Apache Cassandra
TMA-CASSANDRA-2.1
Ensure that authentication is enabled for Cassandra databases
Description
Authentication is pluggable in Cassandra and is configured using the authenticator setting in cassandra.yaml. Cassandra ships with two options included in the default distribution, AllowAllAuthenticator and PasswordAuthenticator. The default, AllowAllAuthenticator, performs no authentication checks and therefore requires no credentials. It is used to disable authentication completely. Checks /etc/cassandra/cassandra.yaml (package install; SKIP when it does not exist).
How it is checked
Audit method: File pattern
- File
/etc/cassandra/cassandra.yaml- Pattern
(?m)^authenticator:[ \t]*(?:\n(?:[ \t]*(?:#[^\n]*)?\n|[ \t]+[^\n]*\n)*?[ \t]+class_name[ \t]*:[ \t]*)?['\x22]?(?:[\w.]*\.)?(?:PasswordAuthenticator|MutualTlsAuthenticator|MutualTlsWithPasswordFallbackAuthenticator)\b
How it is fixed
Fix method: Guidance or infrastructure patch
Set 'authenticator: PasswordAuthenticator' in cassandra.yaml, raise system_auth replication (NetworkTopologyStrategy, RF 3 per DC), rolling-restart the nodes and create a new superuser.
Properties
- Operating systems
- Any
- Tags
- cassandraauthentication
- Reference
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 2.1 Ensure that authentication is enabled for Cassandra databases
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target cassandra