Using cqlsh with Kerberos/SSL

Sample files are provided to help configure authentication for Kerberos, SSL, and Kerberos and SSL.

To run cqlsh with Kerberos, SSL, or Kerberos and SSL, use the sample files and make changes as appropriate for your environment.

DataStax Enterprise provides a sample cqlshrc.sample.kerberos file that you can use as a starting point.

Kerberos example

Required settings for Kerberos authentication:

[connection]
hostname = 192.168.1.2
port = 9042
factory = cqlshlib.kerberos.kerberos_transport_factory ;; Mandatory

[kerberos]
hostname = cassandra01.example.com ;; Mandatory
service = cassandra ;; Mandatory
principal = bill/cassandra-admin@example.com ;; Optional.
qops = auth-conf ;; Optional, see the paragraph below.

SSL example

DataStax Enterprise provides a sample cqlshrc.sample.ssl file that you can use as a starting point.

[authentication]
username = fred
password = !!bang!!$

[connection]
hostname = 127.0.0.1
port = 9042
 
[ssl]
certfile = ~/keys/cassandra.cert
validate = false ;; Optional, true by default. See the paragraph below.

[certfiles] ;; Optional section, overrides the default certfile in the [ssl] section.
10.209.182.160 = /etc/dse/cassandra/conf/dsenode0.cer 
10.68.65.199 = /etc/dse/cassandra/conf/dsenode1.cer

• When validate = false there is no server authentication, only data encryption.
• When validate = true cqlsh will validate the server's certificate against the certfile

keytool -importkeystore -srckeystore .keystore -destkeystore user.p12 -deststoretype PKCS12
openssl pkcs12 -in user.p12 -out user.pem -nodes

This pem key is required because the host in the certificate is compared to the host of the machine that it is connected to. The SSL certificate must be provided either in the configuration file or as an environment variable. The environment variables (SSL_CERTFILE and SSL_VALIDATE) override any options set in this file.

Kerberos and SSL

For information about using Kerberos with SSL, see Using Kerberos and SSL at the same time.

The settings for using both Kerberos and SSL are a combination of the Kerberos and SSL sections in these examples.

The supported environmental variables are KRB_HOST, KRB_SERVICE, KRB_PRINCIPAL, SSL_CERTFILE, and SSL_VALIDATE variables.