TMA-CASSANDRA-3.2
Ensure that the default password is changed for the cassandra role
KritischStufe 1Automatisiertcassandra
Beschreibung
The cassandra role has a default password which must be changed. Attempts a cqlsh login as cassandra/cassandra against CQLSH_HOST/CQLSH_PORT (default 127.0.0.1:9042); passes only when the server rejects the credentials (a login that succeeds, including with authentication disabled, fails; an unreachable node fails).
So wird geprüft
Prüfmethode: Shell-Befehl
shell
command -v cqlsh >/dev/null 2>&1 || exit 1; out=$(cqlsh -u cassandra -p cassandra -e 'SELECT release_version FROM system.local;' 2>&1); rc=$?; if [ $rc -eq 0 ]; then echo default_password_accepted; elif printf '%s' "$out" | grep -qiE 'AuthenticationFailed|Bad credentials|incorrect'; then echo compliant; else exit 1; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Log in as a superuser and run ALTER ROLE cassandra WITH PASSWORD = '<new strong password>'; (or disable the role after creating a replacement superuser, see 3.1).
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- cassandraauthentication
- Referenz
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.2 Ensure that the default password is changed for the cassandra role
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target cassandra