v.18.16Improvement

Server Configuration Files Saved in Preprocessed Directory for Improved Security

Official CH changelog text
The server does not write the processed configuration files to the /etc/clickhouse-server/ directory. Instead, it saves them in the preprocessed_configs directory inside path. This means that the /etc/clickhouse-server/ directory does not have write access for the clickhouse user, which improves security. #2443
ClickHouse server now saves processed configuration files in a preprocessed_configs directory inside the server's path instead of writing them to /etc/clickhouse-server/.

Why it matters

This change improves security by eliminating the need for the clickhouse user to have write access to the /etc/clickhouse-server/ directory, reducing the risk of unauthorized modifications to configuration files.

How to use it

No explicit user action is required. The ClickHouse server automatically writes processed configuration files to the preprocessed_configs directory inside the configured path. Ensure that the clickhouse user has appropriate permissions to access this directory.

Related resources

PreviousNext