TMA-CASSANDRA-3.4
Ensure that Cassandra is run using a non-privileged, dedicated service account
HighLevel 1Automatedcassandra
Description
As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.
How it is checked
Audit method: Shell command
shell
out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.
Properties
- Operating systems
- Any
- Tags
- cassandraservice-account
- Reference
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cassandra