Control access to JMX MBeans
Many monitoring and administrative tools use Management Beans (MBeans) to perform actions on the Hyper-Converged Database (HCD) cluster.
When Java Management Extensions (JMX) authentication is enabled, non-superuser roles require access to MBeans on order to use nodetool
and other HCD utilities.
Additionally, access to MBeans may be required by third-party monitoring tools or other custom management utilities that interact with the database using JMX.
Many of the HCD utilities use the same or similar MBeans, therefore it can be difficult to create permission sets that limit the commands a user can run.
All nodetool commands require |
Access denied error when permission required
nodetool -u martin -pw password status
the request is denied.
nodetool: Failed to connect to '127.0.0.1:7199' - SecurityException: 'Access Denied'.
Create an MBean administrator role and grant permissions
-
Create an MBEAN administrator role:
-
Create an MBean administrator role:
CREATE ROLE mbean_admin;
-
Give the role access to all MBeans:
GRANT ALL PERMISSIONS on ALL MBEANS to mbean_admin;
-
Assign the role to a user or group role:
GRANT mbean_admin TO mike;
To get a complete list of MBeans, see Use
nodetool sjk
.
-
-
Minimal permission is required for a role to run
nodetool
commands:-
Login to
cqlsh
using asuperuser
account or a role that has full access to MBeans. -
Grant the non-superuser role
DESCRIBE
on all MBEANS:GRANT DESCRIBE ON ALL MBEANS TO martin;
-
Grant the role both
SELECT
andEXECUTE
permission on theStorage Service
MBEAN:GRANT SELECT, EXECUTE ON MBEAN 'org.apache.cassandra.db:type=StorageService' TO martin;
-
Grant the role
EXECUTE
on theEndpoint Snitch Information
MBean:GRANT EXECUTE ON MBEAN 'org.apache.cassandra.db:type=EndpointSnitchInfo' TO martin;
The role
martin
can execute the nodetool command.nodetool -u martin -pw password status
Datacenter: Cassandra ===================== Status=Up/Down |/ State=Normal/Leaving/Joining/Moving -- Address Load Tokens Owns Host ID Rack UN 10.10.100.12 67.45 MiB 1 ? 8234303e-1f0b-4ced-844b-48e1ccbce3e2 rack1 UN 10.10.100.30 776.03 KiB 1 ? ff96a036-a4e3-4257-8787-a66010919c36 rack2
-