Richard Pajerski  Software development and consulting

Setting up a new, fully functional stand-alone Sametime 12.0.1 Premium server on Docker instance is a relatively pleasant experience and HCL has made great strides is presenting a more simplified, compelling UX for the product than what was previously offered.  For example, the new interface for creating and customizing meetings gets all the important, relevant bits into a single page (a good introduction to the product can be found here).

But the thrust of this post is on securing the server itself, and more specifically the MongoDB portion where chat histories, contact lists and other details are stored.  HCL supports MongoDB versions 4.2 and higher on a best effort basis and I'm using version 6.0.4 on CentOS 8 for purposes of this post.  Here's what worked for me.

After installing, we configure our Sametime database using the MongoDB Shell; upon first connecting, there's no prompt for a password and we're plainly told:

"Access control is not enabled for the database. Read and write access to data and configuration is unrestricted"

Well, that's not good.  It was now possible to connect using mongosh and fully control the server *from anywhere, without a password*... 

According to the installation guide, port 27017 should be "permitted bidirectionally".  That's understandable since a common strategy is to deploy the MongoDB server on its own host.  But even with this installation which has both the MongoDB server and Sametime on the same machine, closing off external access to 27017 caused internal connectivity problems for Sametime (I could no longer create meetings and chat histories were no longer available).

So next I turned to this document on securing MongoDB.  That method might work for other versions of MongoDB but it didn't work with 6.0.4 (the MongoDB server refused to start).  What I found is that "keyFile" authorization is needed for this version of MongoDB when replica sets are used (which is the default for Sametime).

Create the keyfile:

openssl rand -base64 812 > /opt/st12/mongosec.key

Be sure to also run these two commands on the keyfile or Mongo won't start:

chmod 400 /opt/st12/mongosec.key
chown mongod:mongod /opt/st12/mongosec.key

Edit /etc/mongod.conf to tell MongoDB where the file is and enable authorization:

security:
  keyFile: /opt/st12/mongosec.key
  authorization: enabled

We also need to launch the MongoDB server with "--auth".  I've installed MongoDB as a service so that means editing /etc/systemd/system/multi-user.target.wants/mongod.service:

[Service]
Environment="OPTIONS=-f /etc/mongod.conf --auth"

After restarting the MongoDB service (systemctl restart mongod), I can still connect with mongosh but the warnings are gone; if I attempt to run commands, I'm told authentication is required:

To connect with a username:

mongosh mongodb://127.0.0.1:27017 -u sametimeUser

Finally, don't forget to change the default user/pass combination (sametimeUser/sametime) before going live!