ClickHouse/docs/en/operations/ssl-zookeeper.md

75 lines
1.9 KiB
Markdown
Raw Normal View History

---
2022-04-03 23:05:35 +00:00
toc_priority: 45
toc_title: Secured communication with Zookeeper
---
# Optional secured communication between ClickHouse and Zookeeper {#secured-communication-with-zookeeper}
2021-10-25 07:11:48 +00:00
You should specify `ssl.keyStore.location`, `ssl.keyStore.password` and `ssl.trustStore.location`, `ssl.trustStore.password` for communication with ClickHouse client over SSL. These options are available from Zookeeper version 3.5.2.
2021-10-25 07:11:48 +00:00
You can add `zookeeper.crt` to trusted certificates.
2021-08-18 17:31:27 +00:00
``` bash
sudo cp zookeeper.crt /usr/local/share/ca-certificates/zookeeper.crt
sudo update-ca-certificates
```
Client section in `config.xml` will look like:
2021-08-18 17:31:27 +00:00
``` xml
<client>
<certificateFile>/etc/clickhouse-server/client.crt</certificateFile>
<privateKeyFile>/etc/clickhouse-server/client.key</privateKeyFile>
<loadDefaultCAFile>true</loadDefaultCAFile>
<cacheSessions>true</cacheSessions>
<disableProtocols>sslv2,sslv3</disableProtocols>
<preferServerCiphers>true</preferServerCiphers>
<invalidCertificateHandler>
<name>RejectCertificateHandler</name>
</invalidCertificateHandler>
</client>
2021-08-18 17:31:27 +00:00
```
Add Zookeeper to ClickHouse config with some cluster and macros:
2021-08-18 17:31:27 +00:00
``` xml
2022-03-12 06:24:31 +00:00
<clickhouse>
<zookeeper>
<node>
<host>localhost</host>
<port>2281</port>
<secure>1</secure>
</node>
</zookeeper>
2022-03-12 06:24:31 +00:00
</clickhouse>
2021-08-18 17:31:27 +00:00
```
Start `clickhouse-server`. In logs you should see:
```text
<Trace> ZooKeeper: initialized, hosts: secure://localhost:2281
```
Prefix `secure://` indicates that connection is secured by SSL.
To ensure traffic is encrypted run `tcpdump` on secured port:
2021-08-18 17:31:27 +00:00
```bash
tcpdump -i any dst port 2281 -nnXS
```
And query in `clickhouse-client`:
```sql
SELECT * FROM system.zookeeper WHERE path = '/';
```
On unencrypted connection you will see in `tcpdump` output something like this:
```text
2022-04-03 23:05:35 +00:00
..../zookeeper/q
uota.
```
2021-10-25 07:11:48 +00:00
On encrypted connection you should not see this.