# Cis Cassandra311 1.1

> Cis Cassandra311 1.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure a separate user and group exist for Cassandra

- Skill name: `cis-cassandra311-1.1`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_Cassandra/CIS_Apache_Cassandra_3.11_Benchmark_v1.1.0/cis-cassandra311-1.1/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# 1.1 Ensure a separate user and group exist for Cassandra

## Profile Applicability

- Level 1 - Cassandra on Linux
- Level 2 - Cassandra on Linux

## Description

Create separate userid and group for Cassandra.

## Rationale

All processes need to run as a user with least privilege. This mitigates the potential impact of malware to the system.

## Audit

Logon to the server where Cassandra is installed.
To confirm existence of the group, execute the following command:

```bash
$ getent group | grep cassandra
```

To confirm existence of the user, execute the following command:

```bash
$ getent passwd | grep cassandra
```

If either the group or user do not exist, or if the user is not a member of the group, this is a finding.

## Remediation

Create a group for cassandra(if it does not already exist)

```bash
sudo groupadd cassandra
```

Create a user which is only used for running Cassandra and its related processes.

```bash
sudo useradd -m -d /home/cassandra -s /bin/bash -g cassandra -u <USERID_NUMBER> cassandra
```

Replacing <USERID_NUMBER> with a number not already used on the server

## Default Value

No default user or group exists for Cassandra in a fresh installation.

## References

Not specified in the benchmark.

## CIS Controls

- v8: 3.3 Configure Data Access Control Lists
- v7: 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
- v7: 4.3 Ensure the Use of Dedicated Administrative Accounts
- v7: 14.6 Protect Information through Access Control Lists

## Profile

- Level 1 | Manual

---

Source: https://www.openparable.com/skill/devops-security/cis-cassandra311-1-1 (OpenParable). Cite the canonical URL above.