TMA-CASSANDRA-3.4
Ensure that Cassandra is run using a non-privileged, dedicated service account
ВисокаНиво 1Аутоматскаcassandra
Опис
As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.
Како се проверава
Метод провере: Команда љуске
shell
out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'- Очекивани излаз
0
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.
Својства
- Оперативни системи
- Било који
- Ознаке
- cassandraservice-account
- Референца
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account
Проверите овај рачунар
Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.
shell
tmaegis scan --target cassandra