Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
MIME-Version: 1.0
From: Raimund Klein <chessray77@gmail.com>
Date: Sun, 30 Oct 2016 18:11:55 +0000
Message-ID: <CAFx9sfP--_NsESnMs3KLBiW_B11zby4VNxvCH9k43qzRzJJmYw@mail.gmail.com>
Subject: Securing a Cassandra 2.2.6 Cluster
To: user@cassandra.apache.org
Content-Type: multipart/alternative; boundary=001a114b36080519f205401908cb
archived-at: Sun, 30 Oct 2016 18:12:22 -0000

--001a114b36080519f205401908cb
Content-Type: text/plain; charset=UTF-8

Hi everyone,

We've managed to set up a Cassandra 2.2.6 cluster of two physical nodes
(nodetool sees both of them, so I'm quite certain the cluster is indeed
active). My steps to create the cluster were (this applies to both
machines):

 - Empty listen_address and rpc_address.
 - Define a cluster_name.
 - Define both machines as seeds.
 - Open ports 9042, 7000 and 7001 for external communication.


Now I want to secure access to the cluster in all forms:

 - define a different database user with a new password
 - encrypt communication bet ween clients and the cluster including client
verification
 - encrypt communication between the nodes including verification

What is the best order of steps and correct way to achieve this? I wanted
to start with defining a different user, but cqlsh refuses to connect after
enforcing user/password authentication:

cqlsh -u cassandra -p cassandra
Connection error: ('Unable to connect to any servers', {'127.0.0.1':
error(111, "Tried connecting to [('127.0.0.1', 9042)]. Last error:
Connection refused")})


This happens when I run the command on either of the two machines. Any help
would be greatly appreciated.

--001a114b36080519f205401908cb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi everyone,</div><div>=C2=A0</div><div>We&#39;ve man=
aged to set up a Cassandra 2.2.6 cluster of two physical nodes (nodetool se=
es both of them, so I&#39;m quite certain the cluster is indeed active). My=
 steps to create the cluster were (this applies to both machines):</div><di=
v><br></div><div>=C2=A0- Empty <font face=3D"monospace, monospace">listen_a=
ddress</font> and <font face=3D"monospace, monospace">rpc_address</font>.</=
div><div>=C2=A0- Define a <font face=3D"monospace, monospace">cluster_name<=
/font>.</div><div>=C2=A0- Define both machines as <font face=3D"monospace, =
monospace">seeds</font>.</div><div>=C2=A0- Open ports 9042, 7000 and 7001 f=
or external communication.</div><div><br></div><div>=C2=A0</div><div><br></=
div><div>Now I want to secure access to the cluster in all forms:</div><div=
><br></div><div>=C2=A0- define a different database user with a new passwor=
d</div><div>=C2=A0- encrypt communication bet ween clients and the cluster =
including client verification</div><div>=C2=A0- encrypt communication betwe=
en the nodes including verification</div><div><br></div><div>What is the be=
st order of steps and correct way to achieve this? I wanted to start with d=
efining a different user, but cqlsh refuses to connect after enforcing user=
/password authentication:</div><div><br></div><div><font face=3D"monospace,=
 monospace">cqlsh -u cassandra -p cassandra</font></div><div><font face=3D"=
monospace, monospace">Connection error: (&#39;Unable to connect to any serv=
ers&#39;, {&#39;127.0.0.1&#39;: error(111, &quot;Tried connecting to [(&#39=
;127.0.0.1&#39;, 9042)]. Last error: Connection refused&quot;)})</font></di=
v><div><br></div><div>=C2=A0</div><div><br></div><div>This happens when I r=
un the command on either of the two machines. Any help would be greatly app=
reciated.</div><div><br></div></div>

--001a114b36080519f205401908cb--