Date
1 - 8 of 8
JMX authentication for cassandra
Vinayak Bali
Hi All, There is a requirement to enable the JMX authentication of Cassandra. The steps followed are as follows: 1. cd /home/user1/janusgraph-full-0.5.2/conf/cassandra 2. vi cassandra-env.sh 3. original : LOCAL_JMX=yes if [ "$LOCAL_JMX" = "yes" ]; then JVM_OPTS="$JVM_OPTS -Dcassandra.jmx.local.port=$JMX_PORT -XX:+DisableExplicitGC" else JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.rmi.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=false" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=/path/to/keystore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=<keystore-password>" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=/path/to/truststore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=<truststore-password>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=<enabled-protocols>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=<enabled-cipher-suites>" fi Updated: LOCAL_JMX=yes if [ "$LOCAL_JMX" = "no" ]; then JVM_OPTS="$JVM_OPTS -Dcassandra.jmx.local.port=$JMX_PORT -XX:+DisableExplicitGC" else JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.rmi.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=false" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=/path/to/keystore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=<keystore-password>" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=/path/to/truststore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=<truststore-password>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=<enabled-protocols>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=<enabled-cipher-suites>" fi When I try to restart the service using command getting an error. /home/user1/janusgraph-full-0.5.2/bin/janusgraph start Forking Cassandra... Running `nodetool statusthrift`........................ timeout exceeded (60 seconds) See /home/fusionops/janusgraph-full-0.5.2/bin/../logs/cassandra.log for Cassandra log output. bin/nodetool status SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/home/fusionops/janusgraph-full-0.5.2/lib/slf4j-log4j12-1.7.12.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/home/fusionops/janusgraph-full-0.5.2/lib/logback-classic-1.1.3.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory] error: Authentication failed! Credentials required -- StackTrace -- java.lang.SecurityException: Authentication failed! Credentials required at com.sun.jmx.remote.security.JMXPluggableAuthenticator.authenticationFailure(JMXPluggableAuthenticator.java:211) at com.sun.jmx.remote.security.JMXPluggableAuthenticator.authenticate(JMXPluggableAuthenticator.java:163) at org.apache.cassandra.utils.JMXServerUtils$JMXPluggableAuthenticatorWrapper.authenticate(JMXServerUtils.java:279) at javax.management.remote.rmi.RMIServerImpl.doNewClient(RMIServerImpl.java:232) at javax.management.remote.rmi.RMIServerImpl.newClient(RMIServerImpl.java:199) at javax.management.remote.rmi.RMIJRMPServerImpl$ExportedWrapper.newClient(RMIJRMPServerImpl.java:253) at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:357) at sun.rmi.transport.Transport$1.run(Transport.java:200) at sun.rmi.transport.Transport$1.run(Transport.java:197) at java.security.AccessController.doPrivileged(Native Method) at sun.rmi.transport.Transport.serviceCall(Transport.java:196) at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:573) at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:834) at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(TCPTransport.java:688) at java.security.AccessController.doPrivileged(Native Method) at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:687) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(StreamRemoteCall.java:303) at sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:279) at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:164) at java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod(RemoteObjectInvocationHandler.java:235) at java.rmi.server.RemoteObjectInvocationHandler.invoke(RemoteObjectInvocationHandler.java:180) at com.sun.proxy.$Proxy7.newClient(Unknown Source) at javax.management.remote.rmi.RMIConnector.getConnection(RMIConnector.java:2430) at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:308) at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) at org.apache.cassandra.tools.NodeProbe.connect(NodeProbe.java:183) at org.apache.cassandra.tools.NodeProbe.<init>(NodeProbe.java:150) at org.apache.cassandra.tools.NodeTool$NodeToolCmd.connect(NodeTool.java:302) at org.apache.cassandra.tools.NodeTool$NodeToolCmd.run(NodeTool.java:242) at org.apache.cassandra.tools.NodeTool.main(NodeTool.java:158) Are there any other changes required ?? Thanks & Regards, Vinayak |
|
hadoopmarc@...
Hi Vinayak,
Please review the change you made in the cassandra-env.sh, it does not make sense. I do not know about JMX settings for Cassandra either, but the cassandra-env.sh is written such that you do not have to. Best wishes, Marc |
|
Vinayak Bali
Hi Marc, How can I enable JMX authentication for the Cassandra daemon ?? Thanks & Regards, Vinayak On Tue, Mar 9, 2021 at 10:01 PM <hadoopmarc@...> wrote: Hi Vinayak, |
|
hadoopmarc@...
Hi Vinayak,
What happend after you tried: LOCAL_JMX=no
if [ "$LOCAL_JMX" = "yes" ]; thenJVM_OPTS="$JVM_OPTS -Dcassandra.jmx.local.port=$JMX_PORT -XX:+DisableExplicitGC" else JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.rmi.port=$JMX_PORT" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=false" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=/path/to/keystore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=<keystore-password>" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=/path/to/truststore" # JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=<truststore-password>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=<enabled-protocols>" # JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=<enabled-cipher-suites>" fi Best wishes, Marc |
|
Vinayak Bali
Hi Marc, We get the same error. On Thu, 11 Mar 2021, 4:44 pm , <hadoopmarc@...> wrote: Hi Vinayak, |
|
hadoopmarc@...
Hi Vinayak,
Google is your friend: https://support.datastax.com/hc/en-us/articles/204226179-Step-by-step-instructions-for-securing-JMX-authentication-for-nodetool-utility-OpsCenter-and-JConsole Best wishes, Marc |
|
Vinayak Bali
Hi Marc, The article was useful and complete the JMX authentication successfully. But when I allow password authentication for Cassandra by changing the following lines in Cassandra.yaml, it stops working. Before: authenticator: AllowAllAuthenticator authorizer: AllowAllAuthorizer After: authenticator: PasswordAuthenticator authorizer: CassandraAuthorizer # Authentication backend, implementing IAuthenticator; used to identify users # Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthenticator, # PasswordAuthenticator}. # # - AllowAllAuthenticator performs no checks - set it to disable authentication. # - PasswordAuthenticator relies on username/password pairs to authenticate # users. It keeps usernames and hashed passwords in system_auth.credentials table. # Please increase system_auth keyspace replication factor if you use this authenticator. # Authorization backend, implementing IAuthorizer; used to limit access/provide permissions # Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthorizer, # CassandraAuthorizer}. # # - AllowAllAuthorizer allows any action to any user - set it to disable authorization. # - CassandraAuthorizer stores permissions in system_auth.permissions table. Please # increase system_auth keyspace replication factor if you use this authorizer. The comments here suggest increasing replication factor, but I don't think that's the issue. Please suggest a blog or changes to be made to enable password authentication for Cassandra. Thanks & Regards, Vinayak On Thu, Mar 11, 2021 at 9:58 PM <hadoopmarc@...> wrote: Hi Vinayak, |
|
hadoopmarc@...
Hi Vinayak,
This question is probably better addressed to: https://cassandra.apache.org/community/ as I cannot remember having seen this discussed in the JanusGraph community. Best wishes, Marc |
|