Ensure that Cassandra is run using a non-privileged, dedicated service account

TinggiLevel 1Otomatiscassandra

Deskripsi

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'

Output yang diharapkan: 0

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.

Properti

Sistem operasi: Apa saja
Tag: cassandraservice-account
Referensi: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cassandra