When the server first starts running, and detects that its database is uninitialised or has been deleted, it initialises a fresh database with the following resources:

• a virtual host named /
• a user named guest with a default password of guest,
  granted full access to the / virtual host.

It is advisable to delete the guest user
or change the password to something private, particularly if your broker is
accessible publicly.

当服务器启动的并检测到它的数据库没有被初始化，或者已经被删除了的时候，就会使用下列资源来初始化一个新的数据库：

1、一个名叫/的虚拟主机

2、一个密码为guest的用户guest，具有虚拟主机/的完全访问权限

我们建议将guest用户删掉，或者将其密码修改了，特别是在你的RabbitMQ broker会在公共场合下被访问的时候。

"guest" user can only connect via localhost

By default, the guest user is prohibited from connecting to the broker remotely; it can only connect
over a loopback interface (i.e. localhost). This applies both to AMQP and to any other protocols enabled via plugins. Any
other users you create will not (by default) be restricted in this way.

This is configured via the loopback_users item in the configuration
file.

If you wish to allow the guest user to connect from a remote host, you should set the loopback_users configuration
item to []. A complete rabbitmq.config which
does this would look like:

[{rabbit, [{loopback_users, []}]}].

How permissions work

When an AMQP client establishes a connection to an AMQP server, it specifies a virtual host within which it intends to operate. A first level of access control is enforced at this point, with the server checking whether
the user has any permissions to access the virtual hosts, and rejecting the connection attempt otherwise.

当一个AMQP客户端连接到AMQP服务器的时候，必须要确定要一个要操作的虚拟主机(virtual host)。第一级访问控制将会在这一点上进行，服务器会检测时候当前用户具备访问这个虚拟主机的权限，如果没有权限则拒绝被连接。

Resources, i.e. exchanges and queues, are named entities inside a particular virtual host; the same name denotes a different resource in each virtual host. A second level of access control is enforced when certain
operations are performed on resources.

特定虚拟主机中的队列，交换机，以及命名实体等都称之为资源，不同的虚拟主机中即使同名也是不同的资源。二级访问控制就是在资源上面进行，将会对在特定资源上进行的操作进行权限控制，判断是否可以进行。

RabbitMQ distinguishes between configure, write and read operations on a resource. The configure operations create or destroy resources, or alter their behaviour. The write operations
inject messages into a resource. And the read operations retrieve messages from a resource.

RabbitMQ针对一个资源有“配置，写，以及读”三种操作，其中配置操作创建和销毁资源，或者更改其行为，写操作将消息注入到特定资源，读操作从特定资源检索消息。

In order to perform an operation on a resource the user must have been granted the appropriate permissions for it. The following table shows what permissions on what type of resource are required for all the AMQP commands
which perform permission checks.

为了在特定资源上进行操作，用户必须被授予正确的针对该资源的权限，下表将会展示在执行AMQP命令的时候，将会针对什么资源进行什么样的权限检测。比如可以看到第五个AMQP命令，在创建队列的时候将会对当前用户进行是否针对队列资源有configure权限的判断。

Permissions are expressed as a triple of regular expressions - one each for configure, write and read - on per-vhost basis. The user is granted the respective permission for operations on all resources with names matching
the regular expressions. (Note: For convenience RabbitMQ maps AMQP's default exchange's blank name to 'amq.default' when performing permission checks.)

The regular expression '^$', i.e. matching nothing but the empty string, covers
all resources and effectively stops the user from performing any operation. Standard AMQP resource names are prefixed with amq. and
server generated names are prefixed with amq.gen. For example, '^(amq\.gen.*|amq\.default)$' gives
a user access to server-generated names and the default exchange. The empty string, '' is a synonym for'^$' and
restricts permissions in the exact same way.

RabbitMQ may cache the results of access control checks on a per-connection or per-channel basis. Hence changes to user permissions may only take effect when the user reconnects.

For details of how to set up access control, please see the Access
Control section of the rabbitmqctl(1) man page.