What causes "Dictionary file %s is not readable." in apache/cassandra?

Fix file permissions so the Cassandra process user can read it, e.g. `chown cassandra:cassandra && chmod 640 `

apache/cassandra · error · ConfigurationException

Dictionary file %s is not readable.

Error message

Dictionary file %s is not readable.

What it means

When a dictionary file is configured for the password guardrail, Cassandra checks not only that it exists but that the Cassandra process can read it. If File.isReadable() returns false, a ConfigurationException is thrown.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:283

            minimumLenghtOfFailCharacteristics += minimumLengthsFail[i];

        if (minimumLenghtOfFailCharacteristics > lengthFail)
            throw new ConfigurationException(format("The shortest password to pass the failing validator for any %s " +
                                                    "characteristics out of %s is %s but you have set the %s to %s.",
                                                    characteristicsFail,
                                                    MAX_CHARACTERISTICS,
                                                    minimumLenghtOfFailCharacteristics,
                                                    LENGTH_FAIL_KEY,
                                                    lengthFail));

        if (dictionary != null)
        {
            File dictionaryFile = new File(dictionary);
            if (!dictionaryFile.exists())
                throw new ConfigurationException(format("Dictionary file %s does not exist.", dictionary));

            if (!dictionaryFile.isReadable())
                throw new ConfigurationException(format("Dictionary file %s is not readable.", dictionary));
        }
    }

    private ConfigurationException getValidationException(String key1, int value1, String key2, int value2)
    {
        return new ConfigurationException(format("%s of value %s is less or equal to %s of value %s",
                                                 key1, value1,
                                                 key2, value2));
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Fix file permissions so the Cassandra process user can read it, e.g. `chown cassandra:cassandra <path> && chmod 640 <path>`
Check the OS user the Cassandra process runs as (ps aux | grep cassandra) and grant read access accordingly
Investigate SELinux/AppArmor denials (audit logs) if POSIX permissions look correct

Example fix

// before
-rw------- root root /etc/cassandra/passwords.txt  (cassandra user cannot read)
// after
sudo chown cassandra:cassandra /etc/cassandra/passwords.txt && sudo chmod 640 /etc/cassandra/passwords.txt

Defensive patterns

Strategy: validation

Validate before calling

import java.io.File;
File f = new File(dictionaryPath);
if (f.exists() && !f.canRead()) throw new IllegalStateException("Not readable by this process: " + dictionaryPath);

Try / catch

try {
    applyGuardrailConfig(config);
} catch (ConfigurationException e) {
    if (e.getMessage().contains("is not readable")) {
        logger.error("Fix OS permissions/ownership for the dictionary file: {}", e.getMessage());
    }
}

Prevention

Set ownership to the Cassandra service user when deploying the file
chmod 640 (owner group readable) as the standard deployment mode
Check SELinux/AppArmor policies in hardened environments
Run a post-deploy readability check as the cassandra user (sudo -u cassandra cat <path>)

When it happens

Trigger: Configuring cassandra.password_validator.dictionary to a file whose OS permissions deny read access to the user running the Cassandra process; a root-owned file with 0600 permissions; restrictive SELinux/AppArmor policies.

Common situations: Admin creates the dictionary as root with default umask; deployment tool deploys the file with wrong ownership; containerized Cassandra runs as a non-root user without access to a host-mounted file.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/2b279bd22b896f30. Report an issue: GitHub.