TMA-YUGABYTEDB-5.2
Ensure that the default password changed for the cassandra role
KritischStufe 2Automatisiertyugabytedb
Beschreibung
The cassandra role has a default password which must be changed. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Attempts a ycqlsh login as cassandra/cassandra against ${YCQL_HOST:-127.0.0.1}:${YCQL_PORT:-9042} (ycqlsh on PATH); passes only when the server rejects the credentials. A successful login (including with YCQL authentication disabled) fails, an unreachable server fails.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
command -v ycqlsh >/dev/null 2>&1 || exit 1; out=$(ycqlsh -u cassandra -p cassandra -e 'SELECT release_version FROM system.local;' "${YCQL_HOST:-127.0.0.1}" "${YCQL_PORT:-9042}" 2>&1); rc=$?; if [ $rc -eq 0 ]; then echo default_password_accepted; elif printf '%s' "$out" | grep -qiE 'AuthenticationFailed|Bad credentials|incorrect|Unauthorized'; then echo compliant; else exit 1; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Log in to ycqlsh as a superuser and run ALTER ROLE cassandra WITH PASSWORD = '<new strong password>';
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- yugabytedbauthentication
- Referenz
- CIS YugabyteDB Benchmark v2.0.0 - 5.2 Ensure that the default password changed for the cassandra role
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target yugabytedb --level 2