Mongo Security Authentication Not Working - mongodb

Question

I am trying to get MongoDB authentication working on my AWS Linux server. I have run authentication using MongoDB running on windows with no issues,
>mongod --auth
On my AWS server I am trying to run MongoDB using the service command,
$ sudo service mongod start
However, mogod does not start. I believe the problem is with my /etc/mongod.conf file. Here is the /etc/mongod.conf with authentication enabled,
# mongod.conf
# for documentation of all options, see:
# http://docs.mongodb.org/manual/reference/configuration-options/
# where to write logging data.
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
# Where and how to store data.
storage:
dbPath: /var/lib/mongo
journal:
enabled: true
# engine:
# mmapv1:
# wiredTiger:
# how the process runs
processManagement:
fork: true # fork and run in background
pidFilePath: /var/run/mongodb/mongod.pid # location of pidfile
# network interfaces
net:
port: 27017
# bindIp: 127.0.0.1 # Listen to local interface only, comment to listen on all interfaces.
security:
authorization: enabled
#operationProfiling:
#replication:
#sharding:
## Enterprise-Only Options
#auditLog:
#snmp:
The problem is with the security tag.
security:
authorization: enabled
If I include it, MongoDB will not start. If I take it out, MongoDB starts fine but has no security. What I am doing wrong?

Answer 1

Ok, my bad...The file is of type YAML. I originally entered,
security:
authorization: enabled
Because it's YAML, I needed a couple of spaces. The correct entry is,
security:
authorization: enabled
Works fine now.
By the way, If you are using MongoDB and have a public IP/port exposed I would highly recommend that you enable security. I got an email last week from AWS saying that if you are using MongoDB that has a port that is publicly available you should implement security. I am still in development so I ignored the AWS recommendation. Well, 3 days later, someone accessed my databases, copied them, deleted them, and left me a ransomware note in a new database. They wanted one bitcoin for the return of my existing databases. I did not pay the ransom. Fortunately, this was not a problem for me. All of the data was limited test data. To avoid potential malware bombs, I deleted the AWS instance, created a new instance and installed a fresh MongoDB release with authorization enabled.
This episode could have been a disaster with real customer data. If you are using MongoDB with public access make sure you enable authorization.