I had some very unimportant, largely abandoned mongo-based sites running on machine that's typically fairly well locked down, but after migrating them to this machine, the default mongo port was left open.
Unfortunately, I had never enabled query logging, so I'm trying to find any other possible avenues of finding out if this was the case.
I've looked through ~/.dbshell
though I double that will capture commands/queries run by remote clients, since it's tied to the system user. There's no evidence there.
I don't see any indication that mongo keeps an access log, so is there any other possible way for me to tell:
- Whether anyone connected from outside localhost
- Which commands they may have run
I doubt there's any hope at this point.