Cis Cassandra5 4.2

Ensure that auditing is enabled (Manual)

Profile Applicability

• Level 1 - Cassandra on Linux

Description

Audit logging in Cassandra logs every incoming CQL command request, Authentication (successful as well as unsuccessful) to C* node. Currently, there are two implementations provided, the custom logger can be implemented and injected with the class name as a parameter in cassandra.yaml.

Rationale

Unauthorized attempts to create, drop or alter users or data should be a concern.

Impact

None

Audit Procedure

Allows logging to filesystem log files using logback or to a Cassandra table. When you turn on audit logging, the default is to write to logback filesystem log files. You can verify auditing is turned on:

cat cassandra.yaml | grep -Al "audit_logging_options"

If enabled is set to true, then success. Anything else is a finding.

Remediation

Open the cassandra.yaml file in a text editor

In the audit_logging_options section, set enabled to true.

# Audit logging options
audit_logging_options:
  enabled: true

Default Value

Auditing is disabled by default.

References

1. https://docs.datastax.com/en/datastax_enterprise/4.8/datastax_enterprise/sec/secAudit.html#secAudit

CIS Controls