Ensure that authentication is enabled for Cassandra databases

嚴重等級 1自動化cassandra

說明

Authentication is pluggable in Cassandra and is configured using the authenticator setting in cassandra.yaml. Cassandra ships with two options included in the default distribution, AllowAllAuthenticator and PasswordAuthenticator. The default, AllowAllAuthenticator, performs no authentication checks and therefore requires no credentials. It is used to disable authentication completely. Checks /etc/cassandra/cassandra.yaml (package install; SKIP when it does not exist).

檢查方式

稽核方法: 檔案正規表示式

檔案: /etc/cassandra/cassandra.yaml
比對模式: (?m)^authenticator:[ \t]*(?:\n(?:[ \t]*(?:#[^\n]*)?\n|[ \t]+[^\n]*\n)*?[ \t]+class_name[ \t]*:[ \t]*)?['\x22]?(?:[\w.]*\.)?(?:PasswordAuthenticator|MutualTlsAuthenticator|MutualTlsWithPasswordFallbackAuthenticator)\b

修補方式

修補方法: 操作指南或基礎設施修補檔

Set 'authenticator: PasswordAuthenticator' in cassandra.yaml, raise system_auth replication (NetworkTopologyStrategy, RF 3 per DC), rolling-restart the nodes and create a new superuser.

屬性

作業系統: 不限
標籤: cassandraauthentication
參考資料: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 2.1 Ensure that authentication is enabled for Cassandra databases

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cassandra