Add a superuser role

When you install Hyper-Converged Database (HCD), a default cassandra role is created. This is a superuser (root) role that is used to run the database service or process until otherwise configured.

After enabling role-based access control (RBAC), create your own superuser role, and then disable or drop the default cassandra role.

Roles that you create with the SUPERUSER option have full access to the database and permission to run all cqlsh and CQL commands on all database resources.

Security and performance considerations for superuser roles

When you install Hyper-Converged Database (HCD), a default cassandra superuser role is created with the default password cassandra. The default cassandra role is a security risk because the default username and password are publicly known. However, you must use the cassandra role to create at least one non-default superuser role. Then, disable or drop the cassandra role.

In production environments that use an external authentication method, such as LDAP, dropping the default cassandra role prevents accidental assignment with elevated privileges, and it prevents unauthorized access through publicly known default credentials.

After creating additional roles, only grant superuser roles to users that truly require superuser access. For non-root administrators, create non-superuser roles with reduced permission scopes.

Prerequisites

Change the replication factor of the system_auth and hcd_security keyspaces to 3 or 5, and then run a full repair on all nodes. This ensures role data is replicated to all nodes.
Use firewall rules to restrict public access to the cluster until you have created a new superuser role and dropped the default cassandra role.

Create a superuser role

Start a cqlsh session with the cassandra role, which you must use to create your first non-default superuser role:
```
cqlsh -u cassandra -p cassandra
```
Create a role with SUPERUSER, LOGIN, and PASSWORD options:
```
CREATE ROLE ROLE_NAME
    WITH SUPERUSER = true
    AND LOGIN = true
    WITH PASSWORD = 'ROLE_PASSWORD';
```
For complexity requirements, see Password requirements.

Store these credentials securely. If you lose these credentials, you cannot authenticate as the superuser role or reset the superuser role’s password.

Use LIST ROLES to verify that the role was created with the SUPERUSER option:

LIST ROLES;

The following example shows the default cassandra role and a role named root_user. Both have the SUPERUSER option enabled.

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}
           cassandra |  True |  True |        {}

(2 rows)

Exit cqlsh:
```
EXIT;
```

It isn’t necessary to grant ALL permissions to superuser roles. The SUPERUSER option inherently grants all permissions on all keyspaces.

Additionally, the RESTRICT command cannot limit superuser roles. The SUPERUSER option overrides RESTRICT.

Disable or drop the default `cassandra` role

Start a cqlsh session with your new superuser role:
```
cqlsh -u ROLE_NAME
```
When prompted, enter the password for your superuser role.
DROP or ALTER the cassandra role:
- DROP the cassandra role to delete it completely:
  DROP ROLE cassandra;
- ALTER the cassandra role to disable the SUPERUSER option, disable the LOGIN option, and change the PASSWORD:
  ALTER ROLE cassandra WITH SUPERUSER = false AND LOGIN = false AND PASSWORD='NEW_PASSWORD';
  Although the password isn’t relevant when LOGIN = false, it it is a good practice in case the LOGIN option is accidentally reenabled.

Verify that the cassandra role was dropped or altered:

LIST ROLES;

For example, if you dropped the cassandra role:

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}

(1 rows)

Or if you altered the cassandra role:

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}
           cassandra | False | False |        {}

(2 rows)

If you enabled firewall rules, you can modify those rules to allow external access to the cluster because the default cassandra credentials are no longer valid.

Reset the superuser password

You can change the password for your superuser role (or any other role) at any time, if you have the role’s current credentials:

Start a cqlsh session with your current superuser credentials.

Use ALTER USER to change the password.

ALTER USER ROLE_NAME WITH PASSWORD 'NEW_PASSWORD';

Exit cqlsh, and then start a new session with the new credentials.

Add a superuser role

Security and performance considerations for superuser roles

Prerequisites

Create a superuser role

Disable or drop the default `cassandra` role

Reset the superuser password

Was this helpful?

Give Feedback

Add a superuser role

Security and performance considerations for superuser roles

Prerequisites

Create a superuser role

Disable or drop the default cassandra role

Reset the superuser password

Was this helpful?

Disable or drop the default `cassandra` role