YugabyteDB
TMA-YUGABYTEDB-5.2
Ensure that the default password changed for the cassandra role
CríticaNivel 2Automatizadayugabytedb
Descripción
The cassandra role has a default password which must be changed. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Attempts a ycqlsh login as cassandra/cassandra against ${YCQL_HOST:-127.0.0.1}:${YCQL_PORT:-9042} (ycqlsh on PATH); passes only when the server rejects the credentials. A successful login (including with YCQL authentication disabled) fails, an unreachable server fails.
Cómo se verifica
Método de auditoría: Comando de shell
shell
command -v ycqlsh >/dev/null 2>&1 || exit 1; out=$(ycqlsh -u cassandra -p cassandra -e 'SELECT release_version FROM system.local;' "${YCQL_HOST:-127.0.0.1}" "${YCQL_PORT:-9042}" 2>&1); rc=$?; if [ $rc -eq 0 ]; then echo default_password_accepted; elif printf '%s' "$out" | grep -qiE 'AuthenticationFailed|Bad credentials|incorrect|Unauthorized'; then echo compliant; else exit 1; fi- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Log in to ycqlsh as a superuser and run ALTER ROLE cassandra WITH PASSWORD = '<new strong password>';
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- yugabytedbauthentication
- Referencia
- CIS YugabyteDB Benchmark v2.0.0 - 5.2 Ensure that the default password changed for the cassandra role
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target yugabytedb --level 2