inspec.yml

name: mongodb-enterprise-advanced-4-stig-baseline
title: mongodb-enterprise-advanced-4-stig-baseline
maintainer: MITRE SAF Team
copyright: MITRE, 2024
copyright_email: saf@groups.mitre.org
license: Apache-2.0
summary: "Inspec validation profile for MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide :: Version 1, Release: 2 Benchmark Date: 27 Oct 2022"
version: 1.0.0
supports: []
depends: []
inspec_version: ">=6.0"

inputs:
  # SV-252134, SV-252135, SV-252136, SV-252137, SV-252138, SV-252139, SV-252141, SV-252142, 
  # SV-252143, SV-252145, SV-252146, SV-252147, SV-252148, SV-252149, SV-252156, SV-252157, 
  # SV-252159, SV-252160, SV-252164, SV-252167, SV-252168, SV-252169, SV-252171, SV-252179, 
  # SV-252180
  - name: mongod_config_path
    description: "The path to the mongod configuration file"
    type: string
    value: "/etc/mongod.conf"
    required: true
    
  # SV-252135, SV-252136, SV-252142, SV-252160
  - name: mongo_owner
    description: "The system user of the mongod process"
    type: string
    value: "root"
    required: true
    sensitive: true

  # SV-252135, SV-252136, SV-252142, SV-252160
  - name: mongo_group
    description: "The system group of the mongod process"
    type: string
    value: "root"
    required: true
    sensitive: true

  # SV-252140, SV-252141, SV-252146, SV-252154, SV-252155, SV-252157, SV-252159, SV-252163,
  # SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, SV-252175, SV-252176, SV-252182
  - name: mongo_dba
    description: "The mongo DBA user to access the test database"
    type: string
    required: true
    sensitive: true

  # SV-252140, SV-252141, SV-252146, SV-252154, SV-252155, SV-252157, SV-252159, SV-252163,
  # SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, SV-252175, SV-252176, SV-252182
  - name: mongo_dba_password
    description: "The password for the mongo DBA user"
    type: string
    required: true
    sensitive: true
  
  # SV-252140, SV-252141, SV-252146, SV-252154, SV-252155, SV-252157, SV-252159, SV-252163,
  # SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, SV-252175, SV-252176, SV-252182
  - name: mongo_host
    description: "The hostname or IP address used to connect to the database"
    type: string
    required: true
    sensitive: true

  # SV-252140, SV-252141, SV-252146, SV-252154, SV-252155, SV-252157, SV-252159, SV-252163,
  # SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, SV-252175, SV-252176, SV-252182
  - name: mongo_port
    description: "The port used to connect to the database"
    type: numeric
    required: true
    sensitive: true

  # SV-252140,SV-252154, SV-252155, SV-252157, SV-252163, SV-252174
  - name: mongo_auth_source
    description: "The database used to authorize users"
    type: string
    required: true
    sensitive: true

  # SV-252134, SV-252171
  - name: mongo_filter
    description: "The filter used in authLog"
    type: string
    value: "{ atype: { $in: [ \"createCollection\", \"dropCollection\" ] } }"
    required: true
    sensitive: true

  # SV-252139, SV-252140, SV-252141, SV-252146, SV-252147, SV-252154, SV-252155, SV-252157, 
  # SV-252159, SV-252160, SV-252163, SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, 
  # SV-252175, SV-252176, SV-252179, SV-252180, SV-252182
  - name: ca_file
    description: "The path to the CA file"
    type: string
    required: true
    sensitive: true

  # SV-252139, SV-252140, SV-252141, SV-252146, SV-252147, SV-252154, SV-252155, SV-252157, 
  # SV-252159, SV-252160, SV-252163, SV-252165, SV-252167, SV-252168, SV-252169, SV-252174, 
  # SV-252175, SV-252176, SV-252179, SV-252180, SV-252182
  - name: certificate_key_file
    description: "The path to the certificate key file"
    type: string
    required: true
    sensitive: true

  # SV-252140, SV-252154, SV-252155, SV-252157, SV-252163, SV-252174
  - name: mongo_superusers
    description: "Authorized superuser accounts"
    type: array
    value:
      - "admin.root"
    required: true
    sensitive: true

  # SV-252155, SV-252157
  - name: mongo_users
    description: "Authorized user accounts in the format of database.user"
    type: array
    value:
      - "test.myTester"
      - "products.myRoleTestUser"
    required: true
    sensitive: true
  
  # SV-252155
  - name: mongo_roles
    description: "Authorized roles for MongoDB in the format of database.role"
    type: array
    value:
      - "admin.root"
      - "products.myTestRole"
      - "test.read"
    required: true
    sensitive: true

  # SV-252140, SV-252163, SV-252174
  - name: inappropriate_mongo_privileges
    description: "Inappropriate priveleges for all roles in MongoDB"
    type: array
    value:
      - "changeStream"
      - "createCollection"
    required: true
    sensitive: true

  # SV-252135, SV-252136, SV-252142, SV-252160
  - name: mongo_permissions
    description: "File and directory permissions that should be granted to mongo"
    type: string
    value: "0600"
    required: true

  # SV-252135
  - name: mongo_audit_directory_path
    description: "The path to the mongo audit directory"
    type: string
    value: "/var/log/mongodb/audit/"
    required: true

  # SV-252134, SV-252135, SV-252171
  - name: mongo_audit_file_path
    description: "The path to the mongo audit file"
    type: string
    value: "/var/log/mongodb/audit/auditLog.bson"
    required: true

  # SV-252139, SV-252160, SV-252179, SV-252180
  - name: certificate_key_file_dest
    description: "The path to the mongo certificate key"
    type: string
    value: "/etc/ssl/mongodb.pem"
    required: true

  # SV-252139, SV-252160, SV-252179, SV-252180
  - name: ca_file_dest
    description: "The path to the mongo CA file"
    type: string
    value: "/etc/ssl/CA_bundle.pem"
    required: true

  # SV-252142
  - name: data_file_directory_path
    description: "The path to the mongo data file directory"
    type: string
    value: "/data/db/"
    required: true

  # SV-252147, SV-252165
  - name: encryption_at_rest
    description: "If any data is PII, classified or is deemed by the organization the need to be encrypted at rest"
    type: boolean
    value: false
    required: true

  # SV-252149, SV-252157
  - name: ldap_enabled
    description: "LDAP is used for authentication and authorization"
    type: boolean
    value: false
    required: true

  # SV-252141, SV-252182
  - name: mongo_version
    description: "The edition of MongoDB in use"
    type: string
    value: "7.0.12"
    required: true

  # SV-252182
  - name: mongo_edition
    description: "The edition of MongoDB in use"
    type: string
    value: mongodb-enterprise-server
    required: true