yml — block wildcard/all-index deletion:
action.destructive_requires_name: true
# This rejects DELETE /* or DELETE /_all;
# bulk deletion is not possible without naming the index explicitly.

4. 启用 TLS/加密连接

凭据和数据不得在开放网络上以未加密方式传输。为客户端流量和节点间流量启用 TLS。

MongoDB

# mongod.conf — client TLS:
net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca.pem
# Client: mongosh --tls --tlsCAFile ca.pem

Redis

# redis.conf — enable TLS, close the plain port:
port 0
tls-port 6379
tls-cert-file /etc/redis/redis.crt
tls-key-file  /etc/redis/redis.key
tls-ca-cert-file /etc/redis/ca.crt

Elasticsearch

# elasticsearch.yml — HTTP and transport TLS:
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: http.p12
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: transport.p12

5. 授予最小权限角色——避免过宽的角色

只给每个用户其工作所需的访问权限。使用限定于特定数据库、键模式或索引的细粒度角色，而不是过宽/管理类角色。

MongoDB

// Instead of broad readWrite, grant only on the required DB;
// define a custom role if needed:
db.createRole({ role: "ordersRW",
  privileges: [ { resource: { db: "appdb", collection: "orders" },
    actions: [ "find", "insert", "update" ] } ], roles: [] })
db.grantRolesToUser("app", [ { role: "ordersRW", db: "appdb" } ])

Redis

# Limit by key pattern and command category with ACLs:
ACL SETUSER app on >AppPassword456! ~app:* +@read +@write -@dangerous
# Only keys with the 'app:' prefix, read/write; dangerous commands forbidden.
ACL LIST
ACL WHOAMI

Elasticsearch

# Define a fine-grained role (read-only on specific indices):
POST /_security/role/orders_read
{ "indices": [ { "names": [ "orders-*" ],
    "privileges": [ "read" ] } ] }
# Assign it to the user:
POST /_security/user/app
{ "password": "...", "roles": [ "orders_read" ] }

6. 启用审计/日志——监控访问和变更

必须记录未经授权的访问尝试和管理操作。启用审计日志并将其发送到集中位置。

MongoDB

# Auditing (requires MongoDB Enterprise) — mongod.conf:
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
# Filter: capture events such as authenticate, createUser, dropDatabase.

Redis

# Redis has no full audit; use ACL LOG to see rejected
# authentication/command attempts:
ACL LOG
ACL LOG RESET
# Also: route the loglevel notice and logfile settings to a central collector.

Elasticsearch

# elasticsearch.yml — enable security auditing:
xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include:
  [ authentication_failed, access_denied, connection_denied ]
# Records are written to the <cluster>_audit.json file.