Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (athena.apache.org: domain of dnd1066@gmail.com designates
 74.125.82.172 as permitted sender)
Message-ID: <4EBAD4A6.7080709@gmail.com>
Date: Wed, 09 Nov 2011 19:29:42 +0000
From: Guy Incognito <dnd1066@gmail.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:8.0) Gecko/20111105 Thunderbird/8.0
MIME-Version: 1.0
To: user@cassandra.apache.org
Subject: Re: security
References: <4EB9BBA8.9020902@gmail.com>
 <CAJHHpg10vSA0L_VLQWXZRMVEt95i2XcRqGB4zsi+th8YWDYtVw@mail.gmail.com>
 <CAP5HrRZgr+9QSEF=hpG1dqVH0zbASeLXxiTb_hcnVu2THr5h0g@mail.gmail.com>
 <CAOT3TWr1TMvqxKK-erbnUPQ7QR+FSONcJ5Gpk_j2gZqd-cMs=w@mail.gmail.com>
In-Reply-To: 
 <CAOT3TWr1TMvqxKK-erbnUPQ7QR+FSONcJ5Gpk_j2gZqd-cMs=w@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

ok, thx for the input!

On 09/11/2011 15:19, Mohit Anchlia wrote:
> We lockdown ssh to root from any network. We also provide individual
> logins including sysadmin and they go through LDAP authentication.
> Anyone who does sudo su as root gets logged and alerted via trapsend.
> We use firewalls and also have a separate vlan for datastore servers.
> We then open only specific ports from our application servers to
> datastore servers.
>
> You should also look at Cassandra authentication as additional means
> of securing your data.
>
> On Wed, Nov 9, 2011 at 6:39 AM, Sasha Dolgy<sdolgy@gmail.com>  wrote:
>> Firewall with appropriate rules.
>>
>>> On Tue, Nov 8, 2011 at 6:30 PM, Guy Incognito<dnd1066@gmail.com>  wrote:
>>>> hi,
>>>>
>>>> is there a standard approach to securing cassandra eg within a corporate
>>>> network?  at the moment in our dev environment, anybody with network
>>>> connectivity to the cluster can connect to it and mess with it.  this would
>>>> not be acceptable in prod.  do people generally write custom authenticators
>>>> etc, or just put the cluster behind a firewall with the appropriate rules to
>>>> limit access?