ArangoDB v4.x is under development and not released yet.

This documentation is not final and potentially incomplete.

Server security options

You can harden an ArangoDB server by restricting APIs and disable unused features

arangod provides a variety of options to make a setup more secure. Administrators can use these options to limit access to certain ArangoDB server functionality as well as preventing the leakage of information about the environment that a server is running in.

Server hardening

If the --server.harden startup option is set to true and authentication is enabled, non-admin users are denied access to the following HTTP APIs:

/_admin/cluster/numberOfServers
/_admin/license
/_admin/metrics
/_admin/status
/_admin/system-report
/_admin/usage-metrics
/_api/engine/stats

Additionally, no version details are revealed by the version HTTP API at /_api/version.

The default value for this option is false.

API availability and access

Certain administrative endpoints can be restricted with startup options. Some only let you control the availability of API endpoints while others let you specify the access permissions and required level of authentication, or both. Disabling APIs you don’t use and increasing the access restriction help to reduce the attack surface.

--server.support-info-api
--server.options-api:
- disabled: Disable the API.
- jwt: The API can only be accessed via superuser JWTs.
- admin (default): The API can only be accessed by admin users and superuser JWTs.
- public: Everyone with access to the _system database can access the API.
--backup.api-enabled
--log.api-enabled
--log.recording-api-enabled:
- false: Disable the API.
- jwt: Enable the API but restrict it to superuser JWTs.
- true (default): Enable the API.
--cluster.api-jwt-policy:
- jwt-all: Superuser JWT required to access all operations
- jwt-write: Superuser JWT required for POST/PUT/DELETE operations
- jwt-compat (default): ArangoDB v3.7 compatibility mode
--activities.only-superuser-enabled:
- true: The API can only be accessed via superuser JWTs.
- false: The API can only be accessed by admin users and superuser JWTs.
--server.export-metrics-api:
- false: Disable the API.
- true: Enable the API.