Add a superuser role

After you enable role-based access control (RBAC), create your own superuser role and disable or drop the default cassandra role.

Roles that you create with the SUPERUSER option have full access to the database and permission to run all cqlsh and CQL commands on all database resources.

Security and performance considerations for superuser roles

When you install DataStax Enterprise (DSE), a default cassandra superuser role is created with the default password cassandra. The default cassandra role is a security risk because the default username and password are publicly known. However, you must use the cassandra role to create at least one non-default superuser role. Then, disable or drop the cassandra role.

In addition to the security risks, the cassandra role isn’t recommended for extensive use because all requests from this role use the consistency level of QUORUM. This consistency level can cause significant performance degradation in multiple datacenter environments. Requests from all other authenticated roles have a consistency level of LOCAL_ONE. For more information, see How is the consistency level configured?.

After creating additional roles, only grant superuser roles to users that truly require superuser access. For non-root administrators, create non-superuser roles with reduced permission scopes.

To prevent unintentional role assignment, when you configure role_management_options for LDAP group management, set the mode_by_authentication field to ldap.

For authentication_options, set scheme_permissions to true and bind the superuser role to the internal scheme. For more information, see Binding a Role to an Authentication Scheme.

Prerequisites

Increase the replication factor for system keyspaces before enabling DSE authentication. The default cassandra role executes all requests, including login, with QUORUM and it can fail with an RF of 1.
Because the default cassandra credentials are publicly known, use firewall rules to reduce the chance of unauthorized access until you create a new superuser role and disable the default cassandra role.

Create and use a superuser role

Create a new role with the SUPERUSER, LOGIN, and PASSWORD options:

CREATE ROLE <root_user_name>
  WITH SUPERUSER = true
  AND LOGIN = true
  AND PASSWORD = '<password>';

You can also use a hashed password:

CREATE ROLE <root_user_name>
  WITH SUPERUSER = true
  AND LOGIN = true
  AND HASHED PASSWORD = '<hashed_password>';

Exit cqlsh:
```
EXIT;
```

Disable or drop the default `cassandra` role

To disable or drop the cassandra role, log in with the new role created in the Create and use a superuser role step:
```
cqlsh -u <root_user>
```
Enter the password at the prompt.

Use the LIST ROLES command to verify that the role has superuser privileges:

LIST ROLES;

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}
           cassandra |  True |  True |        {}
(2 rows)

Drop or alter the cassandra role:
- Drop the role (recommended):
  
  DROP ROLE cassandra;
  
  DataStax recommends that you drop the role in production environments. When you use an external authentication method, such as LDAP, dropping the role prevents accidental assignment of unnecessary privileges.
- Alter the cassandra role to disable the SUPERUSER option and change the password:
  
  ALTER ROLE cassandra WITH SUPERUSER = false AND LOGIN = false AND PASSWORD='new_secret_pw';
  
  You can also replace the password with a hashed password:
  
  ALTER ROLE cassandra WITH SUPERUSER = false AND LOGIN = false AND HASHED PASSWORD='$2a$10$4N5j5py12OySiSy9L2RHduOjFFetJ1d9hqCoZYtQC3kJOwdg3hbOC';

If you dropped the role, verify that the cassandra role no longer exists:

LIST ROLES;

Make sure the cassandra role isn’t listed in the output:

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}

(1 rows)

Modify firewall rules now that you have secured the cluster with a non-default superuser role.

Next steps

To set up roles that map to the user or group names for the configured authentication schemes, see Add database users.

Add a superuser role

Security and performance considerations for superuser roles

Prerequisites

Create and use a superuser role

Disable or drop the default `cassandra` role

Next steps

Was this helpful?

Give Feedback

Add a superuser role

Security and performance considerations for superuser roles

Prerequisites

Create and use a superuser role

Disable or drop the default cassandra role

Next steps

Was this helpful?

Disable or drop the default `cassandra` role