Local Mongodb security

Question

So I'm new to the noSQL wave of things and I've been working with the MEAN Stack recently. I just have a question about security when it comes to running MongoDB on the same server I'm running the rest of my website. Whenever I have a mySQL or SQL Server database, I was always advised to run it remotely but when it comes to the MEAN stack, it's all local. And usually when I look online, everyone has their MongoDB running with the rest of their code and I was just wondering if that's just how it's done?

I guess the reason why some say to use it remotely is because it is generally easier to penetrate an app server (code faults etc) than it is a dedicated db server, even if you could run your db on localhost, but yes it is normally ok to run db on local — Sammaye, May 25 '14 at 19:03
Oh they do, and MEAN is not all local, that is just to demonstrate, what you see is all the demos, you should of course take note that they are dev only — Sammaye, May 25 '14 at 20:01

score 0 · Accepted Answer · edited Oct 22 '18 at 19:30

Whenever I have a mySQL or SQL Server database, I was always advised to run it remotely

Same or different server. Both of them, doesn't guarantee your security problems.

The biggest problem is performance. Scalability. Very difficult to horizontally scale a database server, but MongoDB's architecture features built-in support for horizontal scalability.

Back to MongoDB security. Too many good answers. Here is related links :

I use different environments. One on my local machine for development and one on my production server. And MEAN, not only local.

score 0 · Answer 2 · answered May 26 '14 at 00:20

I think you are confusing how one frequently develops with the MEAN stack and how one deploys a production application. All MongoDB drivers, regardless of language used, use a combination of hostname and port number (perhaps also with database name and username/password) to access the MongoDB instance.

That you see people deploying MEAN all on one system points more to these systems either being developmental in nature or to some level of ignorance about how to deploy production applications that incorporate a web server, code and a database.

MongoDB in general is going to be better managed in it's own environment. For one, you'll want to deploy it as a replica set, that includes at least 3 servers. Second, MongoDB likes to use all available RAM on a system as it's cache. While you can run other software on the same server the database will do better if it's there alone. It's also much easier to pick different server sizes for the appropriate use case - between applications, web servers and databases some require more memory, others more cpu, still others more and faster disk. Splitting it up allows you to tune things appropriately.

Local Mongodb security

2 Answers2