mongodb - How to prevent to anonymous access to Mongo DB?

Question

I still don`t can prevent to anonymous access to Mongo DB after do below steps.

1- Create admin user with this command

mongod --port 27017 --logpath D:\Files\Sessions\log\mongo.log --dbpath D:\Files\Sessions\data\db 

2- Create mongod.conf file with this config

systemLog:
   destination: file
   path: "D:/Files/Sessions/log/mongo.log"
storage:
   dbPath: "D:/Files/Sessions/data/db"
net:
   bindIp: 127.0.0.1, localhost
   port: 27017

3- Execute mongod --config "D:\Files\Sessions\mongod.conf"

4- Create admin user with

use admin
db.createUser(
  {
    user: "myUserAdmin",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
  }
)

5- Update mongod.conf with add this config to that

security:
   authorization: enabled

6- Execute mongod --config "D:\Files\Sessions\mongod.conf"

I also in between steps, many times execute this command

mongod --port 27017 --logpath D:\Files\Sessions\log\mongo.log --dbpath D:\Files\Sessions\data\db --auth

In final, I can create new admin user and authenticate with that but still i can also authenticate as anonymous user without credential!

Just in case => mongo version: 4.2, windows 10

What`s wrong?

标签： mongodbsecurityauthenticationnosql