Uploaded image for project: 'Compass '
  1. Compass
  2. COMPASS-5142

Enable connecting to replica sets and TLS with SSH tunnels

XMLWordPrintableJSON

    • Type: Icon: Story Story
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 1.31.0
    • Affects Version/s: None
    • Component/s: None
    • None
    • 8
    • Iteration Seoul, Iteration Tokyo
    • Needed
    • Hide

      The new connection form (which I think is handled in a special way on the docs side, not sure myself) now supports specifying a Socks5 proxy hostname, as well as optionally a Socks5 proxy port and/or username and password. This is mutually exclusive with the usage of SSH tunneling.

      If this feature is documented (I don't think SSH tunneling support currently is), a few security aspects might be relevant to mention in the documentation:

      • Socks5 transmits passwords in plaintext. Consequently, usage of a remote proxy host with Socks5 passwords is generally insecure.
      • Socks5 is a proxy protocol, and as such, it is highly recommended to only use it when TLS is fully enabled and no insecure TLS options are being passed.
      Show
      The new connection form (which I think is handled in a special way on the docs side, not sure myself) now supports specifying a Socks5 proxy hostname, as well as optionally a Socks5 proxy port and/or username and password. This is mutually exclusive with the usage of SSH tunneling. If this feature is documented (I don't think SSH tunneling support currently is), a few security aspects might be relevant to mention in the documentation: Socks5 transmits passwords in plaintext. Consequently, usage of a remote proxy host with Socks5 passwords is generally insecure. Socks5 is a proxy protocol, and as such, it is highly recommended to only use it when TLS is fully enabled and no insecure TLS options are being passed.

      We are going to add support for connecting to replica sets using SSH tunnels. As part of that, we ensure that connecting using SSH + TLS also works.

      This should be based on the driver work in DRIVERS-1357 / NODE-3633.

        1.
        		 Move ssh-tunnel package into Compass monorepo COMPASS-5157 Sub-task Closed Anna Henningsen 1.30.1
        2.
        		 Make SSH tunnel use Socks5 COMPASS-5156 Sub-task Closed Anna Henningsen 1.30.1
        3.
        		 Add Socks5 options to connection form UI COMPASS-5155 Sub-task Closed Basit Chonka 1.31.0
        4.
        		 Add connectivity tests for SSH tunnel + Replica Set/TLS COMPASS-5158 Sub-task Closed Anna Henningsen 1.30.1
        5.
        		 Add connection form UI validation COMPASS-5375 Sub-task Closed Basit Chonka 1.31.0
        6.
        		 Add telemetry support for Socks5 COMPASS-5449 Sub-task Closed Anna Henningsen 1.31.0

            Assignee:
            anna.henningsen@mongodb.com Anna Henningsen
            Reporter:
            anna.henningsen@mongodb.com Anna Henningsen
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: