Hardening checklist
The security settings worth checking before opening the cluster.
Go through these security settings before opening the cluster to your applications, in addition to the production checklist.
Requirements
- A deployed cluster and access to the configuration of each node.
Access
- No node starts with
--insecure. - One user per application, with only its roles. The
rootpassword is kept off the server. - API keys carry only the roles they need and expire.
Network
- Only your operations team sees administration port 27200.
- With client certificates,
--tlsCRLFilerefuses the revoked ones.
Data
- Encryption at rest on if your disks do not already encrypt.
- Sensitive fields with Queryable Encryption.
Record
- Auditing writes to a destination off the node's machine.
- The MCP server stays read-only unless an agent needs to write.
Check
Each point of the list can be checked in the start configuration of the nodes or with usersInfo and apikey list.
Common problems
- An old application still logs in as
root. Create its user and change therootpassword.