Anonymous connections are allowed even when auth is enabled

It is a big security risk to allow anonymous authentication against a mongo server. This allows an unauthorized user to gain attack vector information about the database.

All of the below commands can be run using an anonymous authentication:

db.serverBuildInfo()

db.version()

db.adminCommand({ping:1})

db.adminCommand({whatsmyuri:1})

db.adminCommand({features:1})