Potental false positive for DBS-1820

Describe the bug DBS-1820 is a test where MongoDB is tested against access with no authentication. All of my mongodb instances are run in Docker and all of them require authentication.

Version

Ubuntu 24.04 LTS amd64
Lynis 3.1.2

Expected behavior No warning should show up.

Output lynis.log

2024-06-12 10:21:47 Performing test ID DBS-1818 (Check status of MongoDB server)
2024-06-12 10:21:47 Performing pgrep scan without uid
2024-06-12 10:21:48 IsRunning: process 'mongod' found (4524 5019 5188 5202 5203 5221 5229 5703 7058 8186 10187 12379 14933 )
2024-06-12 10:21:48 ====
2024-06-12 10:21:48 Performing test ID DBS-1820 (Check for authorization in MongoDB)
2024-06-12 10:21:48 Result: configuration file /etc/mongod.conf not found
2024-06-12 10:21:48 Result: configuration file /etc/mongodb.conf not found
2024-06-12 10:21:48 Result: no authorization enabled via parameter or configuration file
2024-06-12 10:21:48 Warning: MongoDB instance allows any user to access databases [test:DBS-1820] [details:-] [solution:-]

Additional context Use the following setup in Docker to reproduce the problem: docker-compose.yml:

services:
  mongodb:
    image: rapidfort/mongodb:4.4
    restart: always
    volumes:
      - database-data:/bitnami/mongodb
    env_file:
      - ./.env
volumes:
  database-data:

.env

MONGODB_ROOT_USER=admin
MONGODB_ROOT_PASSWORD=testpw
MONGODB_PORT=27017
MONGODB_DB=test
MONGODB_USERNAME=test
MONGODB_PASSWORD=testuserpw

The volume must have 1001:1001 permissions set in the volume, otherwise it won't start. I do it in a way where I add command: sleep infinity to a service and then after upping services I do docker exec -i -u 0 containername chown -R 1001:1001 /bitnami/mongodb

CISOfy / lynis

Potental false positive for DBS-1820 #1512