Agent skill · security · jeremylongshore
clickhouse-security-basics
Secure ClickHouse with user management, network restrictions, TLS, and audit logging. Use when hardening a ClickHouse deployment, creating restricted users, enforcing multi-tenant row isolation, or configuring network-level access controls. Trigger with "clickhouse security", "clickhouse user management", "secure clickhouse", "clickhouse TLS", "clickhouse access control", "clickhouse firewall".
Why this skill is useful
Provides specific SQL commands and configuration snippets for securing ClickHouse deployments that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ClickHouse Security Basics Overview Secure a ClickHouse deployment with SQL-based user management, network restrictions, TLS encryption, and query audit logging. This skill walks the seven core hardening steps at a high level; the full copy-pasteable SQL, XML, and connection code lives in references/implementation.md. Prerequisites ClickHouse admin access CLICKHOUSEDEFAULTACCESSMANAGEMENT=1 for SQL-based user management For self-hosted: access to server config files (config.xml, users.xml) Instructions Work through the seven steps in order. Each summary below gives the essential first move; drill into references/implementation.md for the complete, copy-ready code for every step. Step 1: Create restricted users (SQL-based RBAC) Create least-privilege users and REVOKE destructive verbs from application users. Step 2: Use roles for permission groups Define datareader / datawriter / schemaadmin roles once, then grant roles to users instead of hand-managing per-user grants. Verify with SHOW GRANTS. Step 3: Row-level security Isolate multi-tenant data with CREATE ROW POLICY, mapping each user to a tenant via a custom setting (getSetting('customtenantid')). Step 4: Network security Restrict connection sources — SQL HOST IP '10.0.0.0/8' (22.6+), users.xml per-user network allowlists for self-hosted, or the ClickHouse Cloud IP Access List. Step 5: TLS configuration Enable the HTTPS port (8443) in config.xml with a server cert, private key, and strict verification mode. Step 6: Audit logging Query system.querylog (on by default) to see who ran what, and filter exceptioncode = 516 to hunt failed logins. Step 7: Application connection security Connect over https://…:8443 with a minimal-privilege user (never default) and a password sourced from a secret manager — see the client snippet in references/examples.md. Run through the Security Checklist in references/implementation.md before declaring a deployment hardened. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickhouse-security-basics