MongoDB Security issue - javascript

My confidence in MongoDB security is shaken, and I'm hopping it will be restored with an explanation that I'm doing something wrong...
I've created MongoDB's Windows Service like this:
mongod --logpath "C:\mongoDB\logs" --logappend --dbpath
"C:\mongoDB\data\db" --serviceName MongoDB --serviceDisplayName "Mongo
DB" --port 27017 --auth --install
I've then created a DB and added the administration user to that DB's system.users collection.
Then I filled that DB with some random information to a test collection I've created.
Up until now, everything is great and I am able to access the DB only if I have the administrator credentials...
Now the important part...
I removed the service like this:
mongod --remove --serviceName "MongoDB"
Then I recreated the service but with no authentication like this:
mongod --logpath "C:\mongoDB\logs" --logappend --dbpath
"C:\mongoDB\data\db" --serviceName MongoDB --serviceDisplayName "Mongo
DB" --port 27017 --noauth --install
What amazes me is that I am now able to access the DB I've created with now authentication...
Please tell me I should have done something differently.

Authentication happens at the daemon level, not at the database level. The data itself is not encrypted or otherwise access-controlled. If you run the service without requiring credentials, then, as expected, no credentials are required to connect and use it.
This is generally not considered to be problematic, as if you have access to the server and can modify the daemon, you by definition have access to the datafiles anyway.

No auth means you dont have to provide credentials:
noauth
Default: true
Disable authentication. Currently the default. Exists for future compatibility and clarity.
For consistency use the auth option.
source
The configuration mistake you made was that you disabled any authentication measure in your database.

Well...
Since if we edit the database files with a text editor, we can see the stored information, you are right, the information isn't encrypted.
Following this order of ideias in my opinion it is redudant to specifiy the user and password when executing mongodump or mongorestore commands on a secured database. Let's face it, if a baddly intentioned administrator would be interested on exporting the data, he could do it editing the database files itself, with much more work of course :P
I know authentication is at a DB level not the instance itself (through admin database), but im my opinion it is very easy once more for a baddly intencioned user to get the DB information since he doesn't need to specify authentication to remove Windows Service...
Thank you for your opinions!

Related

Growth Book Now Supports ClickHouse - need the installation process for ubuntu server

I have a Growthbook that has already mogo DB integrated and I want to change the database click house because it is fast. please let me know the process of installation of my own domain and also how to create DB and user in click house database?
Github link: https://github.com/growthbook/growthbook
Those are the command not working to create DB and user in click house DB.
CREATE DATABASE wordpress_db;
CREATE USER 'wp_user'#'localhost' IDENTIFIED BY 'password';
GRANT ALL ON wordpress_db.* TO 'wp_user'#'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;
Exit;
I see one place in GrowthBook's GitHub where it says that ClickHouse is supported, and others where it says that the work to integrate with ClickHouse is not complete. This is a very recent issue that says it is not integrated yet:
https://github.com/growthbook/growthbook/issues/371

I can't add first user in mongodb server

Earlier I created first user witch hasn't "userAdminAnyDatabase" role, I delete that user (so now in my database doesn't exist any user) and I got this. What can I do?
Restart your mongod instance with parameter --transitionToAuth
Then you can re-create the user. Restart mongod again.
If it does not work, then try option --noauth.
Option --transitionToAuth disables only the authentication for clients, but Internal/Membership Authentication remains active. Internal/Membership Authentication is pointless when you run a stand-alone MongodDB, it is relevant only for replica sets and sharded clusters.
If you run a stand-alone MongoDB then use option --noauth (and remove option --auth, of course) which disables authentication entirely.

NodeJS REST call with certificate. How could I know which file to use?

I'm trying to open a connexion to an IBM Cognos TM1 server through NodeJS/Axios and to do so I need to pass, during the first REST API Call everything which is needed to authenticate :
an username and password which I have
certificate information as SSL is set to true (I don't want to ignore self signed certificates)
I've found examples on how to pass certificate information with Axios but at this time I didn't succeed in getting it to work :-(
I've put in a dedicated folder, the whole ssl folder a TM1 client software is using:
E:\Development\nodejs\tm1query\assets\ssl\applixca.pem
E:\Development\nodejs\tm1query\assets\ssl\ibmtm1.arm
E:\Development\nodejs\tm1query\assets\ssl\ibmtm1.crl
E:\Development\nodejs\tm1query\assets\ssl\ibmtm1.kdb
E:\Development\nodejs\tm1query\assets\ssl\ibmtm1.rdb
E:\Development\nodejs\tm1query\assets\ssl\ibmtm1.sth
E:\Development\nodejs\tm1query\assets\ssl\importsslcert.exe
E:\Development\nodejs\tm1query\assets\ssl\tm1ca_v2.der
E:\Development\nodejs\tm1query\assets\ssl\tm1ca_v2.pem
E:\Development\nodejs\tm1query\assets\ssl\tm1store
E:\Development\nodejs\tm1query\assets\ssl\uninstallSSL.bat
E:\Development\nodejs\tm1query\assets\ssl\applixca.der
My problem is, which file do I need to use when creating the agent which will hold the connexion ?
Thanks in advance for helping or pointing me to information which can help me to go further in my understanding of how certificates works.
Regards,
Bob

How to use trello webhook callbackURL pointing to localhost in php codeigniter?

I have created a web-based system in codeigniter and some trello integration using its API services. I wanted to achieve something like if there is a new card created in a particular board it will also send a notification in my system that a new card is created. I started reading some documentation in trello webhooks but I just can't figure it out. Am I heading in the right way? Would it be valid if I provide a callbackURL pointing in localhost callbackURL: "localhost/main_controller/trelloCallback" ? However the code below returns a 400 status. Please help me. Thank you.
Javascript
$.post("https://api.trello.com/1/tokens/5db4c9fbb5b2kaf8420771072b203616f3874fa92a4c57f0c796cf90819fa05c/webhooks?key=a2a93deccc7064dek5f4011c2e9810d6", {
description: "My first webhook",
callbackURL: "localhost/dti_infosys/main_controller/trelloCallback",
idModel: "5a73c33ad9a2dk1b473612eb",
});
main_controller/trelloCallback
function trelloCallback() {
$json = file_get_contents('php://input');
$action = json_decode($json,true);
var_dump($action);
}
I know it's an old question, but this use case of having an external tool access our localhost for development is quite common.
So for anyone (OP included) that would like a cloud based service to be able to call a local endpoint, you can use tools like ngrok.
Basically, it sets up a URL accessible via internet that forwards all calls to one of your local ports.
Let's say that your local webserver running your PHP listens on the port 8000 on your machine.
With ngrok installed, you could execute the following command:
$> ngrok http 8000
That would set up the forwarding session:
ngrok by #inconshreveable
Session Status online
Session Expires 6 hours, 21 minutes
Version 2.3.35
Region United States (us)
Web Interface http://127.0.0.1:4040
Forwarding http://b5d44737.ngrok.io -> http://localhost:8000
Forwarding https://b5d44737.ngrok.io -> http://localhost:8000
You can then use any of the Forwarding addresses pointing to ngrok.io to access your local webserver through internet, meaning that if you were to provide an URL using any of these addresses instead of localhost to an external tool, it would be able to indirectly call your local endpoint.
In your case, your javascript call to create a Trello webhook would be:
$.post("https://api.trello.com/1/tokens/<YOUR_ACCESS_TOKEN>/webhooks?key=<YOUR_API_KEY>", {
description: "My first webhook",
callbackURL: "https://b5d44737.ngrok.io/dti_infosys/main_controller/trelloCallback",
idModel: "<YOUR_MODEL_ID>",
});
A bit of warning though: In the case of ngrok, the Forwarding URLs are randomized at each session startup, meaning that the webhooks you created on one session would not work an another session because there callbacksUrl wouldn't be valid anymore.
Note that you can subscribe to a paid plan to "reserve" ngrok subdomains and have URL consistency between sessions. Or you could manually update your webhooks callbackUrls with the new forarding URLs.
Anyway, I hope this will help!
P.S.: When the forwarding session runs, you can access localhost:4040 to inspect calls made on the forwarding URLs and retry some of them.

Could not load the default credentials? (Node.js Google Compute Engine tutorial)

SITUATION:
I follow this tutorial: https://cloud.google.com/nodejs/tutorials/bookshelf-on-compute-engine
Everything works fine until I do npm start and go to:
http://localhost:8080
I am met with the following text on the blank page:
Could not load the default credentials. Browse to https://developers.google.com/accounts/docs/application-default-credentials for more information.
Which makes no sense since I am using OAuth. I followed the link and read the page, but I have no GOOGLE-APPLICATION-CREDENTIALS field anywhere, and nothing about it in the tutorial.
QUESTION:
Could you please reproduce the steps and tell me if you get the same result ?
(takes 5 minutes)
If not, what could I have done wrong ?
Yes, I had the same error. It's annoying cause Google Cloud Platform docs for their "getting started" bookshelf tutorial does not mention this anywhere. Which means that any new developer who tries this tutorial will see this error.
Read this:
https://developers.google.com/identity/protocols/application-default-credentials
I fixed this issue by running:
gcloud auth application-default login
In order to run thisgcloud auth application-default login
Visit: https://cloud.google.com/sdk/install
1) You have to install sdk into your computer
2) That will enable you to run the code
3) Log in to your associated gmail account then you are good to go!
This will make you login, and after that you code locally will use that authentication.
There are 2 solutions for this problem. One option, as mentioned by others, is to use gcloud auth application-default login
Second option is to set the environment variable GOOGLE_APPLICATION_CREDENTIALS. It should point to a file that defines the credentials. To get this file you need to follow these steps:
Go to the API Console Credentials page.
From the project drop-down, select your project.
On the Credentials page, select the Create credentials drop-down, then
select Service account key.
From the Service account drop-down, select an existing service account
or create a new one.
For Key type, select the JSON key option, then select Create. The file
automatically downloads to your computer.
Put the *.json file you just downloaded in a directory of your
choosing.
This directory must be private (you can't let anyone get access to
this), but accessible to your web server code.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the
path of the JSON file downloaded.
See https://developers.google.com/identity/protocols/application-default-credentials for details
Create a service account key using and download the json file. https://console.cloud.google.com/apis/credentials/serviceaccountkey
Add this to your ENV file
GOOGLE_APPLICATION_CREDENTIALS = "<PATH_TO_SERVICE_ACCOUNT_JSON_FILE>"
E.g:
GOOGLE_APPLICATION_CREDENTIALS=/Users/hello/Documents/ssh/my-10ebbbc8b3df.json
I was facing the same issue. It got fixed with following command.
gcloud auth application-default login
It stores default gcloud cloud credentials on your system and uses the same.
I got this error because of initially I did like below:
var admin = require("firebase-admin");
admin.initializeApp(); // I didnt add anything because firebaserc file include appName
It worked when I deployed the functions but not in serve. So this is how I solved it:
Go to the firebase Project settings(click on setting icon from side nav).
Click on the Service accounts.
Copy the admin sdk configuration snippet from selecting your pro. lang.
Ex (node.js):
var admin = require("firebase-admin");
var serviceAccount = require("path/to/serviceAccountKey.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://your-domain.firebaseio.com"
});
Now we need to add serviceAccountKey.json file.
Click on the Manage service account permissions in top right corner.
Now, you will see services accounts for your project, in the table find the row with column name name and value firebase-adminsdk, in that row click on Action dots and select Create key.
From the pop up dialog select Key type as json and press create button.
You will prompt to download the file, download it to your functions directory in project(You can customize this as you want and if you pushing to github, make sure to ignore that file).
Now, if you save it into the same directory where you are initializeApp(), access that file like: ./socialape-15456-68dfdc857c55.json(In my case, both files are located: functions/index.js and functions/services.son in functions directory and in index.js file, I initialed my firebase admin sdk).
Ex(node.js):
const functions = require('firebase-functions');
var admin = require("firebase-admin");
var serviceAccount = require("./myapp-15456-68dfdc857c55.json");
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL: "https://myapp-15456.firebaseio.com"
});
It's a best and good idea to create .env file and include your file there and access it as others mentioned. I leave that part to you.
Hope this help someone on the planet. Regards!
If you're running the app locally, then the gcloud beta auth application-default login command should suffice for acquiring local credentials (I updated the tutorial to say so).
When running the app on Google Compute Engine, if the Compute Engine instance was created with the proper scopes (cloud-platform should be sufficient) then the app will authenticate with Google Cloud Platform APIs automatically without any extra work on your part.
Go here: https://firebase.google.com/docs/admin/setup#initialize_the_sdk and follow the instructions to create a private key.
Then after you have downloaded your private key open command prompt in the project directory and do the following command:
set GOOGLE_APPLICATION_CREDENTIALS=C:\YOUR-PATH\YOUR-KEY.json
use this to solve your issue. this actually works:-
just put credential parameter and give reference to your key to it.
const serviceAccount = require('../key.json');
admin.initializeApp({
credential: admin.credential.cert(serviceAccount)
});
Another solution i found: in your package.json add an export command like this:
"scripts": {
"start": "export GOOGLE_APPLICATION_CREDENTIALS='./gcloud.json' && node ./bin/www --exec babel-node --presets babel-preset-env",
},
You have to create an object of your SessionsClient.
Here I will provide some steps, so you can run your code like a charm.
You have to go into your Dialogflow dashboard.
Click on setting ( Left navbar top-right gear icon)
in the General tab click Service Account link ( it will redirect you to another screen)
If you have a service account then ignore step 5
Create a service account ( Top-center +icon button)
Now you have a service account on a list click on
From the action, field presses the 3 vertical dots and create a key.
Download the JSON file on your local computer.
Assign object to your sessionClient.
const sessionClient = new dialogflow.SessionsClient({
keyFilename: "/var/www/html/moqatrips/dialog-flow.json"
});
For all people using firebase, what it worked for me was passing the credentials to the KeyManagementServiceClient constructor
const serviceAccount = require('../keys/file.json'); //<- your firebase credentials
const client = new KeyManagementServiceClient({
credentials: serviceAccount,
});
I also had this error problem, here I had not created the object of
keyFilename (stores the credentials of the api)
in the sessionClient object for nodejs app.
const sessionClient = new dialogflow.SessionsClient({
keyFilename: "./keyCredentials.json"
});
const sessionPath = sessionClient.sessionPath(projectId, sessionId);
To download 'keyCredentials.json' goto:
https://console.cloud.google.com/apis/credentials/serviceaccountkey
Also add the path of this file to the system variables
In windows open powershell
type GOOGLE_APPLICATION_CREDENTIALS = [PATH_TO_SERVICE_ACCOUNT_JSON_FILE]
you may find youself in another part of the world -- and land here. I'm adding to a three year old question because its keywords matched my issue and the preceding answers helped me although none describe my issue
firebase deploy --only functions --debug
produced
[2020-12-02T08:31:50.397Z] FirebaseError: HTTP Error: 429, Unknown Error
Error: Could not read source directory. Remove links and shortcuts and try again.
I could not find anything wrong with the source directory. But that was all so many tiny fish.
Examining the error in detail, from the top, lead to:
Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot.
The block will expire shortly after those requests stop.
Out of curiosity and exhaustion, I waited first. The wait reset duration is > than 30 minutes. So i pursued the captcha to prove my enduring humanity which did register eventually after some oauth warnings.
Although this question has been answered multiple times, I found myself in a situation not explained here.
After I created the variable: $GOOGLE_APPLICATION_CREDENTIALS, I was getting the same error as Coder1000.
However, I was running both: nodemon and: npm run dev in two separate sessions in Terminal, neither of which were aware of the variable.
Once I: shut the tabs down; added new tabs; and ran the commands again, the application was able to access the variable.
download Cloud SDK installer from this site. https://cloud.google.com/sdk/docs/install
run this command -> gcloud auth application-default login
If anyone ran into the issue just like me and doesn't want to set the variable each time before running their code it's best to manually set the environment variable. Name it GOOGLE_APPLICATION_CREDENTIALS and browse the downloaded JSON file. If you don't know the steps follow this: https://docs.oracle.com/en/database/oracle/machine-learning/oml4r/1.5.1/oread/creating-and-modifying-environment-variables-on-windows.html#GUID-DD6F9982-60D5-48F6-8270-A27EC53807D0

Categories