[
https://issues.apache.org/jira/browse/CASSANDRA-21546?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101385#comment-18101385
]
Stefan Miklosovic edited comment on CASSANDRA-21546 at 8/3/26 3:52 PM:
-----------------------------------------------------------------------
It would be also nice if there was a way how to set up a hash instead of a
plaintext password in case of PasswordDefaultRoleInitializer. The reason for
inserting a hash is that it will not be visible in cassandra.yaml. This is a
classic "chicken-egg" problem - we want to initialize Cassandra to use some
other password from "cassandra" but while doing so we have exposed that
information in cassandra.yaml. To "break" this pattern, if we put a hash into
cassandra.yaml and only inserted that hash without us hashing the password,
then it would be irrelevant that a hash is visible in yaml because an attacker
would have just a hash, no plaintext they can just log in with.
https://github.com/apache/cassandra/commit/06a3726f851a6cbdd7d50e51cc0a492fd96e5a29
was (Author: smiklosovic):
It would be also nice if there was a way how to set up a hash instead of a
plaintext password in case of PasswordDefaultRoleInitializer. The reason for
inserting a hash is that it will not be visible in cassandra.yaml. This is a
classic "chicken-egg" problem - we want to initialize Cassandra to use some
other password from "cassandra" but while doing so we have exposed that
information in cassandra.yaml. To "break" this pattern, if we put a hash into
cassandra.yaml and only inserted that hash without us hashing the password,
then it would be irrelevant that a hash is visible in yaml because an attacker
would have just a hash, no plaintext they can just log in with.
> Support pluggable default role initialization (avoid hardcoded superuser
> password)
> ----------------------------------------------------------------------------------
>
> Key: CASSANDRA-21546
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21546
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Aparna Naik
> Assignee: Aparna Naik
> Priority: Normal
>
> Cassandra's first-boot bootstrap hardcodes the creation of a cassandra
> superuser role with a default password (cassandra). Every new cluster starts
> with this guessable credential exposed until an operator manually rotates or
> drops it, and deployments that already use mutual TLS have no way to
> bootstrap a superuser identity without also creating this password-based one.
> This ticket will make the default role bootstrap pluggable via a new
> IDefaultRoleInitializer interface and default_role_initializer config option.
> The existing password-based behavior will be the default implementation for
> backward compatibility, and it will add a MutualTlsDefaultRoleInitializer
> that instead maps a client certificate identity to the superuser role, so no
> password credential needs to exist at all.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
