Manage superuser accounts

DataStax recommends that you do not use the cassandra role for regular user access, and that you create a custom superuser immediately after creating a keyspace.

This topic provides instructions on how to create a new superuser account, reset your superuser password, and delete the default superuser account.

About superuser accounts

The cassandra account serves as the default superuser account. This account provides full access to all keyspaces and tables in the database. DataStax recommends that you replace the cassandra account with a new superuser account.

To create a new superuser account, you must do the following:

Create a new superuser account with the SUPERUSER and LOGIN permissions.
Grant the new superuser account the ALL permission.
Reset the superuser password.
Delete the default cassandra superuser account.

Create a new superuser account for your database

Create a new superuser account:
```
CREATE ROLE ROOT_ACCOUNT_NAME
    WITH SUPERUSER = true
    AND LOGIN = true
    WITH PASSWORD = 'ROLE_PASSWORD';
```
Replace the following:
- ROOT_ACCOUNT_NAME: The name of your root account
- ROLE_PASSWORD: The role password
Make sure the account exists:
```
LIST ROLE ROOT_ACCOUNT_NAME;
```
Replace ROOT_ACCOUNT_NAME with the name of your root account.
Grant the new superuser account the ALL permission:
```
GRANT ALL PERMISSIONS ON ALL KEYSPACES TO ROOT_ACCOUNT_NAME;
```
Replace ROOT_ACCOUNT_NAME with the name of your root account.
Check that the new superuser account has the ALL permission:
```
LIST ALL PERMISSIONS OF ROOT_ACCOUNT_NAME;
```
Replace ROOT_ACCOUNT_NAME with the name of your root account.

Reset your superuser password

You can change your superuser password at any time. You must ensure that all passwords meet the following requirements:

Includes at least 8 characters, a lowercase letter, an uppercase letter, and a number.
Does not include parts of your username.
Is not any of your last four passwords.

To reset your superuser password, do the following:

Sign into the cqlsh using your superuser credentials.
Run the following command to change your password:
```
ALTER USER superuser WITH PASSWORD 'NEW_PASSWORD';
```
Replace NEW_PASSWORD with your new password.

You can access your databases with your new password.

Delete the default superuser account

After you create a new superuser account, you can delete the default cassandra superuser account.

To delete the default superuser account, do the following:

Log into the cqlsh using your superuser credentials.
Run the following command to delete the cassandra superuser account:
```
DROP ROLE cassandra;
```
Make sure the cassandra account is deleted:
```
LIST ROLE cassandra;
```
After you delete the cassandra account, you can no longer access the database with the cassandra account.

Manage superuser accounts

About superuser accounts

Create a new superuser account for your database

Reset your superuser password

Delete the default superuser account

Was this helpful?

Give Feedback