TMA-CASSANDRA-3.4
Ensure that Cassandra is run using a non-privileged, dedicated service account
VisokaNivo 1Automatskacassandra
Opis
As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.
Kako se proverava
Metod provere: Komanda ljuske
shell
out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'- Očekivani izlaz
0
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- cassandraservice-account
- Referenca
- CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
shell
tmaegis scan --target cassandra