name	cis-cassandra5-3.2
description	Ensure that the default password is changed for the cassandra role
category	cis-cassandra
version	1.1.0
author	cyberstrike-official
tags	["cis","cassandra","linux","database","nosql","access-control","passwords"]
cis_id	3.2
cis_benchmark	CIS Apache Cassandra 5.0 Benchmark v1.1.0
tech_stack	["linux","cassandra"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure that the default password is changed for the cassandra role (Automated)

The cassandra role has a default password which must be changed.

Failure to change the default password for the cassandra role may pose a risk to the database in the form of unauthorized access.

None

Connect to Cassandra database to verify whether the cassandra role has default password.

cqlsh -u cassandra -p cassandra

If the connection is successful this is a finding.

Change the password for the casssandra role by issuing the following command:

cqlsh -u cassandra -p cassandra

alter role 'cassandra' with password '<NEWPASSWORD_HERE>';

Where <NEWPASSWORD_HERE> is replaced with the password of your choosing.

cassandra

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.2 Use Unique Passwords Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.	●	●	●
v7	4.4 Use Unique Passwords Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system.		●	●

cis-cassandra5-3-2