Network ports · 27017
27017 — MongoDB
Port 27017 is the default MongoDB listener and a repeated target of mass ransom campaigns.
Key facts
| Port | 27017 |
|---|---|
| Transport | TCP |
| Service | MongoDB |
| Default auth | Disabled in older versions |
| Binding | <code>bindIp</code> configuration |
| Exposure | Keep private |
A history of exposed databases
Early MongoDB versions listened on all interfaces without authentication. Automated campaigns found those instances, copied or deleted the data and left a ransom note. Later versions changed the defaults, but misconfigured deployments still appear in scans.
An exposed database is not only a confidentiality problem. An attacker with write access can corrupt data, create users or use the server as a foothold.
The minimum configuration
Set bindIp to loopback or a private address, enable authentication, create per-application users with scoped roles, and require TLS for remote connections. Put the database in a private subnet with a firewall rule that only the application can reach.
Backups should be tested, not just scheduled. A ransom campaign is easier to survive when a recent restore is available.
Frequently asked questions
Is MongoDB authentication on by default?
In current versions, access control is disabled until you enable it and create an administrator. Do that before exposing the service to any network.
How do I connect remotely without exposing 27017?
Use an SSH tunnel or a private network path, and keep bindIp restricted.