[CASSANDRA-18420] Connection without username not logged in auditlog

• Type: Bug
• Status: In Progress
• Priority: Normal
• Resolution: Unresolved
• Fix Version/s: 4.0.x, 4.1.x, 5.x
• Component/s: Tool/auditlogging
• Bug Category: Correctness
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Assignee: Ningzi Zhan
• Reporter: Yakir Gibraltar

Authors

Ningzi Zhan

• Created: 03/Apr/23 11:58
• Updated: 06/May/23 12:09

Description

Hi,
If making connection without username to cassandra cluster with PasswordAuthenticator enabled,
Connection will fail but not logged on auditlog.

How to reproduce:

1. Enable "authenticator: PasswordAuthenticator" on cluster
2. Enable audit : "nodetool enableauditlog"
3. Open a new screen and run "auditlogviewer -f <log_location>/audit/"
4. Try to connect, and connection will fail:

   [root@c1 ~]# cqlsh
   Connection error: ('Unable to connect to any servers', {'127.0.0.1:9042': AuthenticationFailed('Remote end requires authentication',)})

5. But nothing in auditlogviewer.

Connection with incorrect usernames or password logged correct on auditlog , the problem only on connection without username.

How it's affecting:

1. Security reason, hard to find unauthorized connections attempt .
2. When migrating cluster into PasswordAuthenticator, hard to find applications that didn't add username/password. 

Thank you.