5

For a clickhouse production server, I would like to secure the access through a defined user, and remove the default user.

I'm using a users.d/myuser.xml file to add a new user, and I would like to remove the default user by this means too.

I can't find the right combination. It look like I should use the "remove" attribute, but it's not documented.

Stephane
  • 161
  • 2
  • 14

1 Answers1

10

It looks like you need to do the next changes:

/users.d/users.xml

<?xml version="1.0"?>
<yandex>
    <users>
        <default remove="remove">
        </default>
        
        <new_secured_user>
            <password>hello_world</password>
            <!-- More secure way to define password: --> 
            <!-- <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex> -->
        </new_secured_user>  
    </users>
</yandex>

Look at the article Remove/Replace config elements.

Take into account that removing default user requires some modification of cluster configuration (see Access Rights):

The default user is chosen in cases when the username is not passed. The default user is also used for distributed query processing, if the configuration of the server or cluster doesn't specify the user and password (see the section on the Distributed engine).

vladimir
  • 13,428
  • 2
  • 44
  • 70