TMA-CASSANDRA-3.4
Ensure that Cassandra is run using a non-privileged, dedicated service account
HochStufe 1Automatisiertcassandra
Beschreibung
As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'- Erwartete Ausgabe
0
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- cassandraservice-account
- Referenz
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target cassandra