Ensure that authorization is enabled for Cassandra databases

嚴重等級 1自動化cassandra

說明

Authorization is pluggable in Cassandra and is configured using the authorizer setting in cassandra.yaml. Cassandra ships with two options included in the default distribution, AllowAllAuthenticator and CassandraAuthorizer. The default, AllowAllAuthenticator performs no checking which grants all permissions to all roles. Checks /etc/cassandra/cassandra.yaml (package install; SKIP when it does not exist).

檢查方式

稽核方法: 檔案正規表示式

檔案: /etc/cassandra/cassandra.yaml
比對模式: (?m)^authorizer:[ \t]*(?:\n(?:[ \t]*(?:#[^\n]*)?\n|[ \t]+[^\n]*\n)*?[ \t]+class_name[ \t]*:[ \t]*)?['\x22]?(?:[\w.]*\.)?(?:CassandraAuthorizer)\b

修補方式

修補方法: 操作指南或基礎設施修補檔

Set 'authorizer: CassandraAuthorizer' in cassandra.yaml, rolling-restart the nodes, then grant least-privilege permissions to roles.

屬性

作業系統: 不限
標籤: cassandraauthorization
參考資料: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 2.2 Ensure that authorization is enabled for Cassandra databases

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cassandra