Configure CIDR authorization

CIDR authorization restricts which IP addresses can connect to Hyper-Converged Database (HCD) by mapping roles to allowed IP ranges. Connections from IP addresses outside a role’s authorized CIDR groups are blocked or logged, depending on the configured mode.

HCD stores CIDR group definitions in the system_auth.cidr_groups table and evaluates them on every connection.

Modes

CassandraCIDRAuthorizer operates in two modes:

MONITOR: CIDR checks are not enforced. Connections from unauthorized CIDR groups are logged at WARN level but allowed. Authorized connections are logged at INFO level. Log messages are throttled to one per minute per role. Use this mode to validate your CIDR group configuration before enforcing it. This is the default mode.
ENFORCE: Connections from unauthorized CIDR groups are rejected.

Enable CIDR authorization

Locate the cassandra.yaml configuration file.

The location of the cassandra.yaml file depends on your installation type:
- Package installations: /etc/hcd/cassandra/cassandra.yaml
- Tarball installations: INSTALL_DIRECTORY/resources/cassandra/conf/cassandra.yaml
Set the cidr_authorizer to CassandraCIDRAuthorizer:
```
cidr_authorizer:
  class_name: CassandraCIDRAuthorizer
  parameters:
    cidr_authorizer_mode: ENFORCE
```
cidr_authorizer_mode

The enforcement mode. Set to MONITOR to log unauthorized connections without blocking them, or ENFORCE to block them. Default: MONITOR.

cidr_checks_for_superusers

Whether CIDR checks also apply to superuser roles. Default: false.

cidr_groups_cache_refresh_interval

How often, in minutes, HCD refreshes the CIDR groups cache from the system_auth.cidr_groups table. Default: 5.

ip_cache_max_size

Maximum number of entries in the IP-to-CIDR-groups cache. Default: 100.
Complete a rolling restart.

Define CIDR groups

Before assigning CIDR groups to roles, define them in the system_auth.cidr_groups table. Each CIDR group maps a name to one or more IP ranges expressed as (ip_address, prefix_length) tuples.

INSERT INTO system_auth.cidr_groups (cidr_group, cidrs)
VALUES ('CIDR_GROUP_NAME', {('IP_ADDRESS', PREFIX_LENGTH)});

Replace the following:

CIDR_GROUP_NAME: A name for the CIDR group. For example, office_network.
IP_ADDRESS: The network address. For example, 192.168.1.0.
PREFIX_LENGTH: The prefix length. For example, 24 for a /24 subnet.

To include multiple IP ranges in one group, add them as additional tuples in the set:

INSERT INTO system_auth.cidr_groups (cidr_group, cidrs)
VALUES ('office_network', {('192.168.1.0', 24), ('10.0.0.0', 8)});

Restrict roles by CIDR group

After defining CIDR groups, assign them to a role using the ACCESS FROM CIDRS option in CREATE ROLE or ALTER ROLE.

CREATE ROLE ROLE_NAME WITH ACCESS FROM CIDRS {'CIDR_GROUP_NAME'};

ALTER ROLE ROLE_NAME WITH ACCESS FROM CIDRS {'CIDR_GROUP_NAME'};

Replace the following:

ROLE_NAME: The role to restrict.
CIDR_GROUP_NAME: The name of the CIDR group that defines the allowed IP ranges. You can specify multiple groups as a comma-separated list within the set. For example, {'office_network', 'vpn_range'}.

CIDR authorization applies to non-superuser roles by default. To also check superuser roles, set cidr_checks_for_superusers: true in cassandra.yaml. CIDR checks are not performed for JMX connections.

To allow the role to connect from any IP address, removing all CIDR restrictions:

ALTER ROLE ROLE_NAME WITH ACCESS FROM ALL CIDRS;

Configure CIDR authorization

Modes

Enable CIDR authorization

Define CIDR groups

Restrict roles by CIDR group

See also

Was this helpful?

Give Feedback