Introduction

Apache Cassandra is a high-performance NoSQL database known for its scalability and fault tolerance. When deploying Cassandra in a production environment, managing access permissions is critical for maintaining data security and integrity. This guide will walk you through configuring access permissions for Cassandra on Linux Ubuntu, ensuring that only authorized users can access and manipulate data.

Prerequisites

Before configuring access permissions, ensure that you have:

• A Linux Ubuntu server with Cassandra installed.
• Access to a terminal or SSH client to connect to your server.
• Root or administrator privileges to modify system configurations.
• Basic understanding of Cassandra architecture and CQL (Cassandra Query Language).

Configure Cassandra Authentication

By default, Cassandra does not enforce authentication. We will enable it to restrict database access only to authenticated users.

1. Edit the cassandra.yaml file:
   Locate the Cassandra configuration file, typically found at /etc/cassandra/cassandra.yaml.

   sudo nano /etc/cassandra/cassandra.yaml

1. Set up Authentication:
   In the cassandra.yaml file, find the authenticator property and set it to PasswordAuthenticator.

   authenticator: PasswordAuthenticator

1. Set up Authorizer:
   Set the authorizer property to CassandraAuthorizer to enable authorization.

   authorizer: CassandraAuthorizer

1. Restart Cassandra:
   Save your changes and restart the Cassandra service to apply the new authentication settings.

   sudo systemctl restart cassandra

Create a Superuser

After enabling authentication, the next step is to create a superuser account to manage database permissions.

1. Connect to Cassandra:
   Use cqlsh, the Cassandra command-line shell, to connect to your database.

   cqlsh

1. Create a Superuser Account:
   Run the following CQL command to create a new superuser:

   CREATE ROLE admin WITH PASSWORD = 'admin_password' AND SUPERUSER = true AND LOGIN = true;

Replace 'admin_password' with a strong, secure password.

1. Exit cqlsh:

   exit

Manage User Roles and Permissions

With a superuser account in place, you can now create users and assign appropriate permissions based on their roles.

1. Log in as Superuser:
   Reconnect to Cassandra using the new superuser account.

   cqlsh -u admin -p admin_password

1. Create New Roles:
   To create a regular user, use the following command:

   CREATE ROLE data_user WITH PASSWORD = 'user_password' AND LOGIN = true;

This role does not have superuser privileges, limiting access to specific keyspaces or operations you define.

1. Grant Permissions:
   Assign permissions using the GRANT statement. For example, to grant read/write access to a specific keyspace:

   GRANT MODIFY ON KEYSPACE my_keyspace TO data_user;
   GRANT SELECT ON KEYSPACE my_keyspace TO data_user;

Replace my_keyspace with the actual name of the keyspace.

1. Revoke Permissions:
   If you need to revoke permissions, use the REVOKE statement:

   REVOKE MODIFY ON KEYSPACE my_keyspace FROM data_user;

1. List Role Permissions:
   To view permissions granted to a user:

   LIST ALL PERMISSIONS OF data_user;

Security Best Practices

• Use Strong Passwords: Ensure all users, especially superusers, have complex and unique passwords.
• Least Privilege Principle: Only grant the minimum necessary permissions to users, reducing the risk of unauthorized access.
• Regular Audits: Periodically review user roles and permissions, revoking access that is no longer needed.
• Monitor Logs: Enable and monitor audit logs to track security-related events and detect potential threats early.

Summary Table

Here's a quick reference table for configuring access permissions:

Conclusion

Configuring access permissions in Cassandra is vital for securing your database against unauthorized access. By enabling authentication, creating user roles, and granting specific permissions, you can maintain data integrity and security, aligning with best practices for operating a production database. Regularly reviewing and updating access policies further strengthens your database's defense against potential threats.