Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id E5E6C200CCF for ; Mon, 10 Jul 2017 01:59:05 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id E449C167C80; Sun, 9 Jul 2017 23:59:05 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 0D7B6167C7C for ; Mon, 10 Jul 2017 01:59:04 +0200 (CEST) Received: (qmail 77885 invoked by uid 500); 9 Jul 2017 23:59:03 -0000 Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@cassandra.apache.org Delivered-To: mailing list user@cassandra.apache.org Received: (qmail 77875 invoked by uid 99); 9 Jul 2017 23:59:03 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 09 Jul 2017 23:59:03 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id C946218580E for ; Sun, 9 Jul 2017 23:59:02 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 1.789 X-Spam-Level: * X-Spam-Status: No, score=1.789 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=2, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=disabled Authentication-Results: spamd3-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=instaclustr-com.20150623.gappssmtp.com Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id 2bfs2Y_7xGNW for ; Sun, 9 Jul 2017 23:58:56 +0000 (UTC) Received: from mail-it0-f50.google.com (mail-it0-f50.google.com [209.85.214.50]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTPS id D5E8A623E4 for ; Sun, 9 Jul 2017 23:40:04 +0000 (UTC) Received: by mail-it0-f50.google.com with SMTP id k192so22774774ith.1 for ; Sun, 09 Jul 2017 16:40:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=instaclustr-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qGprKK0p6+eiZLObGcM0dQITFFHMSTZsnNzIjwqCiwM=; b=fK4txXCGVJtssA5lxLkZouLdK3UmIWoEge9pv/fp5XUmbYKpGzgIw6bUqqvhYm87pc LND9yeeep+WwDzxrY5LBrForJXby34wYODyTcgky71dArx9Ks8vFv3jhXbbTb9JhsNM7 /9jm8z7HLiSvOw7EH1QqUat04bSy5FX7XDyrR0VMgw/JEucGO6pJHHKe1zPRSNxuCwbI ZKxmHmQ77NxHMoB/bCnQqmKmLtmGJf5krm343qAHQQw61l+dPHGwaw0LC+J9pZIVjC9Q aw/2F91tNZydbwOtFVsNn1IKZHtI+BWbmH4n/TV5HB0HKB+kwt+4AxcIIlQqah7JdNWk /n5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qGprKK0p6+eiZLObGcM0dQITFFHMSTZsnNzIjwqCiwM=; b=NUHvkyHMM3mcFZ8QcFv80PNfoEc2sNcALnZTDFO55etE709U0KPEfZQwkwaGp4gwmJ XlyVzXDqIdbiTX+eRul5X2LNrc6FgKyod3Pyh0YJxRsNp8Es1UCXijLaJTsp6wnE32D+ l4OGaFsZm8CHJeTvhOMVcv52vBdE4fQ4JlixH3ZC6J7CXls5OMplRLrjT2zXdB6o4Yys f/I+xHM0emuqkGlG4PSrzZkcr1ujog1MIUupT18zrq/Rf1IlFfAU0W6RaHAYhxkasIgi FHQNMRBLAShq7Gr0B09t7y8+JOuaQPeYUGPpGNE+R+3Byr5EdA2Vgnmp7/baY3KJ+l1c Lj8w== X-Gm-Message-State: AIVw112AiWnb2tGO93Amyp+jGMdDFEjPvH4r6ZLAPNjeoxNG0YfNA5cC uER46KglEB62Nk0l6q8QC375EUHz3QW8DuU= X-Received: by 10.107.10.168 with SMTP id 40mr958157iok.210.1499643603222; Sun, 09 Jul 2017 16:40:03 -0700 (PDT) MIME-Version: 1.0 References: <2017061415110873550525@zjqunshuo.com> <2017061416460359144628@zjqunshuo.com> <2017061417162383413533@zjqunshuo.com> In-Reply-To: From: Justin Cameron Date: Sun, 09 Jul 2017 23:39:52 +0000 Message-ID: Subject: Re: Cannot achieve consistency level LOCAL_ONE To: user@cassandra.apache.org, "Charulata Sharma (charshar)" Cc: "wxn002@zjqunshuo.com" Content-Type: multipart/alternative; boundary="001a113f96fe42bb120553eafcf1" archived-at: Sun, 09 Jul 2017 23:59:06 -0000 --001a113f96fe42bb120553eafcf1 Content-Type: text/plain; charset="UTF-8" It's best-practice to disable the default user ("cassandra" user) after enabling password authentication on your cluster. The default user reads with a CL.QUORUM when authenticating, while other users use CL.LOCAL_ONE. This means it's more likely you could experience authentication issues, even if you increase the replication factor of your system_auth keyspace. See the docs for more info: http://cassandra.apache.org/doc/latest/operating/security.html#enabling-password-authentication Also, accessing Cassandra via a load-balancer is considered an anti-pattern. The Cassandra drivers load-balance requests to the cluster transparently, so the only thing you get by adding a load balancer to the mix is potentially increased query latency. Cheers, Justin On Fri, 7 Jul 2017 at 21:42 Oleksandr Shulgin wrote: > On Thu, Jul 6, 2017 at 6:58 PM, Charulata Sharma (charshar) < > charshar@cisco.com> wrote: > >> Hi, >> >> I am facing similar issues with SYSTEM_AUTH keyspace and wanted to know >> the implication of disabling the "*cassandra*" superuser. >> > > Unless you have scheduled any tasks that require the user with that name > to be there, there are no implications. This user is not used by Cassandra > tools or the server process internally, so nothing really depends on it. > > Of course, in order to drop a superuser account, you need to create > another superuser, so in the end you still have superuser access to your > cluster. > > Cheers, > -- > Alex > > -- *Justin Cameron*Senior Software Engineer This email has been sent on behalf of Instaclustr Pty. Limited (Australia) and Instaclustr Inc (USA). This email and any attachments may contain confidential and legally privileged information. If you are not the intended recipient, do not copy or disclose its content, but please reply to this email immediately and highlight the error to the sender and then immediately delete the message. --001a113f96fe42bb120553eafcf1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It's best-practice to disable the default user ("= cassandra" user) after enabling password authentication on your cluste= r. The default user reads with a CL.QUORUM when authenticating, while other= users use CL.LOCAL_ONE. This means it's more likely you could experien= ce authentication issues, even if you increase the replication factor of yo= ur system_auth keyspace.

A= lso, accessing Cassandra via a load-balancer is considered an anti-pattern.= The Cassandra drivers load-balance requests to the cluster transparently, = so the only thing you get by adding a load balancer to the mix is potential= ly increased query latency.

Cheers,
Just= in


On Fri, 7 Jul 2017 at 21:42 Oleksandr Shulgin <oleksandr.shulgin@zalando.de> wrote:
On Thu, Jul 6, 2017 at 6:58 PM, Charulata Sha= rma (charshar) <charshar@cisco.com> wrote:
Hi,
=C2=A0 =C2=A0 =C2=A0
I am facing similar issues with SYSTEM_AUTH keyspace and wanted to kno= w the implication of disabling the "cassandra" superuser.<= /div>

Unless you = have scheduled any tasks that require the user with that name to be there, = there are no implications.=C2=A0 This user is not used by Cassandra tools o= r the server process internally, so nothing really depends on it.

Of course, in order to drop a superuser account, you need t= o create another superuser, so in the end you still have superuser access t= o your cluster.

Cheers,
--
Ale= x

--

Justin Cameron
Senior Software= Engineer



This email has= been sent on behalf of=C2=A0Instaclustr Pty. Limited (Australia) and=C2=A0= Instaclustr Inc (USA).

= This email and any attachments may=C2=A0contain co= nfidential and legally privileged=C2=A0information.=C2=A0 If you are not th= e intended=C2=A0recipient, do not copy or disclose its=C2=A0content, but pl= ease reply to this email=C2=A0immediately and highlight the error to the=C2= =A0sender and then immediately delete the=C2=A0message.

--001a113f96fe42bb120553eafcf1--