mirror of
https://github.com/ClickHouse/ClickHouse.git
synced 2024-10-07 17:10:49 +00:00
16ca492938
* CLICKHOUSE-4063: less manual html @ index.md * CLICKHOUSE-4063: recommend markdown="1" in README.md * CLICKHOUSE-4003: manually purge custom.css for now * CLICKHOUSE-4064: expand <details> before any print (including to pdf) * CLICKHOUSE-3927: rearrange interfaces/formats.md a bit * CLICKHOUSE-3306: add few http headers * Remove copy-paste introduced in #3392 * Hopefully better chinese fonts #3392 * get rid of tabs @ custom.css * Apply comments and patch from #3384 * Add jdbc.md to ToC and some translation, though it still looks badly incomplete * minor punctuation * Add some backlinks to official website from mirrors that just blindly take markdown sources * Do not make fonts extra light * find . -name '*.md' -type f | xargs -I{} perl -pi -e 's//g' {} * find . -name '*.md' -type f | xargs -I{} perl -pi -e 's/ sql/g' {} * Remove outdated stuff from roadmap.md * Not so light font on front page too * Refactor Chinese formats.md to match recent changes in other languages * Update some links on front page * Remove some outdated comment * Add twitter link to front page * More front page links tuning * Add Amsterdam meetup link * Smaller font to avoid second line * Add Amsterdam link to README.md * Proper docs nav translation * Back to 300 font-weight except Chinese * fix docs build * Update Amsterdam link * remove symlinks * more zh punctuation * apply lost comment by @zhang2014 * Apply comments by @zhang2014 from #3417 * Remove Beijing link * rm incorrect symlink * restore content of docs/zh/operations/table_engines/index.md * CLICKHOUSE-3751: stem terms while searching docs * CLICKHOUSE-3751: use English stemmer in non-English docs too * CLICKHOUSE-4135 fix * Remove past meetup link * Add blog link to top nav * Add ContentSquare article link * Add form link to front page + refactor some texts * couple markup fixes * minor * Introduce basic ODBC driver page in docs * More verbose 3rd party libs disclaimer * Put third-party stuff into a separate folder * Separate third-party stuff in ToC too * Update links * Move stuff that is not really (only) a client library into a separate page * Add clickhouse-hdfs-loader link * Some introduction for "interfaces" section * Rewrite tcp.md * http_interface.md -> http.md * fix link * Remove unconvenient error for now * try to guess anchor instead of failing * remove symlink * Remove outdated info from introduction * remove ru roadmap.md * replace ru roadmap.md with symlink * Update roadmap.md * lost file * Title case in toc_en.yml * Sync "Functions" ToC section with en * Remove reference to pretty old ClickHouse release from docs * couple lost symlinks in fa * Close quote in proper place * Rewrite en/getting_started/index.md * Sync en<>ru getting_started/index.md * minor changes * Some gui.md refactoring * Translate DataGrip section to ru * Translate DataGrip section to zh * Translate DataGrip section to fa * Translate DBeaver section to fa * Translate DBeaver section to zh * Split third-party GUI to open-source and commercial * Mention some RDBMS integrations + ad-hoc translation fixes * Add rel="external nofollow" to outgoing links from docs * Lost blank lines * Fix class name * More rel="external nofollow" * Apply suggestions by @sundy-li * Mobile version of front page improvements * test * test 2 * test 3 * Update LICENSE * minor docs fix * Highlight current article as suggested by @sundy-li * fix link destination * Introduce backup.md (only "en" for now) * Mention INSERT+SELECT in backup.md * Some improvements for replication.md * Add backup.md to toc * Mention clickhouse-backup tool * Mention LightHouse in third-party GUI list * Introduce interfaces/third-party/proxy.md * Add clickhouse-bulk to proxy.md * Major extension of integrations.md contents * fix link target * remove unneeded file * better toc item name * fix markdown * better ru punctuation * Add yet another possible backup approach * Simplify copying permalinks to headers * Support non-eng link anchors in docs + update some deps * Generate anchors for single-page mode automatically * Remove anchors to top of pages * Remove anchors that nobody links to * build fixes * fix few links * restore css * fix some links * restore gifs * fix lost words * more docs fixes * docs fixes * NULL anchor * update urllib3 dependency * more fixes
103 lines
5.8 KiB
Markdown
103 lines
5.8 KiB
Markdown
# Access Rights
|
||
|
||
Users and access rights are set up in the user config. This is usually `users.xml`.
|
||
|
||
Users are recorded in the `users` section. Here is a fragment of the `users.xml` file:
|
||
|
||
```xml
|
||
<!-- Users and ACL. -->
|
||
<users>
|
||
<!-- If the user name is not specified, the 'default' user is used. -->
|
||
<default>
|
||
<!-- Password could be specified in plaintext or in SHA256 (in hex format).
|
||
|
||
If you want to specify password in plaintext (not recommended), place it in 'password' element.
|
||
Example: <password>qwerty</password>.
|
||
Password could be empty.
|
||
|
||
If you want to specify SHA256, place it in 'password_sha256_hex' element.
|
||
Example: <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex>
|
||
|
||
How to generate decent password:
|
||
Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
|
||
In first line will be password and in second - corresponding SHA256.
|
||
-->
|
||
<password></password>
|
||
|
||
<!-- A list of networks that access is allowed from.
|
||
Each list item has one of the following forms:
|
||
<ip> The IP address or subnet mask. For example: 198.51.100.0/24 or 2001:DB8::/32.
|
||
<host> Host name. For example: example01. A DNS query is made for verification, and all addresses obtained are compared with the address of the customer.
|
||
<host_regexp> Regular expression for host names. For example, ^example\d\d-\d\d-\d\.yandex\.ru$
|
||
To check it, a DNS PTR request is made for the client's address and a regular expression is applied to the result.
|
||
Then another DNS query is made for the result of the PTR query, and all received address are compared to the client address.
|
||
We strongly recommend that the regex ends with \.yandex\.ru$.
|
||
|
||
If you are installing ClickHouse yourself, specify here:
|
||
<networks>
|
||
<ip>::/0</ip>
|
||
</networks>
|
||
-->
|
||
<networks incl="networks" />
|
||
|
||
<!-- Settings profile for the user. -->
|
||
<profile>default</profile>
|
||
|
||
<!-- Quota for the user. -->
|
||
<quota>default</quota>
|
||
</default>
|
||
|
||
<!-- For requests from the Yandex.Metrica user interface via the API for data on specific counters. -->
|
||
<web>
|
||
<password></password>
|
||
<networks incl="networks" />
|
||
<profile>web</profile>
|
||
<quota>default</quota>
|
||
<allow_databases>
|
||
<database>test</database>
|
||
</allow_databases>
|
||
</web>
|
||
```
|
||
|
||
You can see a declaration from two users: `default`and`web`. We added the `web` user separately.
|
||
|
||
The `default` user is chosen in cases when the username is not passed. The `default` user is also used for distributed query processing, if the configuration of the server or cluster doesn't specify the `user` and `password` (see the section on the [Distributed](../operations/table_engines/distributed.md) engine).
|
||
|
||
The user that is used for exchanging information between servers combined in a cluster must not have substantial restrictions or quotas – otherwise, distributed queries will fail.
|
||
|
||
The password is specified in clear text (not recommended) or in SHA-256. The hash isn't salted. In this regard, you should not consider these passwords as providing security against potential malicious attacks. Rather, they are necessary for protection from employees.
|
||
|
||
A list of networks is specified that access is allowed from. In this example, the list of networks for both users is loaded from a separate file (`/etc/metrika.xml`) containing the `networks` substitution. Here is a fragment of it:
|
||
|
||
```xml
|
||
<yandex>
|
||
...
|
||
<networks>
|
||
<ip>::/64</ip>
|
||
<ip>203.0.113.0/24</ip>
|
||
<ip>2001:DB8::/32</ip>
|
||
...
|
||
</networks>
|
||
</yandex>
|
||
```
|
||
|
||
You could define this list of networks directly in `users.xml`, or in a file in the `users.d` directory (for more information, see the section "[Configuration files](configuration_files.md#configuration_files)").
|
||
|
||
The config includes comments explaining how to open access from everywhere.
|
||
|
||
For use in production, only specify `ip` elements (IP addresses and their masks), since using `host` and `hoost_regexp` might cause extra latency.
|
||
|
||
Next the user settings profile is specified (see the section "[Settings profiles](settings/settings_profiles.md)"). You can specify the default profile, `default'`. The profile can have any name. You can specify the same profile for different users. The most important thing you can write in the settings profile is `readonly=1`, which ensures read-only access.
|
||
Then specify the quota to be used (see the section "[Quotas](quotas.md#quotas)"). You can specify the default quota: `default`. It is set in the config by default to only count resource usage, without restricting it. The quota can have any name. You can specify the same quota for different users – in this case, resource usage is calculated for each user individually.
|
||
|
||
In the optional `<allow_databases>` section, you can also specify a list of databases that the user can access. By default, all databases are available to the user. You can specify the `default` database. In this case, the user will receive access to the database by default.
|
||
|
||
Access to the `system` database is always allowed (since this database is used for processing queries).
|
||
|
||
The user can get a list of all databases and tables in them by using `SHOW` queries or system tables, even if access to individual databases isn't allowed.
|
||
|
||
Database access is not related to the [readonly](settings/query_complexity.md#query_complexity_readonly) setting. You can't grant full access to one database and `readonly` access to another one.
|
||
|
||
|
||
[Original article](https://clickhouse.yandex/docs/en/operations/access_rights/) <!--hide-->
|