mongoaudit: Security through obscurity and how to limit connections from a specific subnet?
I don't wish to hide my version number. In my opinion this is Security through obscurity


Hiding version details is not security through obscurity unless that is the main security measure you rely on. Exposed version details can allow an attacker to easily identify known security issues rather than having to probe for them. Forcing an attacker to test for known exploits may be useful for an Intrusion Detection System to detect and handle obvious malicious attempt signatures.

I would consider this a low risk if you are following other best practices (eg. limiting network exposure, actively applying security updates, monitoring for intrusion attempts). Putting a reverse proxy in front of your MongoDB deployment may also add unwelcome operational complexity for server discovery and failover.


  Howto whitelist networks? I wish to do that, but only know about net.bindIp. This only say on which virtual NIC mongod listens. Are there options to restrict a subnet?


As you've noted, MongoDB's bindIP configuration only determines which NIC IP addresses the server listens to (not the client IPs that are allowed to connect). To limit network exposure you need configure solutions at the operating system and/or network infrastructure level (eg. firewalls or VPNs).

The current version of mongoaudit includes a link to some suggested resources depending on where your MongoDB deployment is hosted: How to Configure Allowed Hosts, Firewall, Whitelisting and Blacklisting in MongoDB.

For more information, also see Hardening Network Infrastructure and the Security Checklist in the MongoDB documentation.