Configuring TLS for ClickHouse
Enabling HTTPS and native TLS on ClickHouse with OpenSSL certificates: certificate authority setup, server and client verification modes, disabling plaintext ports, and certificate rotation.
ClickHouse security hardening
Specific controls for locking down self-managed ClickHouse: TLS, users, roles and row policies, quotas, encryption at rest, network exposure, Keeper security and log masking.
Automatic TLS certificates for ClickHouse with ACME
Using ClickHouse's experimental ACME client to obtain and renew certificates from Let's Encrypt or ZeroSSL, and when an external certificate manager is the safer choice.
Role-based access control in ClickHouse
Designing users, roles and grants with SQL-driven access control: read-only analyst roles, ingestion roles, admin separation, SHOW ACCESS reviews, and migrating from users.xml.
Row-level security with ClickHouse row policies
Restricting which rows each user or role sees with row policies: tenant and region filters, combining permissive and restrictive policies, and testing that policies cannot be bypassed.
Limiting ClickHouse users with quotas and settings profiles
Capping query counts, rows read and execution time per user with quotas, and locking memory and timeout settings with settings profiles and constraints.
Securing the ClickHouse default user
Why the default user is a risk, how to set a password or disable it, network restrictions in users.d, and creating a named admin with SQL-driven access management.
Encrypting ClickHouse data at rest
Using ClickHouse encrypted disks with AES-CTR keys on local or S3 storage: key configuration, key rotation, performance impact, and how this meets encryption-at-rest requirements.
ClickHouse network ports and firewall rules
Which ClickHouse and Keeper ports to expose to clients, between servers and to monitoring, closing MySQL and PostgreSQL emulation ports, and listen_host settings.
Securing ClickHouse Keeper
Protecting the coordination layer: digest ACLs for replicated tables, TLS for client and Raft traffic, the four-letter-word allow list, and isolating Keeper hosts.
Masking sensitive data in ClickHouse logs
Keeping emails, card numbers and identifiers out of query_log and text logs with query_masking_rules: writing RE2 patterns, configuring every node, and checking matches.
Keeping credentials out of SQL with ClickHouse named collections
Storing S3, Kafka, MySQL and PostgreSQL credentials in named collections, controlling who can use or read them, and avoiding secrets in query text and logs.
