http://www.datastax.com/support-forums/topic/cassandra-client-authentication-encryption Software, Support, and Training for Apache Cassandra en-US Sun, 19 May 2013 17:54:16 +0000 http://bbpress.org/?v=1.0.3 q http://www.datastax.com/support-forums/search.php http://www.datastax.com/support-forums/topic/cassandra-client-authentication-encryption#post-8278 Fri, 04 Jan 2013 12:16:24 +0000 sarch 8278@http://www.datastax.com/support-forums/ <p>As I understand it, Cassandra offers you the opportunity to implement the two interfaces:<br /> org.apache.cassandra.auth.IAuthenticator.java<br /> org.apache.cassandra.auth.IAuthority.java<br /> to allow for authentication and that you extend these interfaces. A simple example (not secure) implementation exists in the source code that can be used.</p> <p>But as I understand it, the IAuthenticator-extended class gets the credentials from the client in a map containing plaintext "username" and "password" fields. As communication to port 9160 is not encrypted, this means that even if you implement a secure class for the IAuthenticator and IAuthority interfaces, your password from your client will be sent in plaintext and is vulnerable to snooping.</p> <p>Have I got my understanding of this situation correct and is there any way of securing your password as it is sent across the network to authorise your cassandra session without tunnelling it through an SSH session? </p>