Default connection url for mongodb

[pushpdeep]

Hi,
I have deployed mongodb and nosqlclient on docker swarm and using traefik for routing.
The moment i open the nosqlclient url then, there's an option to 'connect' . It auto-detects the mongodb running on 27017 and connects to the database by itself. Doesnt asks for any passwords or any kind of authentication . If anyone comes to know url of my nosqlclient instance then, they can easily access all my database. !!! How do I secure this ?

[rsercano]

Hi @pushpdeep I suppose there's a misconfiguration here. There shouldn't be any pre-filled connection unless you fill MONGOCLIENT_DEFAULT_CONNECTION_URL which has the intention to predefine a connection.

Also I guess this's the instance which nosqlclient itself uses for it's own connections & settings, because nosqlclient itself needs a mongodb to be able to run and keeps it's connections & settings there.

[pushpdeep]

@rsercano I am sharing a bit from the inspect, I believe 'Env' maybe the thing to look at

{
    "AppArmorProfile": "docker-default",
    "Args": [
        "node",
        "main.js"
    ],
    "Config": {
        "AttachStderr": false,
        "AttachStdin": false,
        "AttachStdout": false,
        "Cmd": [
            "node",
            "main.js"
        ],
        "Domainname": "",
        "Entrypoint": [
            "./entrypoint.sh"
        ],
        "Env": [
            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "NODE_VERSION=12.16.1",
            "GOSU_VERSION=1.10",
            "ROOT_URL=http://localhost",
            "PORT=3000",
            "INSTALL_MONGO=true",
            "MONGOCLIENT_DEFAULT_CONNECTION_URL=",
            "MONGOCLIENT_CONNECTIONS_FILE_PATH=/opt/meteor/dist/predefined_connections.json",
            "APP_SOURCE_DIR=/opt/meteor/src",
            "APP_BUNDLE_DIR=/opt/meteor/dist",
            "BUILD_SCRIPTS_DIR=/opt/build_scripts"
        ],
        "ExposedPorts": {
            "3000/tcp": {}
        },
        "Hostname": "ef9c288ef235",
        "Image": "mongoclient/mongoclient:latest@sha256:ca98c95de349493fab630ca3fae6e611e27e392ebc59f14d7dd73580c045927a",
        "Labels": {
            "com.docker.stack.namespace": "mongo-shs",
            "com.docker.swarm.node.id": "ranam82eujbv12fbog1pzl46k",
            "com.docker.swarm.service.id": "q78d7db4l81bqht0hm76kk714",
            "com.docker.swarm.service.name": "mongo-shs_mongo-express",
            "com.docker.swarm.task": "",
            "com.docker.swarm.task.id": "4uf3aymh8s2vxatne5afmjhr8",
            "com.docker.swarm.task.name": "mongo-shs_mongo-express.1.4uf3aymh8s2vxatne5afmjhr8"
        },
        "OnBuild": null,
        "OpenStdin": false,
        "StdinOnce": false,
        "Tty": false,
        "User": "node",
        "Volumes": null,
        "WorkingDir": "/opt/meteor/dist/bundle"
    },

[rsercano]

I see, I really dont see a way you put MONGOCLIENT_DEFAULT_CONNECTION_URL but you really should get rid of it, I'm not familiar with swarm, but it points to a file as you shared, and I suppose it contains the connection you want to get rid of, so basically you should unset MONGOCLIENT_DEFAULT_CONNECTION_URL wherever it was set

[pushpdeep]

@rsercano thanks again for the reply. I did not set the MONGOCLIENT_DEFAULT_CONNECTION_URL anywhere, so there's no need to un-set it. It will be a great help if anyone at your end can help configuring 'mongoclient' it with docker-compose.

[rsercano]

Uhm unfortunately there's no paid support on mongoclient/nosqlclient, so in your case I wonder where it came 🤔 when you don't specify it, it shouldn't appear at all. So for compose setup just dont give any environment variable, or at worst try to set it "" (empty) and let me know

[pushpdeep]

@rsercano Yep..
I did include the MONGOCLIENT_DEFAULT_CONNECTION_URL: ""
and here is the inspect

        "Env": [
            "MONGOCLIENT_DEFAULT_CONNECTION_URL=",
            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "NODE_VERSION=12.16.1",
            "GOSU_VERSION=1.10",
            "ROOT_URL=http://localhost",
            "PORT=3000",
            "INSTALL_MONGO=true",
            "MONGOCLIENT_CONNECTIONS_FILE_PATH=/opt/meteor/dist/predefined_connections.json",
            "APP_SOURCE_DIR=/opt/meteor/src",
            "APP_BUNDLE_DIR=/opt/meteor/dist",
            "BUILD_SCRIPTS_DIR=/opt/build_scripts"

The MONGOCLIENT_DEFAULT_CONNECTION_URL: " has now moved to the top of the line in inspect. Thats the only difference.

My next step was to play around a bit more and infuse a URL . After deployment, this guy couldn't connect to its own mongo backend. and throws the error : [1007] Invalid connection string
in the connect window , the servers ip was now replaced from 127.0.0.1:27017 to https:27017 which was a bit weird !

I then flipped it back by removing the MONGOCLIENT_DEFAULT_CONNECTION_URL: ""

I believe its hardcoded in the docker image itself. maybe a bug or something.. not sure.
Joining the Slack for more help and insights :)