This topic describes the data security features of ApsaraDB for MongoDB.
Whitelist group names and sources
Follow the steps in Modify a whitelist to open the Whitelist Settings page and view the whitelist groups of the instance.
By default, an ApsaraDB for MongoDB instance has only one whitelist group named default. The system automatically adds more groups during operations like data migration. The following table describes the names and sources of these whitelist groups.
Group name | Source |
default | The default system whitelist group. This group cannot be deleted. |
ddsdts | The system automatically creates this group and adds the IP addresses of Data Transmission Service (DTS) servers to it when you perform a data migration task. Note If a data migration task is in progress, do not delete this group. Otherwise, the task will fail. |
hdm_security_ips | The system automatically creates this group and adds the IP addresses of Database Autonomy Service (DAS) servers to it when you perform the Authorize DAS to manage MongoDB instances (Deprecated) operation. Note Do not delete this group if the instance needs to continue using the real-time performance, instance session, and space analysis features in CloudDBA. |
rds_replica_group | The system automatically creates this group and adds the IP addresses of the disaster recovery system's servers to it when you perform the Create a cloud disaster recovery instance operation. Note Do not delete this group if you need to continue using the cloud disaster recovery feature. Otherwise, data synchronization will fail. |
KMS encryption
You can enable Transparent Data Encryption (TDE) in the console to encrypt and decrypt data files in real time. TDE encrypts data before it is written to disk and decrypts data when it is read into memory.
MONGODB-CR authentication
Description
ApsaraDB for MongoDB supports only SCRAM-SHA-1 authentication, not MONGODB-CR authentication. If you attempt to change the configuration by setting schema.currentVersion=3, the following error is returned:
WriteResult({
"writeError" : {
"code" : 13,
"errmsg" : "not authorized on admin to execute command {
update: \"system.version\", updates: [ { q: { _id: \"authSchema\" },
u: { _id: \"authSchema\", currentVersion: 3 },
multi: false, upsert: true } ], ordered: true }"
}
})Cause
ApsaraDB for MongoDB does not support the MONGODB-CR authentication method due to its security vulnerabilities. Only SCRAM-SHA-1 authentication is supported.
Solution
This is by design.
More information
SCRAM-SHA-1 is the recommended authentication method. The authentication process is as follows:
The client initiates a SCRAM authentication request.
The server responds with a challenge.
The client responds with proof data and a combined string.
The server generates a signature by using its stored key and random parameters with the same algorithm, and then verifies the client proof data.
The client verifies the server's signature.
SCRAM-SHA-1 authentication offers the following advantages over MONGODB-CR authentication:
Flexible, tunable security strength.
Independent random parameters for each user.
A more secure hash function.
Support for mutual authentication.