Q:

mongodb allows guest connection even when auth is enabled

MongoDB Version: 2.4.5
Enabled the auth=true in mongodb config. I can still connect to the mongodb instance from a remote host. It does enforce the authentication as I am not able to execute most queries as I get 'unauthorized' access but I can still run queries to get information about the server e.g. version etc. I was expecting the server to deny connection without credentials when the auth is enabled.

A:

Yes basicly you can connect without authentication but cannot do nearly anything. you can run db.serverBuildInfo()
db.version() 
db.adminCommand({ping:1}) 
db.adminCommand({whatsmyuri:1})
db.adminCommand({features:1})
for example, maybe some other commands. 
Which is seems a bit pain for me is that able to run:
for(var i=0;i++<20000;){db.adminCommand({forceerror:1})}

Which generates a bit of log.
I checked out the sources, and you can see this behaviour is kind of bug. The sources of the shell startup are in : https://github.com/mongodb/mongo/blob/master/src/mongo/shell/dbshell.cpp
Basicly there are two type of test running against the parameter values given in password and username arguments for mongoshell. The startup checks when you provided a --password parameter and have not wrote a password after. And there is a check when you have not specified to start without db, and you have specified a username which is longer than 0 than it will try to authenticate (check line 1043) 
if (!nodb && username.size()) . 
But that is all. If you not specify credentials at all, it seems will connect without even try to authenticate. I guess in the initialization phase it should be checked weather the process where we connect is running with authentication and force out authenicaion if it needed. 

