大家都說大數(shù)據(jù)有價值,但是馒胆,有多少人給大數(shù)據(jù)加了鎖缨称?
ClickHouse集群,目前線上的都是裸奔祝迂,如果對方惡意請求數(shù)據(jù)睦尽,甚至刪掉某些數(shù)據(jù),就悲劇了
Config概覽
- 配置文件:user.xml
- 核心配置3部分
- profile配置型雳,最大內(nèi)存当凡、負載方式等(沒有特別關(guān)注,可見官方文檔)
- 配額設(shè)置纠俭,單個用戶最大能用的資源多少(沒有特別關(guān)注沿量,可見官方文檔)
- 用戶設(shè)置,包括用戶名和密碼
- 密碼有2種冤荆,一種是明文朴则,一種是寫sha256sum的Hash值
- 官方不建議直接寫明文密碼
我們的config文件
<?xml version="1.0"?>
<yandex>
<profiles>
<default>
<max_memory_usage>10000000000</max_memory_usage>
<use_uncompressed_cache>0</use_uncompressed_cache>
<load_balancing>random</load_balancing>
</default>
<readonly>
<max_memory_usage>10000000000</max_memory_usage>
<use_uncompressed_cache>0</use_uncompressed_cache>
<load_balancing>random</load_balancing>
<readonly>1</readonly>
</readonly>
</profiles>
<quotas>
<!-- Name of quota. -->
<default>
<interval>
<duration>3600</duration>
<queries>0</queries>
<errors>0</errors>
<result_rows>0</result_rows>
<read_rows>0</read_rows>
<execution_time>0</execution_time>
</interval>
</default>
</quotas>
<users>
<default>
<password_sha256_hex>967f3bf355dddfabfca1c9f5cab39352b2ec1cd0b05f9e1e6b8f629705fe7d6e</password_sha256_hex>
<networks incl="networks" replace="replace">
<ip>::/0</ip>
</networks>
<profile>default</profile>
<quota>default</quota>
</default>
<ck>
<password_sha256_hex>967f3bf355dddfabfca1c9f5cab39352b2ec1cd0b05f9e1e6b8f629705fe7d6e</password_sha256_hex>
<networks incl="networks" replace="replace">
<ip>::/0</ip>
</networks>
<profile>readonly</profile>
<quota>default</quota>
</ck>
</users>
</yandex>
配置解讀
下圖定義了兩組設(shè)置,名字不同
-
第二組增加了readonly選項
Snip20171120_8
- 下圖定義了2個用戶钓简,為了方便測試乌妒,用了同一個用戶名
- ck用戶是read模式
Snip20171120_10
如何生成密碼
PASSWORD=$(base64 < /dev/urandom | head -c8);
echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
6lYaUiFi
967f3bf355dddfabfca1c9f5cab39352b2ec1cd0b05f9e1e6b8f629705fe7d6e
權(quán)限驗證
默認用戶登陸(可以不用指定用戶名)
root@10.xxxx:/data1/clickhouse # clickhouse-client -h 127.0.0.1 -d gaopeng4 -m -u default --password 6lYaUiFi
ClickHouse client version 1.1.54289.
Connecting to database gaopeng4 at 127.0.0.1:9000 as user default.
Connected to ClickHouse server version 1.1.54289.
:) create database test1 ;
CREATE DATABASE test1
Ok.
0 rows in set. Elapsed: 0.002 sec.
:) ^C
ck用戶登陸
root@10.xxxx:/data1/clickhouse # clickhouse-client -h 127.0.0.1 -d gaopeng4 -m -u ck --password 6lYaUiFi
ClickHouse client version 1.1.54289.
Connecting to database gaopeng4 at 127.0.0.1:9000 as user ck.
Connected to ClickHouse server version 1.1.54289.
:) create database test2 ;
CREATE DATABASE test2
Received exception from server:
Code: 164. DB::Exception: Received from 127.0.0.1:9000. DB::Exception: Cannot execute query in readonly mode.
0 rows in set. Elapsed: 0.014 sec.
Update
-
如果使用了分布式表,需要在集群的配置文件里外邓,增加分片的用戶名密碼
Snip20171212_15.png