The Future of Security for CQLSH
summary
CQLSH currently supports only the plaintext password authenticator, and a CEP proposes making it loadable via an auth provider class in cqlshrc with key/value constructor properties. Drivers already accept plugins and a SigV4 plugin (Python/Node/Go/Java) exists to demonstrate digest-based ephemeral creds. Examples covered: SAML/OpenID Connect/Kerberos integration, command-line and rc file credential leaks, suggestions to separate per-user credentials files and add file-permission checks, and options for OTP/U2F multi-factor flows.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:21TODAY'S MENU
- 2:41PLUGGABLE AUTHENTICATION, SERVER-SIDE
- 5:30OPEN BY DEFAULT
- 6:38PLUGGABLE AUTHENTICATION, CLIENT-SIDE
- 7:38EXISTING DRIVER PLUGINS
- 10:48AUTHENTICATION IN COLSH
- 13:25EPHEMERAL CREDENTIALS
- 14:54EPHEMERAL ROLES IN PRACTICE
- 16:31WHAT ALREADY EXISTS?
- 17:02SELECTING THE AUTHENTICATOR
- 18:09CONFIGURING THE AUTHENTICATOR
- 19:07EXAMPLE
- 20:17SAML? ISN'T THAT A WEB FRAMEWORK?
- 22:44THERE'S SOAP IN MY DATABASE
- 26:53SSO ALTERNATIVES
- 28:47OBTAINING CREDENTIALS
- 30:47PLUGINS FOR PLUGINS?
- 31:36WARN ON COMMAND LINE USAGE
- 32:48SEPARATE CREDENTIAL FILE
- 34:05UZF AND OTHER MFA
- 39:52FURTHER READING
related talks
41mHow Secure Can You Be?
30mData Security: Theoretical and Real World Approache...
44mEngineering Secure SSH Access for Engineers
27mWho's managing the credential for your data infrastructure?
50msshlogin: securely authenticating to remote Linux systems via ...
36mCredHub and Secure Credential Management - Peter Blum, Scott Frederick
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal- 44mEngineering Secure SSH Access for Engineers