Enabling JMX native authentication

Use the Java provided local JMX authentication method, which stores credentials and controls access using a local file. Only use this method to require authentication to run utilities such as nodetool when DSE Unified Authenitcation is disabled on the DSE.

Generally, JMX settings are inserted into the cassandra-env.sh file. However, you can also specify them on the command line:

cassandra -Dcom.sun.management.jmxremote.authenticate=true


  1. Set the JMX remote authenticate to true for remote and/or local:

    JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true"

    Connections are tested to see if they are local, change the first instance to enable authentication on local connections and the second instance (in the else statement) to enable remote.

  2. On DSE nodes where you want to disable access, set the JMX remote authenticate to false for remote and/or local:

    JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=false"

    Disabling local may cause unexpected behavior, such as preventing dsetool from running on the node.

  3. On nodes that allow access, set the path to the credentials file:

    JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/dse/cassandra/jmxremote.password"

    Ensure that the path is accessible to the user who runs cassandra.

  4. Create a file that contains a user name and password on each line and save it to the location entered in the previous step.

    sallyjones 123DSEadmin
  5. To limit the types of actions a user can perform, create a jmxremote.access file, uncomment the remote access option, and specify the path in the following setting

    JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.access.file=/etc/dse/cassandra/jmxremote.access
  6. If all nodes on the cluster were updated, perform a rolling restart; otherwise restart only the affected nodes.

  7. Verify that authentication is working by running a nodetool command with credentials:

    nodetool -u sallyjones -pw 123DSEadmin status

    The results should display.

    Datacenter: DataStax
    |/ State=Normal/Leaving/Joining/Moving
    --  Address         Load       Tokens       Owns    Host ID                               Rack
    UN  316.76 KiB  1            ?       5ca115f6-250a-4964-9a52-c10926031f1b  rack1
    UN  446.76 KiB  1            ?       74a44407-5e26-43d4-83dc-aae9fe35c2f4  rack1
    Datacenter: Solr
    |/ State=Normal/Leaving/Joining/Moving
    --  Address         Load       Tokens       Owns    Host ID                               Rack
    UN  368.38 KiB  1            ?       d59d912c-dcc9-469f-8ae1-1c14313e16b1  rack1
    Note: Non-system keyspaces don't have the same replication settings, effective ownership information is meaningless
  8. Repeat the configuration on each node in the cluster.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com