Mutual Authentication Between Application Server and ClickHouse
Communication occurs over the HTTPS protocol.
When connecting to ClickHouse, the application server authenticates the ClickHouse instance using its server certificate, which has been previously configured in the Docker container. In turn, ClickHouse authenticates the application server using a username and password pair. The password is stored in an embedded file-based database in encrypted form.
The username and password are transmitted within a POST request.
Example of a database request captured using Wireshark:
Hypertext Transfer Protocol
POST /?extremes=0&database=default&user=writeUser&password=write&compress=1
HTTP/1.1\r\n
[Expert Info (Chat/Sequence): POST /?
extremes=0&database=default&user=writeUser&password=write&compress=1 HTTP/1.1\r\
n]
[POST /?extremes=0&database=default&user=writeUser&password=write&compress=1
HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: POST
Request URI: /?
extremes=0&database=default&user=writeUser&password=write&compress=1
Request URI Path: /
Request URI Query:
extremes=0&database=default&user=writeUser&password=write&compress=1
Request URI Query Parameter: extremes=0
Request URI Query Parameter: database=default
Request URI Query Parameter: user=writeUser
Request URI Query Parameter: password=write
Request URI Query Parameter: compress=1
Request Version: HTTP/1.1
Content-Length: 62\r\n
Content-Type: text/plain; charset=UTF-8\r\n
Host: 192.168.88.15:8888\r\n
Connection: Keep-Alive\r\n
User-Agent: Apache-HttpClient/4.5.2 (Java/11.0.4)\r\n
\r\n
[Full request URI: http://192.168.88.15:8888/?
extremes=0&database=default&user=writeUser&password=write&compress=1]
File Data: 62 bytes
Line-based text data: text/plain (1 lines)
select currentDatabase() FORMAT TabSeparatedWithNamesAndTypes;
ClickHouse users have minimal privileges and are restricted exclusively to executing SQL queries. Settings can be limited on a per-user basis. It is not possible to modify ClickHouse settings via SQL queries.
Security configurations can only be changed directly on the server by editing the following files:
/etc/clickhouse-server/config.xml и /etc/clickhouse-server/users.xml.
If a user lacks physical access to the ClickHouse server, they cannot alter server settings. For a more detailed explanation of security controls, refer to ClickHouse documentation.
Was the article helpful?