RabbitMQ 用户与权限

In any messaging system, controlling who can send and receive messages is crucial. RabbitMQ provides robust mechanisms to manage access, ensuring only authorized users interact with your message broker.

This lesson will guide you through setting up users, virtual hosts, and permissions to secure your RabbitMQ environment.

A user in RabbitMQ represents an application or person connecting to the broker. Each user has a username and password for authentication.

By default, RabbitMQ creates a 'guest' user, but it's best practice to create dedicated users for your applications.

To create a new user, you use the rabbitmqctl command:

Virtual hosts (or vhosts) act like separate, isolated RabbitMQ brokers within a single instance. They provide logical grouping and resource separation for different applications or environments.

• Each vhost has its own exchanges, queues, and bindings.
• Users are granted permissions to specific vhosts.

To create a vhost:

Once you have users and vhosts, you need to define what each user can do within a specific vhost. RabbitMQ permissions are categorized into three types:

• Configure: For creating, deleting, and altering exchanges and queues.
• Write: For sending (publishing) messages to exchanges.
• Read: For receiving (consuming) messages from queues.

The configure permission allows a user to manage RabbitMQ resources like exchanges and queues. If a user needs to declare (create) or delete queues and exchanges, they need this permission.

The permission regex applies to the names of the resources.

The write permission allows a user to publish messages to exchanges within a vhost. Without this, a producer application cannot send messages.

The regex in the second position defines which exchanges the user can write to.

The read permission allows a user to consume messages from queues within a vhost. This is essential for consumer applications to receive messages.

The regex in the third position defines which queues the user can read from.

Often, an application user needs full control over their dedicated vhost. You can grant all three permissions (configure, write, read) to a user for all resources in a vhost using the ".*" regex for all three permission types.

This means 'match any resource name'.

RabbitMQ comes with a default user named guest with password guest. This user has full administrative permissions over all vhosts.

• Crucially: The 'guest' user can only connect from localhost by default.
• For production environments, it is highly recommended to delete this user or change its password and restrict its access, and create specific users with minimal necessary permissions.

You've learned how to secure your RabbitMQ instance by managing user access. Here's a quick summary:

• Users authenticate client applications.
• Virtual Hosts (Vhosts) provide isolated environments.
• Permissions (Configure, Write, Read) control what users can do within a vhost.
• Always use specific users and minimal permissions, especially for production.

Next, we'll explore how to encrypt these connections with SSL/TLS!