--- description: Cassandra security tutorial explains about security in Cassandra, Configuring Cassandra file for security, assignment of permission, configuring the firewall etc. title: "Cassandra JMX Authentication & Authorization: Create User" image: https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png --- [Skip to content](#main) **⚡ Smart Summary** Cassandra security rests on internal authentication, role permissions, firewall rules and JMX access control. This page shows how to enable each layer, create users, grant permissions and secure remote nodetool access. - 🔐 **Two Layers:** Authentication proves who a user is; authorization decides what that user may do. - ⚙️ **Enable It:** Both are off by default and switch on through the authenticator and authorizer settings. - 👤 **Default Account:** The built-in cassandra superuser creates every other account, so change its password immediately. - 🔑 **Grant Model:** Permissions such as SELECT, MODIFY and ALTER are granted per resource with GRANT. - 📡 **Port Control:** Open 7000, 7001, 7199 and 9042 between nodes, and keep JMX authenticated. Read More ![Cassandra JMX Authentication and Authorization](https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png) There are two types of security in [Apache Cassandra](https://www.guru99.com/cassandra-tutorial.html) and DataStax Enterprise. - Internal Authentication - Authorization ## What is Internal Authentication and Authorization Internal authentication is basically validating a user connection. The user is authenticated with login and password. All the user accounts are managed in Cassandra internally. Internal authorization deals with a user’s permission. It deals with what actions a user can perform. For example, we can give permissions such as which user has only data read permission, which user has data write permission and which user has data delete permission. However, authentication can also be controlled externally with Kerberos (Kerberos is used to manage credentials securely) and LDAP (LDAP is used for holding authoritative information about the accounts, such as what they’re allowed to access). External authentication is the authentication that is supported with Kerberos and LDAP. Apache Cassandra does not support external authentication. Only DataStax Enterprise supports external authentication with Kerberos and LDAP, whereas internal authentication is supported both in Apache Cassandra as well as DataStax Enterprise. ## Configure Authentication and Authorization In Cassandra, by default authentication and authorization options are disabled. You have to configure the cassandra.yaml file for enabling authentication and authorization. Open cassandra.yaml and uncomment the lines that deal with internal authentication and authorization, as shown below. [![cassandra.yaml authenticator and authorizer lines uncommented]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe1.png) - In cassandra.yaml, by default, the authenticator value is ‘AllowAllAuthenticator’. Change this authenticator value from ‘AllowAllAuthenticator’ to ‘com.datastax.bdp.cassandra.auth.PasswordAuthenticator’. - Similarly, in cassandra.yaml, by default, the authorizer value will be ‘AllowAllAuthorizer’. Change this authorizer value from ‘AllowAllAuthorizer’ to ‘com.datastax.bdp.cassandra.auth.CassandraAuthorizer’. Those two class names are the DataStax Enterprise values. On open-source Apache Cassandra the same settings take `PasswordAuthenticator` and `CassandraAuthorizer`, and credentials then live in the `system_auth` keyspace, whose replication factor should be raised above one. ## Logging in Now authentication is enabled, if you try to access any keyspace, Cassandra will return an error. By default, Cassandra provides the super account with user name ‘cassandra’ and password ‘cassandra’. By logging in to the ‘cassandra’ account, you can do whatever you want. Let’s see the below screenshot for this, where it will not allow you to login if you are not using the default Cassandra “username” and “password”. [![Login rejected in cqlsh when the default credentials are not used]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe2.png) Now, in the second screenshot, you can see after using the Cassandra default login credential, you are able to login. [![Successful cqlsh login using the default cassandra credentials]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe3.png) You can also create another user with this account. It is recommended to change the password from the default. Here is the example of logging in as the Cassandra user and changing the default password. ``` alter user cassandra with password 'newpassword'; ``` ## Create New User New accounts can be created with the ‘cassandra’ account. For creating a new user, the login and password are specified along with whether the user is a superuser or not. Only a superuser can create new users. ``` create user robin with password 'manager' superuser; create user robin with password 'newhire'; ``` You can get a list of all users by the following syntax. ``` list users; ``` The output lists every account together with its superuser flag. [![Output of the list users command showing accounts and superuser flags]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe5.png) Users can be dropped by the following syntax. ``` drop user laura; ``` **Don't Miss:** - [Cassandra CQL Table: Create, Alter & Truncate Example](https://www.guru99.com/cassandra-table-create-alter-drop-truncate.html) - [Cassandra Query Language (CQL): Insert, Update & Delete](https://www.guru99.com/cassandra-query-language-cql-insert-update-delete-read-data.html) - [Create and Drop INDEX in Cassandra](https://www.guru99.com/create-drop-index-in-cassandra-complete-tutorial.html) - [Cassandra TTL & Cassandra CQL Data Types (Example)](https://www.guru99.com/cassandra-data-types-expiration-tutorial.html) ## Authorization Authorization is the assigning of permission to users, deciding what action a particular user can perform. Here is the generic syntax for assigning permission to users. ``` GRANT permission ON resource TO user ``` There are following types of permission that can be granted to the user. 1. ALL 2. ALTER 3. AUTHORIZE 4. CREATE 5. DROP 6. MODIFY 7. SELECT Here are examples of assigning permission to the user. ``` Create user laura with password 'newhire'; grant all on dev.emp to laura; revoke all on dev.emp to laura; grant select on dev.emp to laura; ``` A new user ‘laura’ is created with password ‘newhire’. Here is the example where user ‘laura’ tries to access the emp\_bonus table. Laura has only permission to access dev.emp and no permission on the table dev.emp\_bonus, which is why an error was returned. [![Error returned when laura queries the emp\_bonus table without permission]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe9.png) ``` select* form emp_bonus; ``` You can get a list of all permissions that are assigned to the user. Here is the example of getting permission information. [![Output of list all permissions of laura]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe10.png) ``` list all permissions of laura; ``` You can also list all the permissions on a resource. Here is the example of getting permission from a table. [![Output of list all permissions on dev.emp]()](https://www.guru99.com/images/cassandra/021216_0545_CassandraSe11.png) ``` list all permissions on dev.emp; ``` ## Configuring Firewall If the firewall is running, following ports must be opened for communication between nodes including some Cassandra ports. If Cassandra ports will not be opened, Cassandra nodes will act as standalone database servers rather than joining the database cluster. ### Cassandra Client Ports | Port Number | Description | | --- | --- | | 9042 | Cassandra Client Port | | 9160 | Cassandra Client Port Thrift | ### Cassandra Internode ports | Port Number | Description | | --- | --- | | 7000 | Cassandra internode cluster communication | | 7001 | Cassandra SSL internode cluster communication | | 7199 | Cassandra JMX monitoring port | ### Public Ports | Port Number | Description | | --- | --- | | 22 | SSH port | | 8888 | OpsCenter Website. Browser http request. | ### Cassandra OpsCenter ports | Port Number | Description | | --- | --- | | 61620 | OpsCenter monitoring port. | | 61621 | Opscenter agent port | Current drivers use only 9042; port 9160 serves the legacy Thrift interface and can stay closed on new clusters. ## Enabling JMX Authentication With the default settings of Cassandra, JMX can only be accessed from the localhost. If you want to access JMX remotely, change the LOCAL\_JMX setting in cassandra-env.sh and enable authentication or SSL. After enabling JMX authentication, make sure [OpsCenter](https://www.guru99.com/cassandra-devcenter-opscenter.html) and nodetool are configured to use authentication. ### Procedure There are following steps for enabling JMX authentication. 1. In the cassandra-env.sh file, add or update following lines. ``` JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true" JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password" ``` Also, change the LOCAL\_JMX setting in cassandra-env.sh. ``` LOCAL_JMX=no ``` 2. Copy the jmxremote.password.template from /jdk\_install\_location/lib/management/ to /etc/cassandra/ and rename it to jmxremote.password. ``` cp /jdk_install_dir/lib/management/jmxremote.password.template /etc/cassandra/jmxremote.password ``` 3. Change the ownership of jmxremote.password to the user you run Cassandra with and change permission to read only. ``` chown cassandra:cassandra /etc/cassandra/jmxremote.password chmod 400 /etc/cassandra/jmxremote.password ``` 4. Edit jmxremote.password and add the user and password for JMX-compliant utilities: ``` monitorRole QED controlRole R&D cassandra cassandrapassword ``` 5. Add the Cassandra user with read and write permission to /jdk\_install\_location/lib/management/jmxremote.access ``` monitorRole readonly cassandra readwrite controlRole readwrite \ create javax.management.monitor.,javax.management.timer. \ unregister ``` 6. Restart Cassandra. 7. Run nodetool with the Cassandra user and password. ``` $ nodetool status -u cassandra -pw cassandra ``` ## FAQs 🔐 Where are Cassandra users and permissions stored? Both live in the system\_auth keyspace, in the roles and role\_permissions tables. Because a lost replica of system\_auth can lock everyone out, raise its replication factor before enabling authentication in production. 👤 How do roles differ from users in modern Cassandra? CQL roles superseded the older user syntax. A role holds permissions and can be granted to other roles, so CREATE ROLE replaces CREATE USER on current releases, which keep the user commands as aliases. 🔒 Does enabling authentication encrypt client traffic? No. Authentication only proves identity; passwords still cross the network in the clear unless client\_encryption\_options is enabled. Turn on TLS separately for client-to-node and node-to-node traffic. 🔑 Should the default cassandra account be kept? Create a dedicated superuser, then change the built-in cassandra password or drop the account. Leaving the documented cassandra/cassandra pair active is the single most common Cassandra misconfiguration. 🧳 Why does a revoked permission still appear to work? Permissions are cached. A change takes effect only after the permissions validity window expires, so shorten that setting in cassandra.yaml or restart the node when testing a grant or revoke. 📡 Why is the JMX port limited to localhost by default? Unauthenticated JMX on port 7199 allows full node control, including decommissioning. Cassandra therefore binds it locally, and remote access should be opened only with a password file or SSL in place. 🤖 How does AI help detect unauthorized Cassandra access? Machine learning models profile normal query shapes, login times and source addresses per role, then flag deviations such as an application account reading an unrelated keyspace. That surfaces credential misuse static rules miss. 🧑‍💻 Can GitHub Copilot write Cassandra GRANT statements? Copilot drafts CREATE ROLE and GRANT statements quickly from a comment, but it tends to suggest broad permissions. Review every generated grant against least privilege before running it on a live [cluster](https://www.guru99.com/cassandra-cluster.html). #### Summarize this post with: ChatGPTPerplexityGrokGoogle AI **Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.** ##### Sign up for the newsletter Subscribe for Free You have successfully subscribed. Please check your inbox. ![AI-Newsletter]() Chosen by over **350,000+** professionals [Scroll to top](#wrapper) × Search for: ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png","url":"https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png","width":"700","height":"250","caption":"Cassandra JMX Authentication & Authorization","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/cassandra-security.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/cassandra","name":"Cassandra"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/cassandra-security.html","name":"Cassandra JMX Authentication & Authorization: Create User"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/cassandra-security.html#webpage","url":"https://www.guru99.com/cassandra-security.html","name":"Cassandra JMX Authentication & Authorization: Create User","dateModified":"2026-10-09T17:10:36+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/cassandra-security.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/editorial","name":"Editorial Team","url":"https://www.guru99.com/author/editorial","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/favicon-new-logo.png","url":"https://www.guru99.com/images/favicon-new-logo.png","caption":"Editorial Team","inLanguage":"en-US"},"sameAs":["https://www.guru99.com/editorial-team"],"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"Cassandra","headline":"Cassandra JMX Authentication & Authorization: Create User","description":"Cassandra security tutorial explains about security in Cassandra, Configuring Cassandra file for security, assignment of permission, configuring the firewall etc.","keywords":"cassandra","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/editorial","name":"Editorial Team"},"dateModified":"2026-10-09T17:10:36+05:30","image":{"@id":"https://www.guru99.com/images/cassandra-jmx-authentication-authorization.png"},"copyrightYear":"2026","name":"Cassandra JMX Authentication & Authorization: Create User","subjectOf":[{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Where are Cassandra users and permissions stored?","acceptedAnswer":{"@type":"Answer","text":"Both live in the system_auth keyspace, in the roles and role_permissions tables. Because a lost replica of system_auth can lock everyone out, raise its replication factor before enabling authentication in production."}},{"@type":"Question","name":"How do roles differ from users in modern Cassandra?","acceptedAnswer":{"@type":"Answer","text":"CQL roles superseded the older user syntax. A role holds permissions and can be granted to other roles, so CREATE ROLE replaces CREATE USER on current releases, which keep the user commands as aliases."}},{"@type":"Question","name":"Does enabling authentication encrypt client traffic?","acceptedAnswer":{"@type":"Answer","text":"No. Authentication only proves identity; passwords still cross the network in the clear unless client_encryption_options is enabled. Turn on TLS separately for client-to-node and node-to-node traffic."}},{"@type":"Question","name":"Should the default cassandra account be kept?","acceptedAnswer":{"@type":"Answer","text":"Create a dedicated superuser, then change the built-in cassandra password or drop the account. Leaving the documented cassandra/cassandra pair active is the single most common Cassandra misconfiguration."}},{"@type":"Question","name":"Why does a revoked permission still appear to work?","acceptedAnswer":{"@type":"Answer","text":"Permissions are cached. A change takes effect only after the permissions validity window expires, so shorten that setting in cassandra.yaml or restart the node when testing a grant or revoke."}},{"@type":"Question","name":"Why is the JMX port limited to localhost by default?","acceptedAnswer":{"@type":"Answer","text":"Unauthenticated JMX on port 7199 allows full node control, including decommissioning. Cassandra therefore binds it locally, and remote access should be opened only with a password file or SSL in place."}},{"@type":"Question","name":"How does AI help detect unauthorized Cassandra access?","acceptedAnswer":{"@type":"Answer","text":"Machine learning models profile normal query shapes, login times and source addresses per role, then flag deviations such as an application account reading an unrelated keyspace. That surfaces credential misuse static rules miss."}},{"@type":"Question","name":"Can GitHub Copilot write Cassandra GRANT statements?","acceptedAnswer":{"@type":"Answer","text":"Copilot drafts CREATE ROLE and GRANT statements quickly from a comment, but it tends to suggest broad permissions. Review every generated grant against least privilege before running it on a live cluster."}}]}],"@id":"https://www.guru99.com/cassandra-security.html#schema-1151678","isPartOf":{"@id":"https://www.guru99.com/cassandra-security.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/cassandra-security.html#webpage"}}]} ```