CODEWITHSUNDEEP
cassandracqlsh
Manos K
Manos K

Reputation: 33

Any reason not dropping cassandra default user?

Most of the online guides give advice how to alter the password of the default cassandra user and create another admin for better security. Is there any reason to keep cassandra role if another superuser is created and used for all purposes?

I created a new admin user:

CREATE ROLE priam WITH PASSWORD = 'somepass' AND LOGIN = true AND SUPERUSER = true;

and deleted the default one:

drop role cassandra;

Seems that everything still works :) or not?

Upvotes: 0

Views: 493

Answers (2)

Alex Ott
Alex Ott

Reputation: 87224

The biggest problem with built-in cassandra user is that the QUORUM consistency level is used when accessing its data. This means, if you lose several nodes, you have a big chance not be able to login with this user if you want to perform some action.

You can leave the cassandra user, but you must change its password, and because it's still exist, it's an additional security risk.

So it's better to use a new super user and drop cassandra.

Upvotes: 1

Manos K
Manos K

Reputation: 33

Here they say that you can also drop the account after you create another with superuser rights.

https://docs.datastax.com/en/dse/6.0/dse-admin/datastax_enterprise/security/Auth/secCreateRootAccount.html

also here:

https://www.allcode.com/remove-the-user-cassandra-from-datastaxapache-cassandra-installations/

Upvotes: 0

Related Questions