Ensure that Cassandra is run using a non-privileged, dedicated service account

YüksekDüzey 1Otomatikcassandra

Açıklama

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when every CassandraDaemon process runs as the cassandra account (the benchmark assumes that user name); also confirm with sudo -l -U cassandra that it has no administrative rights.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(ps -eo user=,args= | grep '[C]assandraDaemon') || exit 1; printf '%s\n' "$out" | awk '$1 != "cassandra" {n++} END {print n+0}'

Beklenen çıktı: 0

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Run Cassandra under a dedicated, non-administrative cassandra account (User=cassandra in the service unit) and remove any sudo rights for it.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: cassandraservice-account
Referans: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target cassandra