Add a superuser login

After enabling role-based access control, create your own superuser account and disable or drop the default cassandra account. Roles created with the superuser option have full access to the database; users with the superuser role can run any CQL commands on all database resources.

Prerequisites

Isolate the HCD cluster and enable RBAC, see Set up logins and users.

Procedure

Create a new superuser account with password stored in the CQL database:

CREATE ROLE <root_user_name>
  WITH SUPERUSER = true
  AND LOGIN = true
  AND PASSWORD = '<password>';

or create the new superuser account with a hashed password:

CREATE ROLE <root_user_name>
  WITH SUPERUSER = true
  AND LOGIN = true
  AND HASHED PASSWORD = '<hashed_password>';

Exit cqlsh:
```
EXIT;
```
To disable or drop the cassandra role, log in with the new role created in the previous step:
```
cqlsh -u <root_user>
```
Enter the password at the prompt.

Verify that the role was created as a superuser using LIST ROLES:

LIST ROLES;

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}
           cassandra |  True |  True |        {}
(2 rows)

Drop or update the cassandra account:
- Drop the cassandra account:
  DROP ROLE cassandra;
- Update the cassandra role by disabling superuser and changing the password:
  ALTER ROLE cassandra WITH SUPERUSER = false AND LOGIN = false AND PASSWORD='new_secret_pw';
  or with a hashed password:
  ALTER ROLE cassandra WITH SUPERUSER = false AND LOGIN = false AND HASHED PASSWORD='$2a$10$4N5j5py12OySiSy9L2RHduOjFFetJ1d9hqCoZYtQC3kJOwdg3hbOC';
DataStax recommends dropping the account to secure the database in production environments. When using an external authentication method, such as LDAP, this prevents accidentally assignment with elevated privileges.

Verify that the cassandra role was deleted:

LIST ROLES;

Only the roles created in these steps display:

 role                | super | login | options
---------------------+-------+-------+---------
           root_user |  True |  True |        {}

(1 rows)

Reopen the firewall to support production CQL traffic.

Next steps

Set up roles that map to the user or group names for the configured authentication schemes:

Add database users

Add a superuser login

Prerequisites

Procedure

Next steps

Was this helpful?

Give Feedback