OpenParable
Skip to content
← Back to skills

Cis Cassandra311 1.1

DevOps & Security
cis-cassandra311-1.1

Cis Cassandra311 1.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure a separate user and group exist for Cassandra

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_Cassandra/CIS_Apache_Cassandra_3.11_Benchmark_v1.1.0/cis-cassandra311-1.1/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-cassandra311-1-1, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

1.1 Ensure a separate user and group exist for Cassandra

Profile Applicability

  • Level 1 - Cassandra on Linux
  • Level 2 - Cassandra on Linux

Description

Create separate userid and group for Cassandra.

Rationale

All processes need to run as a user with least privilege. This mitigates the potential impact of malware to the system.

Audit

Logon to the server where Cassandra is installed. To confirm existence of the group, execute the following command:

$ getent group | grep cassandra

To confirm existence of the user, execute the following command:

$ getent passwd | grep cassandra

If either the group or user do not exist, or if the user is not a member of the group, this is a finding.

Remediation

Create a group for cassandra(if it does not already exist)

sudo groupadd cassandra

Create a user which is only used for running Cassandra and its related processes.

sudo useradd -m -d /home/cassandra -s /bin/bash -g cassandra -u <USERID_NUMBER> cassandra

Replacing <USERID_NUMBER> with a number not already used on the server

Default Value

No default user or group exists for Cassandra in a fresh installation.

References

Not specified in the benchmark.

CIS Controls

  • v8: 3.3 Configure Data Access Control Lists
  • v7: 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
  • v7: 4.3 Ensure the Use of Dedicated Administrative Accounts
  • v7: 14.6 Protect Information through Access Control Lists

Profile

  • Level 1 | Manual