Enabling JMX Native Authentication
Use the Java-provided local Java Management Extensions (JMX) authentication method, which stores credentials and controls access using a local file.
This implementation requires authentication to run utilities such as nodetool
or nodesync
.
When enabled, ensure that DSE Unified Authentication is disabled.
Generally, JMX settings are inserted into the |
cassandra -Dcom.sun.management.jmxremote.authenticate=true
-Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password
Procedure
-
Locate the
cassandra-env.sh
file. The location of this file depends on the type of installation:-
Package installations:
/etc/dse/cassandra/cassandra-env.sh
-
Tarball installations:
<installation_location>/resources/cassandra/conf/cassandra-env.sh
-
-
If it does not already exist, create the
/etc/cassandra directory
from an account withsudo
privilege.sudo mkdir /etc/cassandra
-
Set the JMX remote authenticate to
true
for remote or local, or both:JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true"
Connections are tested to see if they are local; change the first instance to enable authentication on local connections and the second instance (in the else statement) to enable remote.
-
On DSE nodes where you want to disable JMX remote access, ensure
jmxremote.authenticate
is set tofalse
:JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=false"
-
Uncomment the
java.rmi.server.hostname
setting, and change it to the IP address of the node to which you are connected. Example:JVM_OPTS="$JVM_OPTS -Djava.rmi.server.hostname=10.0.100.100"
-
On nodes that allow access, set the path to the credentials file:
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password"
Ensure that the path is accessible to the user who runs as
cassandra
. -
Create a
jmxremote.password
file that contains a user name and password on each line and save it to the location entered in the previous step. Example:touch jmxremote.password
cassandra p4ssw0rd
-
Change the ownership and permission of the
jmxremote.password
file. Example:chown cassandra:cassandra /etc/cassandra/jmxremote.password
chmod 400 /etc/cassandra/jmxremote.password
-
Optional: To limit the types of actions a user can perform, create a
jmxremote.access
file, uncomment theremote access
option, and specify the path in the following setting:JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.access.file=/etc/cassandra/jmxremote.access"
-
If you enabled the remote access in this step, edit the
jmxremote.access
file to include users and their proper permission level. Example:cassandra readwrite <<new_superuser>> readwrite <<some_other_user>> readonly
The default
superuser
account is a security hazard! This account is used only for the purposes of illustration.The
readonly
permission allows the JMX client to read an MBean’s attributes and receive notifications. Thereadwrite
permission allows the JMX client to set attributes, to invoke operations, and to create and remove MBeans, in addition to reading an MBean’s attributes and receiving notifications.The access file must be secured from unauthorized readers. Change the ownership of the
jmxremote.access
file to the user who startscassandra
, and change permissions toread only
. Example:chown cassandra:cassandra /etc/cassandra/jmxremote.access
chmod 400 /etc/cassandra/jmxremote.access
This example presumes that
cassandra
is run by the default usercassandra
. -
If all nodes on the cluster were updated, perform a rolling restart; otherwise restart only the affected nodes.
-
Verify that authentication is working by running a
nodetool
command with credentials:nodetool -u cassandra -pw p4ssw0rd status
The results should display.
Datacenter: DataStax ===================== Status=Up/Down |/ State=Normal/Leaving/Joining/Moving -- Address Load Tokens Owns Host ID Rack UN 10.200.182.180 316.76 KiB 1 ? 5ca115f6-250a-4964-9a52-c10926031f1b rack1 UN 10.200.182.181 446.76 KiB 1 ? 74a44407-5e26-43d4-83dc-aae9fe35c2f4 rack1 Datacenter: Solr ================ Status=Up/Down |/ State=Normal/Leaving/Joining/Moving -- Address Load Tokens Owns Host ID Rack UN 10.200.182.183 368.38 KiB 1 ? d59d912c-dcc9-469f-8ae1-1c14313e16b1 rack1 NOTE: Non-system keyspaces don't have the same replication settings, effective ownership information is meaningless
-
Repeat the configuration on each node in the cluster.