# MongoDB Security<br />ch2 Authorization and Encryption

###### tags: `MongoDB University M310`

## Authorization Model

MongoDB authorization model is **role based control access control.**

The model is for any given **user** we're going to go ahead and assign a **role** to that user. And that role is going to be assigned over a given namespace.
The namespace is just a **database** in mongodb.

For example we create a user named **kirby** and a role called **readWrite** role for the **products database**.

db.createUser({
    user: 'kirby',
    pwd: 'secret',
    roles: [
        {
            role: 'readWrite',
            db: 'products'
        }
    ]
})

:::info
**Roles** are groups of **privileges**, **actions** over **resources**, that are granted to **users** over a given **namespace(database)**.

:::

| Actions | Resources |
| ---------- | ---------- |
| insert | collection |
| create | database |
| createUser | cluster |
| addShard | |

Role based access control gives a high level of responsibility isolation for operational tasks. This means we can grant what privileges the user need against their role in work.

## Built-in Roles
There are a lot of built-in roles in mongodb.
[Official Document Built-In Roles](https://docs.mongodb.com/manual/reference/built-in-roles/)

## User defined roles
Though the built-in roles should cover majority of the difference type of people who need to use database, we can build our own roles.

## Action, Resources and Privileges

There are 2 parts of privileges, **action** and **resources**.

**Action** describes the ***operations*** that given user may perform on a resources in the database.
e.g. find, insert, remove, update, createUser...

**Resources** are subject of actions, there are 4 resources in mongodb:
1. collection, databases

// a specific database
{ db: "products", collection: ""}

// a specific collection
{ db: "", collection: "inventory"}

// a specific collection on a specific databse
{ db: "products", collection: "inventory" }

// All none system collection on all databses
{ db: "", collection: "" }

2. cluster

{ cluster: true }

3. anyResource

// This resource is for internal usage only!
{ anyResource: true }

Privileges are defined by using a privileged document.

{
    resource: {
        db: <database>,
        collection: <collection>
    },
    actions: [
        <actions>
    ]
}

Run the command can get the privileged document of the role.
Read role for example.

db.getRole('read')

// to get privilege details
db.getRole('read', { showPrivileges: true })

## Create user with built in role
Let's get started with a real world example. There are 4 members in our team and we need to grant the specific privilege to each one of them.
* Alice - `security officer`
Needs to:
* Create/drop user in any database
* Grant/revoke roles
* Create/update/delete roles

Does not need to:
* See any collection data
* Create/drop any database or collection
* Perform backup/restore operations

db.createUser(
    { 
        user: 'alice', 
        pwd: 'sharppencil', 
        roles: [
            {
                role: 'userAdminAnyDatabase', db: 'admin'
            }
        ] 
    }
)

* Ben - `sysAdmin`
Needs to:
* Do maintainance operations
* Add/Remove member of a replica set
* Add/Remove shards in sharded cluster

Does not need to:
* See any collection data
* Create/Drop any database or collection
* List any database or collection

db.createUser(
    {
        user: 'ben',
        pwd: 'secret',
        roles: [
            {
                role: 'clusterManager', db: 'admin'
            }
        ]
    }
)

* Carol - `DBA`
Needs to:
* Check database status
* Kill long running operations
* Create collections, indexes, etc

Does not need to:
* Write to any collection
* Manage a cluster
* Create new users

// Wrong example
db.createUser(
    {
        user: 'carol',
        pwd: 'secret',
        roles: [
            { roles: 'dbAdmin', db: 'admin'}
        ]
    }
)

// We found that Carol needs more privilege, 
// so we should change Carol's role from dbAdmin to dbAdminAnyDatabase
db.updateUser('carol', roles: [
    {
        role: 'dbAdminAnyDabase',
        db: 'admin'
    }
])

* Dan - `intern`
Needs to:
* Query the nasa database

Does not need to:
* Do anythin else

db.createUser(
    {
        user: 'dan',
        pwd: 'secret',
        roles: [
            {role: 'read', db: 'nasa'}
        ]
    }
)

:::info
**Hint**
Since dan is created in nasa database,
The account need to authenticate against nasa database
:::
Sometimes we need to add --authenticationDatabase parameter to our command if the account is not created on the db we are performing to like:

// We have a user created in admin, and was granted the readWrite role on nasa
mongoimport -u botloader -p secret -d nasa -c meteorites nasa_meteorites.json --authenticationDatabase admin

## Create user defined role
Roles are comprised of three components: a name, a list of inherited roles and a list of privileged documents.

db.createRole({
    role: <role name>,
    privileges: [{
        resource: {
            db: <database>,
            collection: <collection>
        },
        actions: [
            <action>
        ]
    }],
    roles: [{
        role: <role>,
        db: <database>
    }]
})

In this case, we want to change Dan's role to a user defined role.
The role allows to update the collection meteorites on the nasa database and we still want the role to be able to inherit the ability to read the nasa dababase.

db.createRole( {
    role: 'customRole',
    privileges: [{
        resource: { db: 'nasa', collection: 'meteorites' }, actions: ["update"]
    }],
    roles: [
        { role: 'read', db: 'nasa' }
    ]
} )

db.updateUser( 'dan', { roles: [{ role: 'customRole', db: 'admin' }]})

## Grant new privileges to role
In mongodb, roles are updatable except the built-in roles. There are 3 ways to update a given role.
1. Update roles by pushing actions onto action array of the privilege

const role = db.getRole('customRole', {showPrivileges: ture})
const updatePrivileges = role.privileges
updatePrivileges[0].actions.push('insert')
db.updateRole('customRole', {privileges: updatePrivileges})

2. Use grantPrivilegesToRole function

db.grantPrivilegesToRole('customRole', [{resource: { db: 'nasa', collection: 'meteorites' }}], actions: ['insert'])

3. use grantRolesToRole

db.grantRolesToRole('customRole', ['readWriteAnyDatabase'])

## Revoke privilege from role

db.revokePrivilegesFromRole('customRole', [
    {
        resource: {
            db: '',
            collection: 'internlog'
        },
        action: ['update']
    }
])

## Encryption Intro
* Transport Encryption
* Encryption at Rest

## Transport encryption (TLS)
MongoDB use TLS/SSL to encrypt information between client and server.

TLS is by the public/private key encryption algrithm through the utilization of SSL certificates.

This allow clients and server verify each other and provides the ability to encript messages.

MongoDB uses openssl libraries for TLS encryption. From MongoDB 4.0 onwards, the server uses native TLS/SSL library implementations.

## TLS connection modes
4 mode for SSL connection in MongoDB
* disabled
* allowSSL
* preferSSL
* requireSSL

mongod --sslMode requireSSL --sslPEMKeyFile server.pem

## Enable TLS between client and mongod

mongod --sslMode requireSSL --sslPEMKeyFile server.pem

mongod --sslMode requireSSL --sslPEMKeyFile server.pem --sslCAFile ca.pem

The difference between two command is the second command would verify the identify of client and make sure they are connecting with the certificate signed by the same ca.

If we don't provide the SSL CA file, that means that would be susceptible to a man-in-middle attack.

## Enable TLS within replica set

## Encrypted Storage Engine

### Application Level Encryption
Application level encryption is not an actual feature of MongoDB, we encryp and decrypt the information **within application layer**.

**MongoDB always keeps the encrypted ciphertext**.

### Storage Level Encryption
Only available on
* MongoDB enterprise 3.2
* WiredTiger storage engine

Basically our data lives in RAM as unencrypted text.
When mongodb decide to write informations to disk, it will ***encrypt the information in RAM and then store the encrypted information to disk.***

4 steps for storage engine encryption:
1. Generate a **master key**
2. Generate a key for each database and encrypt the database with the key
3. After each databse is encrypted, each key is encrypted with the master key
4. Each databse key is stored **within** MongoDB, the master key is stored **outside** the MongoDB

2 key management options for master key
* Key Management Interoperability Protocol(KMIP)
* Local Key Management(key file)

// Domo for local key management(not recommended)
// First, generate a key file
openssl rand -base64 32 > mongodb-keyfile
chmod 600 mongodb-keyfile
// Second, starting a mongod instance with storage engine
mongod --enableEncryption --encryptionKeyFile mongodb-keyfile

## KMIP Integration

MongoDB enterprise supports secure transfer of key files with a compatible key management appliance.

**KMIP Key Management**
* HIPAA
* PCI-DSS
* FERPA

Start mongod to connect kimp server

mongod --enableEncryption --kmipServerName <hostname> --kmipServerCAFile ca.pem --kmipClientCertificateFile client.pem