Mongodb authentication logs #3736
2 changed files+86−1
Modifiedbackend/agents/08_security.md+2−1View fileUnifiedSplit
@@ -2,4 +2,5 @@
22You focus on safe defaults:
33- Never output secrets.
44- Require ADMIN_TOKEN for privileged operations.
5- Suggest password rotation if a secret was exposed.
\ No newline at end of file
5- Suggest password rotation if a secret was exposed.
6- Prefer descriptive MongoDB usernames (e.g. `hibiscus_app`) over generic names like `MONGO_URL` for clearer audit logs; see `docs/MONGODB_AUTHENTICATION_LOGS.md`.
\ No newline at end of file
Addeddocs/MONGODB_AUTHENTICATION_LOGS.md+84−0View fileUnifiedSplit
@@ -0,0 +1,84 @@
1# MongoDB Authentication Logs — Analysis & Reference
2
3This document explains how to interpret MongoDB Atlas authentication logs and summarizes findings from recent logs.
4
5## Log Format
6
7| Column | Description |
8|--------|-------------|
9| **Timestamp** | When the authentication occurred |
10| **Username** | The authenticated identity (MongoDB user or external principal) |
11| **IP Address** | Source IP of the connection |
12| **Host** | MongoDB Atlas host that received the connection |
13| **Authentication Source** | Database used for auth (`admin`, `$external`, etc.) |
14| **Authentication Result** | Success or failure |
15
16---
17
18## Sample Log Analysis (hibiscustoairport cluster)
19
20### Two Authentication Sources
21
22#### 1. Application / Backend (`MONGO_URL` → `admin`)
23
24| Username | Auth Source | Typical Use |
25|----------|-------------|-------------|
26| `MONGO_URL` | `admin` | Backend server (Render) using connection string from `MONGO_URL` env var |
27
28- **Source IP:** `74.220.49.253` (likely Render deployment)
29- **Connection string format:** `mongodb+srv://MONGO_URL:<password>@hibiscustoairport-shard-00-02.vte8b8.mongodb.net/...`
30
31> **Note:** The username `MONGO_URL` in Atlas logs means the MongoDB user in your connection string is literally named `MONGO_URL`. This is an unusual choice. Consider creating a dedicated user (e.g. `hibiscus_app` or `bookaride_backend`) for clearer audit trails and easier credential rotation.
32
33#### 2. Human / Atlas UI (`CN=ccantynz@gmail.com` → `$external`)
34
35| Username | Auth Source | Typical Use |
36|----------|-------------|-------------|
37| `CN=ccantynz@gmail.com` | `$external` | MongoDB Atlas UI, Compass, or CLI using Google/LDAP/X.509 |
38
39- **Source IPs:** `13.238.145.51`, `54.252.174.158` (AWS ap-southeast-2 — Australia)
40- **Auth method:** External (e.g. Google OAuth, X.509, or LDAP)
41
42---
43
44## IP Address Summary
45
46| IP | Likely Origin | Used By |
47|----|---------------|---------|
48| `74.220.49.253` | Render / hosting provider | Backend (`MONGO_URL`) |
49| `13.238.145.51` | AWS ap-southeast-2 | Atlas UI / Compass (`CN=ccantynz@gmail.com`) |
50| `54.252.174.158` | AWS ap-southeast-2 | Atlas UI / Compass (`CN=ccantynz@gmail.com`) |
51
52---
53
54## Security Recommendations
55
561. **Use descriptive usernames** — Prefer `hibiscus_app` or `bookaride_backend` over `MONGO_URL` for application connections. This improves audit clarity and avoids confusion with env var names.
57
582. **Rotate credentials** — If `MONGO_URL` or any credential may have been exposed, rotate the MongoDB user password and update `MONGO_URL` in Render.
59
603. **Restrict IP access** — In MongoDB Atlas → Network Access, consider limiting allowed IPs to known deployment and admin IPs (e.g. Render outbound IPs, your office/VPN).
61
624. **Monitor failed logins** — Watch for `Authentication Result: Failed` entries; repeated failures from unknown IPs may indicate brute-force attempts.
63
645. **Separate admin and app users** — Use different MongoDB users for:
65 - Application (read/write to app DB only)
66 - Admin/bootstrap (e.g. for `/admin/bootstrap`)
67 - Atlas UI access (your personal `$external` identity)
68
69---
70
71## Where to Find These Logs
72
731. Log in to [MongoDB Atlas](https://cloud.mongodb.com)
742. Select your project and cluster (`hibiscustoairport`)
753. Go to **Security** → **Authentication** or **Monitoring** → **Logs**
764. Filter by authentication events
77
78---
79
80## Related Configuration
81
82- **Backend:** `MONGO_URL` env var (Render, local `.env`)
83- **Code:** `backend/database.py`, `backend/booking_routes.py`, `backend/admin_routes.py`
84- **Security agent:** `backend/agents/08_security.md`
085
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts