Ensure that Cassandra is run using a non-privileged, dedicated service account

ÉlevéeNiveau 1Automatiséecassandra

Description

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'

Sortie attendue: 0

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: cassandraservice-account
Référence: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target cassandra