Questions[mongoose](server)

I have an ssh config file like this. I have a proxy jump to host1 from test2.

Host host1
  Hostname xxxxxx.us-east-1.elb.amazonaws.com
  Port 2222
  User xxxx
  IdentityFile ~/.ssh/cert
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  KeepAlive yes
  ServerAliveInterval 30
  ServerAliveCountMax 30

Host test2
  Hostname xx.xxx.xx.xxx
  ProxyCommand  ssh.exe host1  -q -W %h:%p host1
  User ubuntu
  IdentityFile ~/.ssh/cert
  KeepAlive yes
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  ServerAliveInterval 30
  ServerAliveCountMax 30

I have to Use SSH Tunneling to Mongodb using Host test2, But it uses Proxy Jump using ProxyCommand

I want to connect to mongodb using SSH Tunneling with a Mongo DB Compass and also with node js mongoose.

How Can I connect using the Mongo DB Compass?

Here I don't have an option to enter ProxyCommand details.

How Can I connect using node js?

I am using tunnel-ssh, I have a reference code ,

var config = {
    username:'ubuntu',
    host:'xx.xxx.xx.xxx',
    agent : process.env.SSH_AUTH_SOCK,
    privateKey:require('fs').readFileSync('~/.ssh/cert'),
    port:22,
    dstPort:27017,
    password:'mypassword'
};

var server = tunnel(config, function (error, server) {
  
});

Here as well how can I enter ProxyCommand details here?

I am in the process of building a basic no-code solution to build RESTful APIS that support CRUD operations on a MongoDB collection. Right now it is just a Proof of Concept project that I use internally with no external users.

I saw this question on Stack Overflow the other day and I though that it could allow me to convert this little project into a SaaS concept.

Allowing users to create their own collections in MongoDB could be potentially insecure, but I couldn't think of any catastrophic consequence... Maybe the fact that malicious users can purposely create a collection that is horrible in performance? Or maybe the user could inject some references to other collections...?

Does having a separated Mongo database help to mitigate those attacks? Or could you give me more reasons why this is a bad idea?

Thank you very much!

I want to upgrade mongodb version(3.2 to 3.6) on prd environment W/O downtime. We have one primary node, one secondary node and one arbitrary. We are using ubuntu 16.04. So please guide me how can I achieve success on this. (3.2 -> 3.4 -> 3.6)

To use SSL, the web server that I am using requires the location of a single .pem file (-ssl_cert xyz.pem)

I have a certificate issued by GoDaddy. They gave me the file:

banana.crt

The preceding certificate request was created using a private key I generated

banana.key

Googling seems to suggest that creating a .pem file is as simple as concatenating them.

cat banana.key banana.crt > banana.pem

Unfortunately, starting the server with banana.pem, and visiting it with Safari tells me:

Issued by: Go Daddy Secure Certificate Authority

This certificate was signed by an unknown authority

What's going wrong? Have I or GoDaddy screwed something up in the creation of the certificate, or do I somehow have to mix something from here in to my .pem file?

I'm visiting with a fully up to date OS X Leopard + Safari installation.

I'd like to run a web server to experiment with. I'm going to to use Mongoose because it looks lightweight and simple enough to understand everything that it is doing.

I have a Debian box to run it on.

My questions are

• Is it advisable to run a web server as root? If not, why not? (How can a non-privileged accounts listen on ports 80,443?)

• Is there a standard directory to put the "site root" to be served? Does it matter where this is as far as security considerations go?