| name | cis-cassandra5-3.2 |
| description | Ensure that the default password is changed for the cassandra role |
| category | cis-cassandra |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","cassandra","linux","database","nosql","access-control","passwords"] |
| cis_id | 3.2 |
| cis_benchmark | CIS Apache Cassandra 5.0 Benchmark v1.1.0 |
| tech_stack | ["linux","cassandra"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the default password is changed for the cassandra role (Automated)
Profile Applicability
- Level 1 - Cassandra
- Level 1 - Cassandra on Linux
Description
The cassandra role has a default password which must be changed.
Rationale
Failure to change the default password for the cassandra role may pose a risk to the database in the form of unauthorized access.
Impact
None
Audit Procedure
Connect to Cassandra database to verify whether the cassandra role has default password.
cqlsh -u cassandra -p cassandra
If the connection is successful this is a finding.
Remediation
Change the password for the casssandra role by issuing the following command:
cqlsh -u cassandra -p cassandra
alter role 'cassandra' with password '<NEWPASSWORD_HERE>';
Where <NEWPASSWORD_HERE> is replaced with the password of your choosing.
Default Value
cassandra
References
- http://cassandra.apache.org/doc/latest/operating/security.html
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 5.2 Use Unique Passwords
Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. | ● | ● | ● |
| v7 | 4.4 Use Unique Passwords
Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. | | ● | ● |
