Change Default Cassandra User Password

This guide walks you through changing the default password for the cassandra superuser in Apache Cassandra. By default, Cassandra ships with the password cassandra, which is a well-known security risk. You’ll use the Cassandra Query Language (CQL) shell to update it, and then verify the change works. This assumes you have access to a running Cassandra node and can connect to it.

What You’ll Need

• Access to the Cassandra server (local or remote) with permission to run cqlsh.
• The current cassandra user password (default is cassandra unless already changed).
• If password authentication is not yet enabled, you’ll need to enable it first (steps included).
• Basic familiarity with the command line.

Step-by-Step

1. Connect to Cassandra using cqlsh
   Open a terminal on the Cassandra node (or a machine with cqlsh installed) and run:
   cqlsh -u cassandra -p cassandra
   Replace the host if needed (e.g., cqlsh 192.168.1.10 -u cassandra -p cassandra). If authentication is not enabled, just cqlsh will work.
2. Check if password authentication is enabled
   Run:
   SELECT * FROM system_auth.roles WHERE role = 'cassandra';
   If this returns an error about permissions or the table not existing, authentication may be off. If it returns a row, authentication is on.
3. If authentication is off, enable it
   Edit the Cassandra configuration file (usually cassandra.yaml). Find the line:
   authenticator: AllowAllAuthenticator
   Change it to:
   authenticator: PasswordAuthenticator
   Also set authorizer: CassandraAuthorizer if not already set. Save the file and restart Cassandra (e.g., sudo systemctl restart cassandra or service cassandra restart). Wait for the node to be up, then reconnect with cqlsh -u cassandra -p cassandra.
4. Change the password
   In the cqlsh session, run:
   ALTER USER cassandra WITH PASSWORD 'NewStrongPassword';
   Replace NewStrongPassword with a strong password of your choice. Note: the default superuser cannot be dropped or have its superuser status revoked, but you can change its password.
5. Verify the change
   Exit cqlsh (exit), then reconnect with the new password:
   cqlsh -u cassandra -p NewStrongPassword
   If you can connect, the change succeeded.
6. Update your application or scripts
   Any application or script that connects to Cassandra using the cassandra user must be updated with the new password. Also update any connection strings in configuration files.

Common Mistakes

• Forgetting to enable authentication – If you run ALTER USER while authentication is off, the command may fail or have no effect. Always check the authenticator setting first.
• Using a weak password – A simple password defeats the purpose. Use a mix of letters, numbers, and symbols.
• Not restarting Cassandra after config changes – The server must be restarted for the authenticator change to take effect.
• Typing the password in plain text in logs – Avoid using the password in command lines that might be logged. Use environment variables or prompt-based entry if possible.
• Locking yourself out – If you forget the new password, you’ll need to temporarily set the authenticator back to AllowAllAuthenticator to reset it. Do this carefully.

Tips

• Use a password manager to generate and store a strong password.
• Consider creating a separate superuser for administrative tasks and keep the default cassandra user for emergencies only.
• If you have multiple nodes, the password change is replicated automatically via the system_auth keyspace, but ensure all nodes are up.
• For production, enable SSL/TLS and restrict network access to Cassandra ports.
• Document the new password in a secure place, not in plain text files on the server.

Troubleshooting

Cannot connect with new password
Double-check for typos. If you still can’t connect, verify the password was actually changed by running a query as a user with permission (or temporarily disabling auth).

ALTER USER fails with ‘Unauthorized’
You need superuser privileges. The cassandra user is superuser by default, but if you’re using another user, grant superuser or use the cassandra user.

Error: ‘Cannot alter superuser’
This error occurs if you try to change the superuser status, not the password. Use ALTER USER ... WITH PASSWORD only, not SUPERUSER.

Password change works but cqlsh prompts for password anyway
That’s normal; cqlsh will prompt if you don’t provide -p. Use the new password.

After enabling authentication, existing connections break
All clients must now authenticate. Update connection settings with the new credentials.

Node fails to start after config change
Check the Cassandra system log for errors. Common issues: YAML syntax errors, missing permissions on the config file, or incorrect authenticator class name. Revert the change if needed.

Frequently Asked Questions

Can I change the password without enabling authentication?

No. Password authentication must be enabled for the ALTER USER command to have any effect. If it’s off, the system ignores passwords entirely.

What if I forget the new password?

You can temporarily set authenticator: AllowAllAuthenticator in cassandra.yaml, restart, connect without credentials, and reset the password. Then re-enable PasswordAuthenticator.

Is the default ‘cassandra’ user a superuser?

Yes, the default cassandra user is a superuser and cannot have its superuser status removed, but you can change its password.

Does changing the password affect other nodes in the cluster?

Yes, the change is replicated via the system_auth keyspace. As long as all nodes are up, they will see the new password.

Can I change the password using a script?

Yes, you can pipe the CQL command into cqlsh, e.g., echo "ALTER USER cassandra WITH PASSWORD 'newpass';" | cqlsh. Be aware that the password may appear in shell history.

How do I create a new superuser instead of using the default?

Connect as cassandra and run: CREATE ROLE admin WITH LOGIN = true AND PASSWORD = 'adminpass' AND SUPERUSER = true; Then use that role for admin tasks.

Related

• How to Add a Gmail Account to a Samsung Galaxy Phone
• Windows To Go Alternatives: Run Windows From USB
• Android Identity Check: Turn On Theft Protection