Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-59604

Audit log authcheck record has incorrect command for unauthenticated user

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 5.2.0
    • Affects Version/s: 4.2.15, 4.4.8, 5.0.2
    • Component/s: None
    • None
    • Fully Compatible
    • ALL
    • Hide

      This issue reproduces on MongoDB Enterprise 4.2.15, 4.4.8, and 5.0.2.

      To reproduce, start a standalone mongod with audit enabled, connect with the legacy mongo shell without authenticating, and attempt to run (for example) db.foo.findOne(). Then check the audit log, you should see an entry similar to the above. The command field should contain "find", not "Error".

      Show
      This issue reproduces on MongoDB Enterprise 4.2.15, 4.4.8, and 5.0.2. To reproduce, start a standalone mongod with audit enabled, connect with the legacy mongo shell without authenticating, and attempt to run (for example) db.foo.findOne(). Then check the audit log, you should see an entry similar to the above. The command field should contain "find", not "Error".
    • Security 2021-11-01

      When an unauthenticated user attempts a command that requires authentication, an authcheck record may be generated in the audit log. The record looks like this:

      { "atype" : "authCheck", "ts" : { "$date" : "2021-08-26T07:47:14.112-05:00" }, "uuid" : { "$binary" : "puZTT2N5RYWlDirvcy9Blw==", "$type" : "04" }, "local" : { "ip" : "127.0.2.1", "port" : 27017 }, "remote" : { "ip" : "127.0.0.1", "port" : 39250 }, "users" : [], "roles" : [], "param" : { "command" : "Error", "ns" : "admin" }, "result" : 13 }

      Note the param.command field is "Error" rather than the actual command.

            Assignee:
            erwin.pe@mongodb.com Erwin Pe
            Reporter:
            spencer.brown@mongodb.com Spencer Brown
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: