content_image/757981.jpg
<img src='content_image/757981.jpg'>

## 6.4.3 Security Release Notes Alerts 

Security Release Notes (page 431) Security vulnerability for password. 

## Security Release Notes 

## Access to system.users Collection 

Changed in version 2.4. 

In 2.4, only users with the userAdmin role have access to the system.users collection. 

In version 2.2 and earlier, the read-write users of a database all have access to the system.users collection, which contains the user names and user password hashes. 87 

## Password Hashing Insecurity 

If a user has the same password for multiple databases, the hash will be the same. A malicious user could exploit this to gain access on a second database using a different user’s credentials. 

As a result, always use unique username and password combinations for each database. 

Thanks to Will Urbanski, from Dell SecureWorks, for identifying this issue. 

## 6.5 Security Checklist 

This documents provides a list of security measures that you should implement to protect your MongoDB installation. 

## 6.5.1 Require Authentication 

Enable MongoDB authentication and specify the authentication mechanism. You can use the MongoDB authentica- tion mechanism or an existing external framework. Authentication requires that all clients and servers provide valid credentials before they can connect to the system. In clustered deployments, enable authentication for each MongoDB server. 

See Authentication (page 320), Enable Client Access Control (page 357), and Enable Authentication in a Sharded Cluster (page 358). 

