STIGQter: STIG Summary: vRealize - Cassandra Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be restricted to authorized users.

DISA Rule

SV-87283r1_rule

Vulnerability Number

V-72651

Group Title

SRG-APP-000133-DB-000362

Rule Version

VROM-CS-000110

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Configure the Cassandra Server to restrict the role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) to authorized users.

At the command line execute the following command:

# chown root <file>

Replace <file> with the files that are not owned by either "admin" or "root".

Check Contents

Review the Cassandra Server settings to ensure the role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) are restricted to authorized users.

At the command prompt, execute the following command:

# find /usr/lib/vmware-vcops/cassandra -type f ! \( -user admin -o -user root \)

If any files are listed that are not owned by either "admin" or "root", this is a finding.

Vulnerability Number

V-72651

Documentable

False

Rule Version

VROM-CS-000110

Severity Override Guidance

Review the Cassandra Server settings to ensure the role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) are restricted to authorized users.

At the command prompt, execute the following command:

# find /usr/lib/vmware-vcops/cassandra -type f ! \( -user admin -o -user root \)

If any files are listed that are not owned by either "admin" or "root", this is a finding.

Check Content Reference

M

Target Key

3179

Comments