I am trying to enable authentication on my Mongo database. In /etc/mongod.conf I have
security:
authorization: enabled
setParameter:
authenticationMechanisms: SCRAM-SHA-1
However, when I connect to the database with no credentials as
mongosh "mongodb://xxx.xxx.xx.xx:port"
I still get a shell prompt connected to the test database:
Current Mongosh Log ID: xxxxx
Connecting to: mongodb://xxx.xxx.xx.xx:port/?directConnection=true&appName=mongosh+1.5.4
Using MongoDB: 6.0.1
Using Mongosh: 1.5.4
For mongosh info see: https://docs.mongodb.com/mongodb-shell/
test>
I seem to be unable to perform any operations and get MongoServerError telling that the operation requires authentication. I was just wondering if getting a shell by itself represents any vulnerability.
If I recall correctly, in earlier versions of Mongo I could not even get a shell if I did not provide credentials in the connection command. Here I can connect without any problems, but I'm unable to do anything without authentication. Is this the intended behavior?