密码认证器
默认的认证器是 org.apache.cassandra.auth.AllowAllAuthenticator。如果想要求客户端提供凭证，Cassandra提供另一种选择 org.apache.cassandra.auth.PasswordAuthenticatot
配置认证器
默认登录cqlsh不需要密码，修改cassandra.yaml 修改
# authenticator: AllowAllAuthenticator authenticator: PasswordAuthenticator
Cassandra2.2或以后的版本，会看到使用 PasswordAuthenticator必须使用CassandraRoleManager，是Cassandra授权功能的一部分。
增加用户
修改之后登录提示需要账号密码，默认账号密码都是 cassandra
[[email protected] bin]$ ./cqlsh node2
Connection error: (‘Unable to connect to any servers‘, {‘192.168.56.12‘: AuthenticationFailed(‘Remote end requires authentication.‘,)})
[[email protected] bin]$ ./cqlsh node2 -u cassandra -p cassandra
Connected to Cluster01 at node2:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]>
修改cassandra账号的密码：
[email protected]> alter user cassandra with password ‘[email protected]‘;
[email protected]> quit
[[email protected] bin]$ ./cqlsh node2 -u cassandra -p cassandra
Connection error: (‘Unable to connect to any servers‘, {‘192.168.56.12‘: AuthenticationFailed(‘Failed to authenticate to 192.168.56.12: Error from server: code=0100 [Bad credentials] message="Provided username cassandra and/or password are incorrect"‘,)})
[[email protected] bin]$ ./cqlsh node2 -u cassandra -p [email protected]123
Connected to Cluster01 at node2:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]>
创建账号：
[[email protected] bin]$ ./cqlsh node2 -u cassandra -p [email protected]123
Connected to Cluster01 at node2:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]>
[email protected]> list users;
name | super
-----------+-------
cassandra | True
(1 rows)
[email protected]> create user cass with password ‘[email protected]‘;
[email protected]>
[email protected]> list users;
name | super
-----------+-------
cass | False
cassandra | True
(2 rows)
[email protected]>
配置自动登录，为了避免每次登录cqlsh都需要输入账号密码，可以在家目录中创建文件 .cqlshrc
[[email protected] ~]$ ls -al
total 24
drwx------. 3 cassandra cassandra 117 Feb 11 04:59 .
drwxr-xr-x. 3 root root 23 Feb 4 03:24 ..
-rw-------. 1 cassandra cassandra 8074 Feb 11 01:17 .bash_history
-rw-r--r--. 1 cassandra cassandra 18 Aug 8 2019 .bash_logout
-rw-r--r--. 1 cassandra cassandra 193 Aug 8 2019 .bash_profile
-rw-r--r--. 1 cassandra cassandra 231 Aug 8 2019 .bashrc
drwxrwxr-x. 2 cassandra cassandra 51 Feb 11 04:59 .cassandra
-rw-rw-r--. 1 cassandra cassandra 58 Feb 11 04:57 .cqlshrc
[[email protected] ~]$ cat .cqlshrc
[authentication]
username = cassandra
password = [email protected]123
[[email protected] ~]$ cd /data/cass/bin
[[email protected] bin]$ ./cqlsh
Connection error: (‘Unable to connect to any servers‘, {‘127.0.0.1‘: error(111, "Tried connecting to [(‘127.0.0.1‘, 9042)]. Last error: Connection refused")})
[[email protected] bin]$ ./cqlsh node2
Connected to Cluster01 at node2:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]>quit
[[email protected] bin]$ cd
[[email protected] ~]$ ls -al
total 20
drwx------. 3 cassandra cassandra 101 Feb 11 04:59 .
drwxr-xr-x. 3 root root 23 Feb 4 03:24 ..
-rw-------. 1 cassandra cassandra 8074 Feb 11 01:17 .bash_history
-rw-r--r--. 1 cassandra cassandra 18 Aug 8 2019 .bash_logout
-rw-r--r--. 1 cassandra cassandra 193 Aug 8 2019 .bash_profile
-rw-r--r--. 1 cassandra cassandra 231 Aug 8 2019 .bashrc
drwxrwxr-x. 2 cassandra cassandra 66 Feb 11 04:59 .cassandra
[[email protected] ~]$ cd .cassandra/
[[email protected] .cassandra]$ ll
total 16
-rw-------. 1 cassandra cassandra 3978 Feb 11 04:59 cqlsh_history
-rw-rw-r--. 1 cassandra cassandra 58 Feb 11 04:57 cqlshrc
-rw-rw-r--. 1 cassandra cassandra 5833 Feb 10 22:00 nodetool.history
[[email protected] .cassandra]$ cat cqlshrc
[authentication]
username = cassandra
password = [email protected]123
切换账号无需退出重新登录，执行时可以不加密码，在命令行输入。用户家目录下面 .cassandra/cqlsh_history 文件中会记录所有命令行上输入的内容
[[email protected] bin]$ ./cqlsh node3
Connected to Cluster01 at node3:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]>
[email protected]> list users;
name | super
-----------+-------
cass | False
cassandra | True
(2 rows)
[email protected]> login cass ‘[email protected]‘;
[email protected]>
修改账号密码，删除账号
[email protected]> alter user cass with password ‘[email protected]‘; [email protected]> login cass ‘[email protected]‘; [email protected]> login cassandra ‘[email protected]‘; [email protected]> drop user cass; [email protected]> list users; name | super -----------+------- cassandra | True (1 rows)
使用CassandraAuthorizer
通过授权器，授权用户访问集群中的键和表。 默认授权器 org.apache.cassandra.auth.AllowAllAuthorizer。
关闭集群，配置脚本 bin/stop-server
echo "Cassandra is shutting down"
user=`whoami`
pgrep -u $user -f cassandra | xargs kill -9
if ps -ef|grep cassandra|grep -v grep|grep java; then
echo "Cassandra shutdown failed"
else
echo "Cassandra closed"
fi
修改cassandra.yaml
# authorizer: AllowAllAuthorizer authorizer: CassandraAuthorizer
普通用户登录查看keyspace和table没有权限
[[email protected] bin]$ ./cqlsh node2
Connected to Cluster01 at node2:9042.
[cqlsh 5.0.1 | Cassandra 3.11.5 | CQL spec 3.4.4 | Native protocol v4]
Use HELP for help.
[email protected]> desc keyspaces;
system_schema system system_distributed test01
system_auth keyspace1 system_traces
[email protected]> list users;
name | super
-----------+-------
cass | False
cassandra | True
(2 rows)
[email protected]> login cass;
Password:
[email protected]> desc keyspaces;
system_schema system system_distributed test01
system_auth keyspace1 system_traces
SyntaxException: line 1:0 no viable alternative at input ‘ues‘ ([ues]...)
[email protected]> use test01;
[email protected]:test01> desc tables;
test01
[email protected]:test01> select * from test01;
Unauthorized: Error from server: code=2100 [Unauthorized] message="User cass has no SELECT permission on <table test01.test01> or any of its parents"
[email protected]:test01>
通过grant命令给用户赋予权限
[email protected]> grant select on test01.test01 to cass; [email protected]> login cass; Password: [email protected]> use test01; [email protected]:test01> select * from test01; key | C0 | C1 | C2 | C3 | C4 -----+----+----+----+----+---- (0 rows)
基于角色的访问控制
Cassandra提供一种基于角色的访问控制(role-based access control, RBAC)功能。创建角色，给角色赋予权限，给用户赋予角色的权限。
[email protected]:test01> list roles;
role | super | login | options
-----------+-------+-------+---------
cass | False | True | {}
cassandra | True | True | {}
(2 rows)
[email protected]:test01> create role dev;
[email protected]:test01> grant all on keyspace test to dev;
InvalidRequest: Error from server: code=2200 [Invalid query] message="Resource <keyspace test> doesn‘t exist"
[email protected]:test01> grant all on keyspace test01 to dev;
[email protected]:test01>
[email protected]:test01> drop user cass;
[email protected]:test01> create user cass with password ‘[email protected]‘;
[email protected]:test01> login cass
Password:
[email protected]:test01> select * from test01.test01;
Unauthorized: Error from server: code=2100 [Unauthorized] message="User cass has no SELECT permission on <table test01.test01> or any of its parents"
[email protected]:test01> login cassandra
Password:
[email protected]:test01> grant dev to cass;
[email protected]:test01> login cass
Password:
[email protected]:test01> select * from test01.test01;
key | C0 | C1 | C2 | C3 | C4
-----+----+----+----+----+----
(0 rows)
Cassandra中角色是可加的，这表示，如果授权一个用户的任意一个角色有某个特定的权限，那么这个用户就会授权这个权限。
在后台Cassandra把用户和角色存储在system_auth 键空间。如果为集群配置的授权，那么只有管理员用户可以访问这个键空间，所以使用管理员用户登录cqlsh来检查这个键空间内容；
[email protected]:system> use system_auth;
[email protected]:system_auth> desc tables;
resource_role_permissons_index role_permissions role_members roles
[email protected]:system_auth>
[email protected]:system_auth> select * from role_members;
role | member
------+--------
dev | cass
(1 rows)
[email protected]:system_auth> select * from role_permissions;
role | resource | permissions
------+-------------+--------------------------------------------------------------
dev | data/test01 | {‘ALTER‘, ‘AUTHORIZE‘, ‘CREATE‘, ‘DROP‘, ‘MODIFY‘, ‘SELECT‘}
(1 rows)
cassandra[email protected]:system_auth> select * from resource_role_permissons_index;
resource | role
-----------+-----------
roles/dev | cassandra
(1 rows)
[email protected]:system_auth> select * from roles;
role | can_login | is_superuser | member_of | salted_hash
-----------+-----------+--------------+-----------+--------------------------------------------------------------
cassandra | True | True | null | $2a$10$6q2SqzrdcARz6qGcLj7DreKWAnQjJT653r4acBAJlHWzQW/e/4SQm
cass | True | False | {‘dev‘} | $2a$10$Z/KpRFIkmhQ6uEn45eDa4eyymaj/sty6LN1MDBfZdrxZwHnMI8ow2
dev | False | False | null | null
(3 rows)
实际上并没有一个单独的数据库级用户的概念，Cassandra使用角色概念来耿总用户以及角色。
改变system_auth 副本因子
需要指出重要的一点，system_auth键空间默认配置为使用SimpleStrategy，副本因子为1.
这说明默认情况下，我们配置的任何用户，角色和权限不会再集群上分布存储，除非我们重新配置system_auth键空间 的复制策略，使之与我们的集群拓扑一致。
加密
从3.0版本开始，Cassandra通过客户端与服务器(节点)间的加密以及节点间的加密来保护数据的安全。Cassandra3.0以后，只有DataStax企业版的Cassandra才支持数据文件(静态数据)加密。
数据文件加密路线图
有很多Cassandra JIRA请求都说针对提供加密特性的3.x版本系列。
提示的加密： https://issues.apache.org/jira/browse/CASSANDRA-11040
提交日志的加密： https://issues.apache.org/jira/browse/CASSANDRA-6018
原文地址：https://www.cnblogs.com/yuxiaohao/p/12298938.html
时间： 2024-11-15 13:27:43