> [!CAUTION]
> **Caution:** This documentation covers Edge for Private Cloud 4.19.01, which is no longer supported. Google does not provide security patches, bug fixes, or technical support for this version. The current supported version is 4.54.00. See the [Edge for Private Cloud documentation](https://docs.apigee.com/private-cloud/latest/overview) for the current version, or [All versions](https://docs.apigee.com/private-cloud/versions) to compare releases.

*Edge for Private Cloud v4.19.01*

By default, Cassandra installs without authentication enabled. That means anyone can access
Cassandra. You can enable authentication after installing Edge, or as part of the installation
process.

If you decide to enable authentication on Cassandra, it uses the following default
credentials:

- username = 'cassandra'
- password = 'cassandra'

You can use this account, set a different password for this account, or create a new Cassandra
user. Add, remove, and modify users by using the Cassandra CREATE/ALTER/DROP USER
statements.

For more information, see [Cassandra SQL shell commands](https://docs.datastax.com/en/cql-oss/3.x/cql/cql_reference/cqlshCommandsTOC.html).

## Enable Cassandra authentication during
installation

You can enable Cassandra authentication at install time. However, while you can enable
authentication when you install Cassandra, you cannot change the default username and password.
You have to perform that step manually after installation of Cassandra completes.

> [!NOTE]
> **Note**: Use this procedure when installing Cassandra by using the "-p c", "-p ds", "-p sa", "-p aio", "-p asa", and "-p ebp" options.

To enable Cassandra authentication at install time, include the `CASS_AUTH`
property in the configuration file for all Cassandra nodes:

```
CASS_AUTH=y # The default value is n.
```

The following Edge components access Cassandra:

- Management Server
- Message Processors
- Routers
- Qpid servers
- Postgres servers

Therefore, when you install these components, you must set the following properties in the
configuration file to specify the Cassandra credentials:

```
CASS_USERNAME=cassandra
CASS_PASSWORD=cassandra
```

You can change the Cassandra credentials after installing Cassandra. However, if you have
already installed the Management Server, Message Processors, Routers, Qpid servers, or Postgres
servers, you must also update those components to use the new credentials.

To change the Cassandra credentials after installing Cassandra:

1. Log into any one Cassandra node using the `cqlsh` tool and the default credentials. You only have to change the password on one node and it will be broadcast to all Cassandra nodes in the ring:

   ```
   /opt/apigee/apigee-cassandra/bin/cqlsh cassIP 9042 -u cassandra -p cassandra
   ```

   Where:
   1. <var translate="no">cassIP</var> is the IP address of the Cassandra node.
   2. <var translate="no">9042</var> is the default Cassandra port.
   3. The default user is `cassandra`.
   4. The default password is `cassandra`. If you changed the password previously, use the current password.
2. Run the following command at the `cqlsh>` prompt to update the password:

   ```
   ALTER USER cassandra WITH PASSWORD 'NEW_PASSWORD';
   ```
3. Exit the cqlsh tool:

   ```
   exit
   ```
4. **If you have not yet** installed the Management Server, Message Processors, Routers, Qpid servers, or Postgres servers, set the following properties in the config file and then install those components:

   ```
   CASS_USERNAME=cassandra
   CASS_PASSWORD=NEW_PASSWORD
   ```
5. **If you have already installed** the Management Server, Message Processors, Routers, Qpid servers, or Postgres servers, then see [Resetting Edge Passwords](https://docs.apigee.com/private-cloud/v4.19.01/resetting-passwords) for the procedure to update those components to use the new password.

## Enable Cassandra authentication post
installation

To enable authentication:

- Update all Edge components that connect to Cassandra with the Cassandra username and password.
- On all Cassandra nodes, enable authentication.
- Set the Cassandra username and password on any one node. You only have to change the credentials on one Cassandra node and they will be broadcast to all Cassandra nodes in the ring.

Use the following procedure to update all Edge components that communicate with Cassandra
with the new credentials. Note that you do this step before you actually update the Cassandra
credentials:

1. On the Management Server node, run the following command:

   ```
   /opt/apigee/apigee-service/bin/apigee-service edge-management-server
     store_cassandra_credentials -u cassandra_username -p cassandra_password
   ```

   Optionally, you can pass a file to the command containing the new username and password:

   ```
   apigee-service edge-management-server store_cassandra_credentials  -f configFile
   ```

   Where the <var translate="no">configFile</var> contains the following:

   ```
   CASS_USERNAME=cassandra_username # Default is cassandra
   CASS_PASSWORD=cassandra_password # Default is cassandra
   ```

   This command automatically restarts the Management Server.
2. For each of the following services, repeat Step 1:
   - All Message Processors
   - All Routers
   - All Qpid servers (edge-qpid-server)
   - Postgres servers (edge-postgres-server)

   When you repeat Step 1 for each service, replace `edge-management-server` in the
   command above with the appropriate service name. For example, when you execute the step for
   a Router service, use the following command:

   ```
   /opt/apigee/apigee-service/bin/apigee-service edge-router
     store_cassandra_credentials -u cassandra -p cassandra
   ```

Use the following procedure to enable Cassandra authentication and set the username and
password:

1. Log in to the first Cassandra node.
2. Run the following command:

   ```
   /opt/apigee/apigee-service/bin/apigee-service apigee-cassandra
     enable_cassandra_authentication -e y
   ```

   This command enables authentication and restarts Cassandra.
3. Repeat steps 1 and 2 on all Cassandra nodes.
4. Log into any one Cassandra node using the `cqlsh` tool and the default credentials. You only have to change the password on one Cassandra node and it will be broadcast to all Cassandra nodes in the ring:

   ```
   /opt/apigee/apigee-cassandra/bin/cqlsh cassIP 9042 -u cassandra -p cassandra
   ```

   Where
   - <var translate="no">cassIP</var> is the IP address of the Cassandra node.
   - <var translate="no">9042</var> is the Cassandra port.
   - The default user is `cassandra`.
   - The default password is `cassandra`. If you changed the password previously, use the current password.
5. Run the following command at the `cqlsh>` prompt to update the password:

   ```
   ALTER USER cassandra WITH PASSWORD 'NEW_PASSWORD';
   ```
6. Run the following command at the `cqlsh>` prompt to ensure that the keyspace is always available.

   > [!NOTE]
   > **Note:**The commands below all set the replication factor to "3", indicating three Cassandra nodes in the cluster. Modify this value as necessary for your installation.

   For a single data center:

   ```
   ALTER KEYSPACE system_auth WITH replication = {'class': 'NetworkTopologyStrategy', 'dc-1': '3'};
   ```
   For a two data centers:

   ```
   ALTER KEYSPACE system_auth WITH replication = {'class': 'NetworkTopologyStrategy', 'dc-1': '3', 'dc-2': '3'};
   ```
7. Exit the `cqlsh` tool:

   ```
   exit
   ```
8. Run `nodetool repair` to make sure that the change is propagated to all Cassandra nodes:

   ```
   /opt/apigee/apigee-cassandra/bin/nodetool [-u username -pw password] repair system_auth
   ```

   You only need to pass your username and password if you
   [enabled JMX authentication for Cassandra](https://docs.apigee.com/private-cloud/v4.19.01/how-monitor#cassauthenable).