Phase 8: Security, Internode TLS Encryption & Enterprise RBAC¶
Audience: Principal Security Architect & Distributed Infrastructure Specialist
Source References:src/java/org/apache/cassandra/auth/,src/java/org/apache/cassandra/security/
1. Network Encryption Architecture: Client vs. Internode¶
Cassandra separates external client queries from internal cluster gossip and data streaming:
┌────────────────────────────────────────────────────────────────────────┐
│ Client-to-Node Encryption (Port 9042: CQL Native Protocol) │
├────────────────────────────────────────────────────────────────────────┤
│ - Encrypts data over the wire from application microservices │
│ - Configured via client_encryption_options │
│ - Supports TLS v1.3, mTLS (Client Certificate Authentication) │
└────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────┐
│ Internode Encryption (Port 7001: Storage & Gossip Bus) │
├────────────────────────────────────────────────────────────────────────┤
│ - Encrypts peer-to-peer data replication and gossip heartbeats │
│ - Mandatory for multi-datacenter clusters spanning public WAN links │
│ - Configured via server_encryption_options │
│ - Modes: all (encrypts all nodes) or dc (encrypts cross-DC traffic) │
└────────────────────────────────────────────────────────────────────────┘
1.1 Enterprise cassandra.yaml Encryption Configuration¶
# Internode Encryption (Between Nodes)
server_encryption_options:
internode_encryption: all
keystore: /etc/cassandra/conf/internode-keystore.p12
keystore_password_type: custom
keystore_password: "SecretKeystorePassword"
truststore: /etc/cassandra/conf/internode-truststore.p12
truststore_password: "SecretTruststorePassword"
protocol: TLSv1.3
algorithm: SunX509
require_client_auth: true # Enforce mTLS between nodes
# Client-to-Node Encryption (Application Clients)
client_encryption_options:
enabled: true
optional: false # Reject unencrypted plaintext connections
keystore: /etc/cassandra/conf/client-keystore.p12
keystore_password: "ClientKeystorePassword"
protocol: TLSv1.3
2. Authentication & Role-Based Access Control (RBAC)¶
By default, Cassandra ships with AllowAllAuthenticator, permitting anyone to read and write without authentication. In production, this must be replaced:
authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer
role_manager: CassandraRoleManager
permissions_validity_in_ms: 2000 # Cache permissions in RAM to avoid constant auth reads
2.1 Managing Enterprise Roles & Least Privilege¶
-- 1. Create Application Role with Strong Password
CREATE ROLE order_service WITH PASSWORD = 'ProductionStrongPassword#2026'
AND LOGIN = true
AND SUPERUSER = false;
-- 2. Grant Least-Privilege Permissions on Specific Keyspace & Tables
GRANT USAGE ON KEYSPACE ecommerce TO order_service;
GRANT SELECT, MODIFY ON TABLE ecommerce.orders TO order_service;
GRANT SELECT ON TABLE ecommerce.inventory TO order_service;
-- 3. Verify Effective Role Permissions
LIST ALL PERMISSIONS OF order_service;
3. Transparent Data Encryption (TDE) at Rest¶
To comply with HIPAA, PCI-DSS, or GDPR, Cassandra can encrypt SSTables and CommitLogs on disk using native AES-256:
# Transparent SSTable Encryption
transparent_data_encryption_options:
enabled: true
chunk_length_kb: 64
cipher: AES/CBC/PKCS5Padding
key_alias: cassandra_storage_key
key_provider:
- class_name: org.apache.cassandra.security.FileBasedKeyProviderFactory
parameters:
key_file: /etc/cassandra/conf/storage-encryption.key