OpenParable
Skip to content
← Back to skills

Cis Cassandra311 3.4

DevOps & Security
cis-cassandra311-3.4

Cis Cassandra311 3.4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure that Cassandra is run using a non-privileged, dedicated service account

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Apache_Cassandra/CIS_Apache_Cassandra_3.11_Benchmark_v1.1.0/cis-cassandra311-3.4/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-cassandra311-3-4, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

3.4 Ensure that Cassandra is run using a non-privileged, dedicated service account

Profile Applicability

  • Level 1 - Cassandra on Linux
  • Level 2 - Cassandra on Linux

Description

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context.

Rationale

Utilizing a non-privileged account for Cassandra to execute as may reduce the impact of a Cassandra-born vulnerability. A restricted account will be unable to access resources unrelated to Cassandra, such as operating system configurations.

Audit

Execute the following command at a terminal prompt to assess this recommendation:

ps -ef | egrep "^cassandra.*$"

If no lines are returned, then this is a finding. NOTE: It is assumed that the Cassandra user is cassandra. Additionally, you may consider running sudo -l as the Cassandra user or to check the sudoers file.

Remediation

Create a user which is only used for running Cassandra and directly related processes. This user must not have administrative rights to the system.

Default Value

No default user exists for running Cassandra.

References

Not specified in the benchmark.

CIS Controls

  • v8: 3.3 Configure Data Access Control Lists
  • v8: 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
  • v7: 4.3 Ensure the Use of Dedicated Administrative Accounts
  • v7: 14.6 Protect Information through Access Control Lists

Profile

  • Level 1 | Automated