Ensure that authorization is enabled for Cassandra databases

KritisLevel 1Otomatiscassandra

Deskripsi

Authorization is pluggable in Cassandra and is configured using the authorizer setting in cassandra.yaml. Cassandra ships with two options included in the default distribution, AllowAllAuthenticator and CassandraAuthorizer. The default, AllowAllAuthenticator performs no checking which grants all permissions to all roles. Checks /etc/cassandra/cassandra.yaml (package install; SKIP when it does not exist).

Cara pemeriksaan

Metode audit: Pola file

File: /etc/cassandra/cassandra.yaml
Pola: (?m)^authorizer:[ \t]*(?:\n(?:[ \t]*(?:#[^\n]*)?\n|[ \t]+[^\n]*\n)*?[ \t]+class_name[ \t]*:[ \t]*)?['\x22]?(?:[\w.]*\.)?(?:CassandraAuthorizer)\b

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set 'authorizer: CassandraAuthorizer' in cassandra.yaml, rolling-restart the nodes, then grant least-privilege permissions to roles.

Properti

Sistem operasi: Apa saja
Tag: cassandraauthorization
Referensi: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 2.2 Ensure that authorization is enabled for Cassandra databases

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cassandra