Providing Kerberos Credentials when Starting CQL Shell
Set up a cqlshrc file to run cqlsh against a Kerberos-enabled cluster.
Example files
DataStax Enterprise (DSE) provides cqlshrc.sample files and the following examples for adjusting their settings:
Make changes as appropriate for your environment.
To use Kerberos with SSL, see Kerberos and SSL.
The default location of the cqlshrc.sample file depends on the type of installation:
| Filename | Package installations | Tarball installations |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Kerberos example
DSE provides a sample cqlshrc.sample.kerberos file as a starting point.
Required settings for Kerberos authentication:
[connection]
hostname = 192.168.1.2
port = 9042
[kerberos]
service = dse ;; If not set, the default is dse
qops = auth ;; Optional, see the paragraph belowThe [connection] hostname and [kerberos] service settings must either match the values in the dse.yaml configuration file or be set as environment variables.
-
In the
kerberos_optionssection of thedse.yamlfile, setservice_principal. Theservice_principalsetting must be consistent and present everywhere: in thedse.yamlfile, in thekeytab, and in thecqlshrcfile (whereservice_principalis separated into<service>/<hostname>). -
The environment variables (
KRB_HOST,KRB_SERVICE, andKRB_PRINCIPAL) override the options that are set indse.yaml.The environment variables
KRB_SERVICEandQOPSoverride the options in the.cqlshrcfile. The loading order for settings is: environment variable,.cqlshrcsetting, default.
The default (auth) is used when qops is not specified.
On the client side, the qops option is a comma-delimited list of the QOP values allowed by the client for the connection.
-
The client (cqlsh) value list must contain at least one of the
QOPvalues that are specified on the server. -
The client can have multiple
QOPvalues, while the server can only have a singleQOPvalue that is specified in thedse.yamlfile.
SSL example
DSE provides a sample cqlshrc.sample.ssl file as a starting point.
[authentication]
username = fred
password = !!bang!!$
[connection]
hostname = 127.0.0.1
port = 9042
[ssl]
certfile = ~/keys/cassandra.cert
validate = false ;; Optional, true by default. See the paragraph below.
[certfiles] ;; Optional section, overrides the default certfile in the [ssl] section.
10.209.182.160 = /etc/dse/cassandra/conf/dsenode0.cer
10.68.65.199 = /etc/dse/cassandra/conf/dsenode1.cer|
When generating the certificate, be sure to set the |
When validate is enabled, you must create a Policy Enforcement Manager (pem) key which is used in the cqlshrc file.
For example:
keytool -importkeystore -srckeystore .keystore -destkeystore <user>.p12 -deststoretype PKCS12
openssl pkcs12 -in <user>.p12 -out <user>.pem -nodesThis pem key is required because the host in the certificate is compared to the host of the machine to which it is connected.
The SSL certificate must be provided either in the configuration file or as an environment variable.
The environment variables (SSL_CERTFILE and SSL_VALIDATE) override any options set in this file.
Kerberos and SSL
For information about using Kerberos with SSL, see Connecting to SSL-enabled nodes using cqlsh.
The settings for using both Kerberos and SSL are a combination of the Kerberos and SSL sections in these examples.
The supported environmental variables are KRB_SERVICE, SSL_CERTFILE, and SSL_VALIDATE variables.
