Ensure that the default password is changed for the cassandra role

CríticaNivel 1Automatizadacassandra

Descripción

The cassandra role has a default password which must be changed. Attempts a cqlsh login as cassandra/cassandra against CQLSH_HOST/CQLSH_PORT (default 127.0.0.1:9042); passes only when the server rejects the credentials (a login that succeeds, including with authentication disabled, fails; an unreachable node fails).

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v cqlsh >/dev/null 2>&1 || exit 1; out=$(cqlsh -u cassandra -p cassandra -e 'SELECT release_version FROM system.local;' 2>&1); rc=$?; if [ $rc -eq 0 ]; then echo default_password_accepted; elif printf '%s' "$out" | grep -qiE 'AuthenticationFailed|Bad credentials|incorrect'; then echo compliant; else exit 1; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Log in as a superuser and run ALTER ROLE cassandra WITH PASSWORD = '<new strong password>'; (or disable the role after creating a replacement superuser, see 3.1).

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cassandraauthentication
Referencia: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.2 Ensure that the default password is changed for the cassandra role

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cassandra