Mongodb authentication logs #3735
2 changed files+113−1
Modifiedbackend/agents/08_security.md+2−1View fileUnifiedSplit
@@ -2,4 +2,5 @@
22You focus on safe defaults:
33- Never output secrets.
44- Require ADMIN_TOKEN for privileged operations.
5- Suggest password rotation if a secret was exposed.
\ No newline at end of file
5- Suggest password rotation if a secret was exposed.
6- Prefer descriptive MongoDB usernames (e.g. `hibiscus_app`) over generic names like `MONGO_URL` for clearer audit logs; see `docs/MONGODB_AUTHENTICATION_LOGS.md`.
\ No newline at end of file
Addeddocs/MONGODB_AUTHENTICATION_LOGS.md+111−0View fileUnifiedSplit
@@ -0,0 +1,111 @@
1# MongoDB Authentication Logs — Analysis & Reference
2
3This document explains how to interpret MongoDB Atlas authentication logs and summarizes findings from recent logs.
4
5## Log Format
6
7| Column | Description |
8|--------|-------------|
9| **Timestamp** | When the authentication occurred |
10| **Username** | The authenticated identity (MongoDB user or external principal) |
11| **IP Address** | Source IP of the connection |
12| **Host** | MongoDB Atlas host that received the connection |
13| **Authentication Source** | Database used for auth (`admin`, `$external`, etc.) |
14| **Authentication Result** | Success or failure |
15
16---
17
18## Sample Log Analysis (hibiscustoairport cluster)
19
20### Two Authentication Sources
21
22#### 1. Application / Backend (`MONGO_URL` → `admin`)
23
24| Username | Auth Source | Typical Use |
25|----------|-------------|-------------|
26| `MONGO_URL` | `admin` | Backend server (Render) using connection string from `MONGO_URL` env var |
27
28- **Source IP:** `74.220.49.253` (likely Render deployment)
29- **Connection string format:** `mongodb+srv://MONGO_URL:<password>@hibiscustoairport-shard-00-02.vte8b8.mongodb.net/...`
30
31> **Note:** The username `MONGO_URL` in Atlas logs means the MongoDB user in your connection string is literally named `MONGO_URL`. This is an unusual choice. Consider creating a dedicated user (e.g. `hibiscus_app` or `bookaride_backend`) for clearer audit trails and easier credential rotation.
32
33#### 2. Human / Atlas UI (`CN=ccantynz@gmail.com` → `$external`)
34
35| Username | Auth Source | Typical Use |
36|----------|-------------|-------------|
37| `CN=ccantynz@gmail.com` | `$external` | MongoDB Atlas UI, Compass, or CLI using Google/LDAP/X.509 |
38
39- **Source IPs:** `13.238.145.51`, `54.252.174.158` (AWS ap-southeast-2 — Australia)
40- **Auth method:** External (e.g. Google OAuth, X.509, or LDAP)
41
42---
43
44## Recent Log Summary (2026-02-15)
45
46All 25 authentication events recorded on 2026-02-15 between 8:58 PM and 11:03 PM were **successful**. No failed logins were observed.
47
48### Timeline
49
50| Time (UTC+13) | Username | IP Address | Auth Source |
51|----------------|----------|------------|-------------|
52| 8:58:17 PM | `CN=ccantynz@gmail.com` | 13.238.145.51 | `$external` |
53| 8:59:42–8:59:43 PM | `MONGO_URL` | 74.220.49.253 | `admin` |
54| 9:00:37–9:00:39 PM | `CN=ccantynz@gmail.com` | 54.252.174.158 / 13.238.145.51 | `$external` |
55| 9:06:42–9:06:43 PM | `MONGO_URL` | 74.220.49.253 | `admin` |
56| 9:10:51 PM | `MONGO_URL` | 74.220.49.253 | `admin` |
57| 9:16:35 PM | `MONGO_URL` | 74.220.49.253 | `admin` |
58| 10:26:35–10:26:37 PM | `CN=ccantynz@gmail.com` | 13.238.145.51 / 54.252.174.158 | `$external` |
59| 10:27:42–10:27:44 PM | `CN=ccantynz@gmail.com` | 13.238.145.51 / 54.252.174.158 | `$external` |
60| 11:03:35 PM | `MONGO_URL` | 74.220.49.253 | `admin` |
61
62### Connection Breakdown
63
64| Username | Auth Source | Connection Count | IP(s) |
65|----------|-------------|-----------------|-------|
66| `MONGO_URL` | `admin` | 10 | 74.220.49.253 |
67| `CN=ccantynz@gmail.com` | `$external` | 15 | 13.238.145.51, 54.252.174.158 |
68
69---
70
71## IP Address Summary
72
73| IP | Likely Origin | Used By |
74|----|---------------|---------|
75| `74.220.49.253` | Render / hosting provider | Backend (`MONGO_URL`) |
76| `13.238.145.51` | AWS ap-southeast-2 | Atlas UI / Compass (`CN=ccantynz@gmail.com`) |
77| `54.252.174.158` | AWS ap-southeast-2 | Atlas UI / Compass (`CN=ccantynz@gmail.com`) |
78
79---
80
81## Security Recommendations
82
831. **Use descriptive usernames** — Prefer `hibiscus_app` or `bookaride_backend` over `MONGO_URL` for application connections. This improves audit clarity and avoids confusion with env var names.
84
852. **Rotate credentials** — If `MONGO_URL` or any credential may have been exposed, rotate the MongoDB user password and update `MONGO_URL` in Render.
86
873. **Restrict IP access** — In MongoDB Atlas → Network Access, consider limiting allowed IPs to known deployment and admin IPs (e.g. Render outbound IPs, your office/VPN).
88
894. **Monitor failed logins** — Watch for `Authentication Result: Failed` entries; repeated failures from unknown IPs may indicate brute-force attempts.
90
915. **Separate admin and app users** — Use different MongoDB users for:
92 - Application (read/write to app DB only)
93 - Admin/bootstrap (e.g. for `/admin/bootstrap`)
94 - Atlas UI access (your personal `$external` identity)
95
96---
97
98## Where to Find These Logs
99
1001. Log in to [MongoDB Atlas](https://cloud.mongodb.com)
1012. Select your project and cluster (`hibiscustoairport`)
1023. Go to **Security** → **Authentication** or **Monitoring** → **Logs**
1034. Filter by authentication events
104
105---
106
107## Related Configuration
108
109- **Backend:** `MONGO_URL` env var (Render, local `.env`)
110- **Code:** `backend/database.py`, `backend/booking_routes.py`, `backend/admin_routes.py`
111- **Security agent:** `backend/agents/08_security.md`
0112
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts