cyberstrikeus Ensure that the default password is changed for the cassandra role (Automated)
Profile Applicability
- Level 1 - Cassandra
- Level 1 - Cassandra on Linux
Description
The cassandra role has a default password which must be changed.
Rationale
Failure to change the default password for the cassandra role may pose a risk to the database in the form of unauthorized access.
Impact
None
Audit Procedure
Connect to Cassandra database to verify whether the cassandra role has default password.
cqlsh -u cassandra -p cassandra
If the connection is successful this is a finding.
Remediation
Change the password for the casssandra role by issuing the following command:
cqlsh -u cassandra -p cassandra
alter role 'cassandra' with password '<NEWPASSWORD_HERE>';
Where <NEWPASSWORD_HERE> is replaced with the password of your choosing.
Default Value
cassandra
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.2 Use Unique PasswordsUse unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. | ● | ● | ● |
| v7 | 4.4 Use Unique PasswordsWhere multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. | ● | ● |