| name | clickhouse-security-basics |
| description | Secure ClickHouse with user management, network restrictions, TLS, and
audit logging. Use when hardening a ClickHouse deployment, creating restricted
users, enforcing multi-tenant row isolation, or configuring network-level
access controls. Trigger with "clickhouse security", "clickhouse user
management", "secure clickhouse", "clickhouse TLS", "clickhouse access
control", "clickhouse firewall".
|
| allowed-tools | Read |
| version | 1.7.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","database","analytics","clickhouse","olap"] |
| compatibility | Designed for Claude Code |
ClickHouse Security Basics
Overview
Secure a ClickHouse deployment with SQL-based user management, network restrictions,
TLS encryption, and query audit logging. This skill walks the seven core hardening
steps at a high level; the full copy-pasteable SQL, XML, and connection code lives in
references/implementation.md.
Prerequisites
- ClickHouse admin access
CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 for SQL-based user management- For self-hosted: access to server config files (
config.xml, users.xml)
Instructions
Work through the seven steps in order. Each summary below gives the essential
first move; drill into references/implementation.md
for the complete, copy-ready code for every step.
Step 1: Create restricted users (SQL-based RBAC)
Create least-privilege users and REVOKE destructive verbs from application users.
CREATE USER analyst
IDENTIFIED WITH sha256_password BY 'strong-password-here'
DEFAULT DATABASE analytics
SETTINGS readonly = 1, max_execution_time = 60;
GRANT SELECT ON analytics.* TO analyst;
Step 2: Use roles for permission groups
Define data_reader / data_writer / schema_admin roles once, then grant roles
to users instead of hand-managing per-user grants. Verify with SHOW GRANTS.
Step 3: Row-level security
Isolate multi-tenant data with CREATE ROW POLICY, mapping each user to a tenant
via a custom setting (getSetting('custom_tenant_id')).
Step 4: Network security
Restrict connection sources — SQL HOST IP '10.0.0.0/8' (22.6+), users.xml
per-user network allowlists for self-hosted, or the ClickHouse Cloud IP Access List.
