Ensure the Cassandra service is run as a non-root user

How it is checked

Audit method: Shell command

out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 == "root" {n++} END {print n+0}'

Expected output

0

How it is fixed

Fix method: Guidance or infrastructure patch

Create a dedicated cassandra system user, chown the data, commitlog, saved_caches and log directories to it and start the service with User=cassandra.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target cassandra