V-281700
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
Title
MongoDB must terminate a user session after organization-defined conditions or trigger events requiring session disconnect via a scheduled script.
Description
<VulnDiscussion>This addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Ses...
Fix Text (Documentation Requirement)
Determine the situations when a user-initiated database session must be terminated. Note: The user running the commands shown below must have privileges with listSessions, killAnySession and impersonate action on the cluster. In the MongoDB shell, as an authenticated user, run the following command to list all user sessions: > use config > db.system.sessions.aggregate( [ { $listSessions: { allUsers: true } } Reference: https://docs.mongodb.com/v8.0/reference/operator/aggregation/listSessions/ Example output: { "_id" : { "id" : UUID("b3b50641-54c6-4d6d-a96e-a2239fadce3c"), "uid" : BinData(0,"Y5mrDaxi8gv8RmdTsQ+1j7fmkr7JUsabhNmXAheU0fg=") }, "lastUse" : ISODate("2021-09-23T23:34:43.951Z"), "user" : { "name" : "jsmith@admin" } } From the output, identify the names of users whose sessio...