案例在mac操作系统下使用docker启动 镜像参考：https://hub.docker.com/search...

一、docker是否启动成功

curl 'http://localhost:8123/'
Ok. (Ok代表成功)

二、进入容器找到配置文件

docker exec -it 容器ID /bin/bash (进入容器)
cd /etc/clickhouse-server  （到配置文件默认目录）

vim users.xml (需要在xml文件配置用户和密码 vim不存在，请使用apt-get install vim 安装)

三、根据需求配置

xml有三个节点
profiles -------服务器等相关配置（如内存 缓存压缩大小） 此处忽略
users -----用户相关配置 我们需要修改的就是这里
quotas -----通用配置 此处忽略

users节点默认展示：
<!-- Users and ACL. -->
    <users>
        <!-- If user name was not specified, 'default' user is used. -->
        <default>
            <!-- Password could be specified in plaintext or in SHA256 (in hex format).

                 If you want to specify password in plaintext (not recommended), place it in 'password' element.
                 Example: <password>qwerty</password>.
                 Password could be empty.

                 If you want to specify SHA256, place it in 'password_sha256_hex' element.
                 Example: <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex>
                 Restrictions of SHA256: impossibility to connect to ClickHouse using MySQL JS client (as of July 2019).

                 If you want to specify double SHA1, place it in 'password_double_sha1_hex' element.
                 Example: <password_double_sha1_hex>e395796d6546b1b65db9d665cd43f0e858dd4303</password_double_sha1_hex>

                 How to generate decent password:
                 Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
                 In first line will be password and in second - corresponding SHA256.

                 How to generate double SHA1:
                 Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | openssl dgst -sha1 -binary | openssl dgst -sha1
                 In first line will be password and in second - corresponding double SHA1.
            -->
            <password></password>

            <!-- List of networks with open access.

                 To open access from everywhere, specify:
                    <ip>::/0</ip>

                 To open access only from localhost, specify:
                    <ip>::1</ip>
                    <ip>127.0.0.1</ip>

                                                                                                                     4,1           Top
                     To check access, DNS PTR query is performed for peer address and then regexp is applied.
                     Then, for result of PTR query, another DNS query is performed and all received addresses compared to peer address.
                     Strongly recommended that regexp is ends with $
                 All results of DNS requests are cached till server restart.
            -->
            <networks incl="networks" replace="replace">
                <ip>::/0</ip>
            </networks>

            <!-- Settings profile for user. -->
            <profile>default</profile>

            <!-- Quota for user. -->
            <quota>default</quota>

            <!-- For testing the table filters -->
            <databases>
                <test>
                    <!-- Simple expression filter -->
                    <filtered_table1>
                        <filter>a = 1</filter>
                    </filtered_table1>

                    <!-- Complex expression filter -->
                    <filtered_table2>
                        <filter>a + b &lt; 1 or c - d &gt; 5</filter>
                    </filtered_table2>

                    <!-- Filter with ALIAS column -->
                    <filtered_table3>
                        <filter>c = 1</filter>
                    </filtered_table3>
                </test>
            </databases>
        </default>

        <!-- Example of user with readonly access. -->
        <!-- <readonly>
            <password></password>
            <networks incl="networks" replace="replace">
                <ip>::1</ip>
                <ip>127.0.0.1</ip>
            </networks>
            <profile>readonly</profile>
            <quota>default</quota>
        </readonly> -->
    </users>
    

仔细分析其中分为两个节点 default 和readonly 去掉所有注释后清晰可见：

     <users>
     <default>
        <password></password>
        <networks incl="networks" replace="replace">
            <ip>::/0</ip>
        </networks>
        <profile>default</profile>
        <quota>default</quota>
        <databases>
            <test>
                <filtered_table1>
                    <filter>a = 1</filter>
                </filtered_table1>
                <filtered_table2>
                    <filter>a + b &lt; 1 or c - d &gt; 5</filter>
                </filtered_table2>
                <filtered_table3>
                    <filter>c = 1</filter>
                </filtered_table3>
            </test>
        </databases>
    </default>
  </users>

系统默认使用default用户登录 无密码。 现在我们配置用户test 密码为abc123.

密码生成方法：

   <users>
    <test>
        <password>abc123</password>
        <networks incl="networks" replace="replace">
            <ip>::/0</ip>
        </networks>
        <profile>default</profile>
        <quota>default</quota>
    </test>
   </users>
    

配置后保存直接使用客户端登录测试（不需要重启服务）。可以使用clickhouse--client命令连接，这里我使用dbeaver客户端软件连接。测试成功。

当然，我们不推荐明文秘钥，除开明文，官方上面文档也说了 支持SHA256和SHA1算法秘钥。其中算法生成方法分别是：

SHA1 
     PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | openssl dgst -sha1 -binary | openssl dgst -sha1

SHA256

     PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'

两种加密在linux macos系统终端执行就好，第一行是你的密码（连接服务器使用），第二行是加密算法值 也就是需要配置的值。当然，这两种算法配置的xml节点不一样：

SHA1 password_double_sha1_hex
SHA256 password_sha256_hex

下面只举例使用SHA1算法：
1）终端执行密码生成命令 返回：

 D5X2cCWm
 5d12e69be56929e66554d5f6a6628715e929d9fd

2）配置如下

 <users>
    <test>         
 <password_double_sha1_hex>5d12e69be56929e66554d5f6a6628715e929d9fd</password_double_sha1_hex>
        <networks incl="networks" replace="replace">
            <ip>::/0</ip>
        </networks>
        <profile>default</profile>
        <quota>default</quota>
    </test>
</users>

3)客户端测试 账号test 密码D5X2cCWm。测试成功