I85PREP
⌘ K
Cassandra Admin study materials
Cassandra Admin study resources

Cassandra Admin: Security: Authentication, Authorization, Encryption, and Audit

Cassandra Admin · Work through your exam, one topic at a time.

All guide sections

Security: Authentication, Authorization, Encryption, and Audit

This domain tests locking down access: authentication, authorization, transport and internode encryption, and audit visibility.

Authentication and authorization

  • authenticator controls login. AllowAllAuthenticator disables auth; PasswordAuthenticator uses Cassandra internal system_auth tables. authorizer: CassandraAuthorizer enables role-based permissions; AllowAllAuthorizer grants everything.
  • Default installs may ship cassandra/cassandra; change it immediately and remove anonymous or default roles. Roles can LOGIN, be granted other roles, and receive GRANT SELECT or INSERT on keyspace.table.
  • system_auth must have RF >= 3 and be repaired; otherwise auth outages follow node loss. In multi-DC, use NetworkTopologyStrategy.
  • Enable JMX authentication and SSL and restrict port 7199; do not expose 9042 publicly without TLS and authentication.

Encryption and audit

  • Internode encryption uses server_encryption_options with keystore, truststore, and internode_encryption set to all, dc, or rack. Client encryption uses client_encryption_options with enabled true and optional require_client_auth.
  • Apache Cassandra does not provide native transparent data-at-rest encryption in all versions; use OS or volume encryption unless a vendor feature is confirmed. Cassandra 4.x audit logging can record login and CQL activity via audit_logging_options; verify logger and categories for your version.

Worked example

Create an ops role with LOGIN=true and a password; GRANT SELECT ON app.events TO ops; set system_auth RF=3, run repair, then test with cqlsh -u ops. If authentication fails after a node restart, check system_auth RF and repair status before changing authenticators.

Traps

Leaving default credentials; setting system_auth RF=1; granting ALL broadly; enabling client TLS without updating drivers; and assuming SSL alone provides authorization.