Ensure that Cassandra is run using a non-privileged, dedicated service account

高レベル 1自動cassandra

説明

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.

チェック方法

監査方法: シェルコマンド

shell

out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'

期待される出力: 0

修正方法

修正方法: ガイダンスまたは IaC パッチ

Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.

プロパティ

オペレーティングシステム: すべて
タグ: cassandraservice-account
参照: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target cassandra