Description:
Security Groups control incoming and outgoing network traffic for cloud instances. Cassandra-related services may use ports 7199, 9160, and 8888. These ports should not be accessible from unrestricted sources such as the public internet.
Access to these ports should be limited to trusted IP addresses or private network ranges that actually require access.
Rationale:
Allowing unrestricted access to Cassandra-related ports can expose services to unauthorized users and increase the risk of attacks. Restricting these ports to trusted sources reduces unnecessary network exposure.
Impact:
Systems outside the allowed source IP addresses will not be able to connect to the configured Cassandra ports.
Applications or administrators that require access must be included in the allowed source ranges.
Connectivity should be verified after changing the Security Group rules.
Default Value:
Utho allows administrators to configure Security Group rules. Unrestricted access to Cassandra ports is not automatically prevented and must be reviewed and restricted as required.
Pre-requisites:
A Utho account with permission to manage Security Groups.
Access to the Utho Console.
Permission to create and delete Incoming Rules.
Knowledge of the trusted IP addresses or private network ranges that require access to the Cassandra service.
Remediation
Test Plan:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Cassandra cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Review the configured Service, Protocol, Port, and Sources values.
Check for rules allowing access to ports 7199, 9160, or 8888.
Verify that the Sources for these ports are not set to 0.0.0.0/0 or ::/0.
Confirm that access is restricted to trusted IP addresses or private network ranges.
If any Incoming Rule allows unrestricted access to port 7199, 9160, or 8888, follow the Implementation Steps to remediate the issue.
Using the Utho API
Use the Utho API to retrieve the Security Group configuration and review the Incoming Rules.
curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that ports 7199, 9160, and 8888 are not allowed from unrestricted sources such as 0.0.0.0/0 or ::/0.
Implementation Steps:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Cassandra cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Locate any rule that allows TCP access to port 7199, 9160, or 8888 from an unrestricted source.
Delete the unrestricted Incoming Rule.
Create a new Incoming Rule with the required restricted access:
Service: Custom
Protocol: TCP
Port: 7199, 9160, or 8888
Sources: Trusted IP address or private CIDR range
Do not use 0.0.0.0/0 or ::/0 in the Sources field.
Click Add Rule.
Using the Utho API
Use the Utho API to apply the required Security Group configuration.
curl -X PUT \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '<updated-security-group-rule>' \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that the updated Security Group does not allow unrestricted access to ports 7199, 9160, or 8888.
Note: The API endpoints and request body above should be replaced with the exact Utho API endpoint and request format supported by your Utho environment. Do not use the example PUT request directly without confirming it against Utho's API documentation.
Backout Plan:
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the affected Security Group.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Add the previous Incoming Rule configuration if access needs to be restored.
Enter the required Service, Protocol, Port, and Sources values.
Click Add Rule.
References:
Systems outside the allowed source IP addresses will not be able to connect to the configured Cassandra ports.
Applications or administrators that require access must be included in the allowed source ranges.
Connectivity should be verified after changing the Security Group rules.
A Utho account with permission to manage Security Groups.
Access to the Utho Console.
Permission to create and delete Incoming Rules.
Knowledge of the trusted IP addresses or private network ranges that require access to the Cassandra service.
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Cassandra cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Review the configured Service, Protocol, Port, and Sources values.
Check for rules allowing access to ports 7199, 9160, or 8888.
Verify that the Sources for these ports are not set to 0.0.0.0/0 or ::/0.
Confirm that access is restricted to trusted IP addresses or private network ranges.
If any Incoming Rule allows unrestricted access to port 7199, 9160, or 8888, follow the Implementation Steps to remediate the issue.
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Cassandra cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Locate any rule that allows TCP access to port 7199, 9160, or 8888 from an unrestricted source.
Delete the unrestricted Incoming Rule.
Create a new Incoming Rule with the required restricted access:
Service: Custom
Protocol: TCP
Port: 7199, 9160, or 8888
Sources: Trusted IP address or private CIDR range
Do not use 0.0.0.0/0 or ::/0 in the Sources field.
Click Add Rule.
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the affected Security Group.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Add the previous Incoming Rule configuration if access needs to be restored.
Enter the required Service, Protocol, Port, and Sources values.
Click Add Rule.