Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (athena.apache.org: domain of mohitanchlia@gmail.com
 designates 209.85.160.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAP5HrRZgr+9QSEF=hpG1dqVH0zbASeLXxiTb_hcnVu2THr5h0g@mail.gmail.com>
References: <4EB9BBA8.9020902@gmail.com>
	<CAJHHpg10vSA0L_VLQWXZRMVEt95i2XcRqGB4zsi+th8YWDYtVw@mail.gmail.com>
	<CAP5HrRZgr+9QSEF=hpG1dqVH0zbASeLXxiTb_hcnVu2THr5h0g@mail.gmail.com>
Date: Wed, 9 Nov 2011 07:19:17 -0800
Message-ID: 
 <CAOT3TWr1TMvqxKK-erbnUPQ7QR+FSONcJ5Gpk_j2gZqd-cMs=w@mail.gmail.com>
Subject: Re: security
From: Mohit Anchlia <mohitanchlia@gmail.com>
To: user@cassandra.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

We lockdown ssh to root from any network. We also provide individual
logins including sysadmin and they go through LDAP authentication.
Anyone who does sudo su as root gets logged and alerted via trapsend.
We use firewalls and also have a separate vlan for datastore servers.
We then open only specific ports from our application servers to
datastore servers.

You should also look at Cassandra authentication as additional means
of securing your data.

On Wed, Nov 9, 2011 at 6:39 AM, Sasha Dolgy <sdolgy@gmail.com> wrote:
> Firewall with appropriate rules.
>
>> On Tue, Nov 8, 2011 at 6:30 PM, Guy Incognito <dnd1066@gmail.com> wrote:
>>>
>>> hi,
>>>
>>> is there a standard approach to securing cassandra eg within a corporat=
e
>>> network? =A0at the moment in our dev environment, anybody with network
>>> connectivity to the cluster can connect to it and mess with it. =A0this=
 would
>>> not be acceptable in prod. =A0do people generally write custom authenti=
cators
>>> etc, or just put the cluster behind a firewall with the appropriate rul=
es to
>>> limit access?
>