So we had a detailed look at how we can create and manage users and how users are generally set up and
how we work with them. As a developer,
we don't have to worry too much about this whole creation process but it's still nice to know how this
works behind the scenes which is why it was important to me to show this to you.
So now that our database is locked down,
let's make sure that data that is transferred from our app to database also is secure because this is
a typical set up we will have when creating an application that uses mongodb in the backend.
We have our application and this could be a node or a PHP, Python, C++, whatever it is application that
uses them mongodb driver to then communicate to the mongodb server and store data
and of course it's important that the data is encrypted
whilst it is in transport, so that someone who's spoofing our connection cannot read our data and
mongodb has everything we need for that built-in,
so let me now show you how you can easily secure your data whilst it's on its way from client to server.
To encrypt our data in transport,
mongodb uses SSL or actually
TLS which is the successor of SSL
but I'll just say SSL here,
I mean the same though.
So SSL is the more common thing you know and SSL
in the end is just a way of encrypting our data whilst it's on its way and we'll use a public private
key pair to decrypt this information on the server and to prove that we as a client are who we well
make the server think we are.
So essentially it's a secure way of encrypting our data and decrypting it on the server
and whilst it's on its way, it's consistently encrypted.
Now if you want to learn more about SSL and how it works, you'll find a link with detailed instructions
in the last lecture of this module, I will not focus on the underlying technology but how we can make
it work.
Now if you google for a mongodb SSL, you'll find an article that also describes the steps you need
to take and I'm simply showing you this because we will need a command from there which we execute together.
This is essentially a command that will create us the files we need to enable SSL encryption,
so basically this public private key pair
and we can just copy that
and on Linux and Mac, you can just run this command in the terminal, on Windows,
this will not work
but the good thing is on Windows,
if you google for windows open SSL, you will find that binaries open SSL wiki link
and there, you will find open SSL implementations for Windows. Now you can take the top one here and you
should be forwarded to this page and there if you scroll to the bottom, you should find download links
and here for this win64 open SSL Light version, you can just download the executable and then once it
is downloaded, just execute that to install
open SSL on Windows,
this will then ask you for a folder where it should install it and once you did install it into that folder,
you can navigate into that folder in your command prompt on windows, into the bin folder of that installed
folder and from in there, you will be able to run the same command as I do here on Mac and Linux. So on Mac
and Linux,
we can simply paste in this command and again you paste that exact same command on Windows then after
you navigated into that bin folder and hit enter
and now you will be asked a couple of questions.
Now the first questions are not that important and you could enter a dot and hit enter but you can
also fill them out with your right information but the information here doesn't really matter,
you could fill in anything.
Now the important part is that common name here and there, you must fill in localhost during developement,
so whilst we are running this on localhost.
If you were to deploy your mongo database onto a server in the web, you need to fill in the address
of that web server and that will be important
otherwise the connection will fail because this will later be validated
that if you are connecting to a server, that the server you are connecting to is the server that is mentioned
in your certificate,
so we will be connecting to localhost, so we need to put localhost in here.
So hit enter then, you can enter any email address there and now you are done and you will now have two
files,
the mongodb cert key file and the mongodb-cert.crt file.
We now need to concatenate these two into one file and that is also a step you find described in
the official docs. On Mac and Linux,
you can execute this command, on Windows
it's almost the same but you replace cat with type there,
the rest is the same. So you just replace cat with
type on Windows, on Mac and Linux,
it's cat. So after this, you'll have a mongodb.pem file and that is the file you will need to
enable SSL encryption.
Now how does that work?
In that folder where are you stored that pem file
and of course you can now copy and move it around in your file system
but in the folder where that file lives, you can now start your mongod server with SSL enabled,
let's quickly check the options with --help to see how that works.
You'll see a bunch of SSL options here,
one option we need to set is the mode. The SSL mode defines whether SSL is disabled so we connect as before,
if we want to allow clients to connect via SSL but they could still connect without SSL,
if we want to prefer this which is only important if you are using replica sets or if you want to require
this which means any connection that does not use SSL will be denied
and that is actually what I want to use.
So we will need to set SSL mode to require SSL,
we will then also need to point at our pem file with SSL pem key file argument,
now theoretically you could even create such a certificate or such a pem file with a password which you
then also would have to enter
and this is important,
you could also have a CA file, a certificate authority file.
Now you will get this if you get your SSL certificate through an official authority,
you can get those on the Internet, free ones and paid ones
and this is actually a file which you pass in addition to your pem file,
we have that pem file but we have no CA file right now, that CA file would then be an extra layer of
security
that basically ensures that man in the middle attacks can be prevented.
So if you do deploy your mongodb database in production, you would get your SSL certificate from a
certificate authority and they would give you a pem file and CA file and you would basically add both
arguments and point at the respective files when launching your server.
Now in our case here, we will just launch the server mongod with SSL
mode set to, if we scroll up require SSL, so require SSL and then I'll add my SSL pem key file
and now I need to point at my mongodb.pem file and for that, you should navigate into that folder where
that file lies or specify the full path to that file.
If you now hit enter
and on Mac, you might also need to add sudo as before,
if you now hit enter, it should start your server.
You'll see a warning that we have no SSL certificate validation in place because we are missing that
SSL CA file
I just talked about
but besides that, we got a server which is now waiting for connections on port 27017
SSL. So now to connect to the server, we should navigate in a new terminal window into that same
folder where we have that pem file
and now we'll launch our mongo client but launching it like this will fail and if it succeeds, you connect
it to a different mongod instance which you can shut down with db shutdown server of course which
you saw earlier in the course.
But for me it fails here because indeed I got no mongod running which would allow connections
from non-SSL clients.
Now let's check out the help options for the mongo client to see what we can do with SSL there
and indeed here we need to set two things, we need to enable SSL and we will need to pass our pem file
as a SSL CA file here.
So I simply type mongo
--ssl followed by --sslCAFile and that CA file is my mongodb.pem file.
Now this might actually fail
and for this case you need to add --host localhost, so that host you specified during your certificate
creation,
with that, it should succeed.
Now you need it to specify that because otherwise it tried to connect to the IP address 127.0.0.1
which is localhost but technically is a different word therefore was not considered equal to localhost,
so with specifying --host localhost, we made it really clear that this is the host we expect to
see as a name on the backend,
this is the host which was part of our certificate and therefore this works.
Now obviously, you can have more elaborate set ups
and of course you should mean non self-signed certificate but what one you got from an authority for production
use cases
but this will do for now and this shows you how you can generally connect with SSL turned on and now all
data we send from the client,
so from the mongo shell to the mongo server will be encrypted.