Enabling JMX Native Authentication

Use the Java-provided local Java Management Extensions (JMX) authentication method, which stores credentials and controls access using a local file. This implementation requires authentication to run utilities such as nodetool or nodesync. When enabled, ensure that DSE Unified Authentication is disabled.

Generally, JMX settings are inserted into the cassandra-env.sh file. However, you can also specify them on the command line:

cassandra -Dcom.sun.management.jmxremote.authenticate=true
  -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password

Procedure

Locate the cassandra-env.sh file. The location of this file depends on the type of installation:
- Package installations: /etc/dse/cassandra/cassandra-env.sh
- Tarball installations: <installation_location>/resources/cassandra/conf/cassandra-env.sh
If it does not already exist, create the /etc/cassandra directory from an account with sudo privilege.
```
sudo mkdir /etc/cassandra
```
Set the JMX remote authenticate to true for remote or local, or both:
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true"
```
Connections are tested to see if they are local; change the first instance to enable authentication on local connections and the second instance (in the else statement) to enable remote.
On DSE nodes where you want to disable JMX remote access, ensure jmxremote.authenticate is set to false:
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=false"
```
Uncomment the java.rmi.server.hostname setting, and change it to the IP address of the node to which you are connected. Example:
```
JVM_OPTS="$JVM_OPTS -Djava.rmi.server.hostname=10.0.100.100"
```
On nodes that allow access, set the path to the credentials file:
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password"
```
Ensure that the path is accessible to the user who runs as cassandra.
Create a jmxremote.password file that contains a user name and password on each line and save it to the location entered in the previous step. Example:
```
touch jmxremote.password
```
```
cassandra p4ssw0rd
```

Change the ownership and permission of the jmxremote.password file. Example:

chown cassandra:cassandra /etc/cassandra/jmxremote.password

chmod 400 /etc/cassandra/jmxremote.password

Optional: To limit the types of actions a user can perform, create a jmxremote.access file, uncomment the remote access option, and specify the path in the following setting:
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.access.file=/etc/cassandra/jmxremote.access"
```
If you enabled the remote access in this step, edit the jmxremote.access file to include users and their proper permission level. Example:
```
cassandra readwrite
<<new_superuser>> readwrite
<<some_other_user>> readonly
```
The default superuser account is a security hazard! This account is used only for the purposes of illustration.

The readonly permission allows the JMX client to read an MBean’s attributes and receive notifications. The readwrite permission allows the JMX client to set attributes, to invoke operations, and to create and remove MBeans, in addition to reading an MBean’s attributes and receiving notifications.

The access file must be secured from unauthorized readers. Change the ownership of the jmxremote.access file to the user who starts cassandra, and change permissions to read only. Example:
```
chown cassandra:cassandra /etc/cassandra/jmxremote.access
```
```
chmod 400 /etc/cassandra/jmxremote.access
```
This example presumes that cassandra is run by the default user cassandra.
If all nodes on the cluster were updated, perform a rolling restart; otherwise restart only the affected nodes.

Verify that authentication is working by running a nodetool command with credentials:

nodetool -u cassandra -pw p4ssw0rd status

The results should display.

Datacenter: DataStax
=====================
Status=Up/Down
|/ State=Normal/Leaving/Joining/Moving
--  Address         Load       Tokens       Owns    Host ID                               Rack
UN  10.200.182.180  316.76 KiB  1            ?       5ca115f6-250a-4964-9a52-c10926031f1b  rack1
UN  10.200.182.181  446.76 KiB  1            ?       74a44407-5e26-43d4-83dc-aae9fe35c2f4  rack1
Datacenter: Solr
================
Status=Up/Down
|/ State=Normal/Leaving/Joining/Moving
--  Address         Load       Tokens       Owns    Host ID                               Rack
UN  10.200.182.183  368.38 KiB  1            ?       d59d912c-dcc9-469f-8ae1-1c14313e16b1  rack1

NOTE: Non-system keyspaces don't have the same replication settings, effective ownership information is meaningless

Repeat the configuration on each node in the cluster.

Enabling JMX Native Authentication

Procedure

Was this helpful?

Give Feedback