The Mongo Service is Configured to Use an Unsecure REST Interface (4040494)

The Mongo Service is Configured to Use an Unsecure REST Interface

The MongoDB is used as the events database for Rapid Recovery. Currently, the Mongodb Service is configured to open the rest interface (--rest), which is unsecured per https://docs.mongodb.org/ecosystem/tools/http-interfaces.

This is the process that is executed on the MongoDB service on the Core:

"C:\Program Files\AppRecovery\Core\CoreService\MongoDb\mongod.exe" --rest --dbpath "C:\ProgramData\AppRecovery\EventsDatabase" --directoryperdb --logpath "C:\ProgramData\AppRecovery\EventsDatabase\db.log" --auth --service

A defect ID has been assigned to this concern.

One change can be made in the registry to conform Rapid Recovery's MongoDB utilization to the best security practices for a production MongoDB.  This will slightly change the way the command executed on the MongoDB service by the Core

1. Gracefully stop the Dell Data Protection | Rapid Recovery Core Service.
2. Open regedit
3. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RapidRecoveryMongod\ImagePath
4. Make a backup
5. Remove "--rest" part of the registry key manually
6. Start the Dell Data Protection | Rapid Recovery Core Service.

Windows Registry Disclaimer: Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support. 

STATUS

This issue fixed in version 6.1. The latest version of Rapid Recovery can be downloaded from the Download Page here.

D-33171