Currently the documentation pretends to create a JKS keystore. It is
only actually a JKS keystore on java 8: on java9+ it is a PKCS12
keystore with a .jks extension (because PKCS12 is the new java default).
It works even though solr explicitly tells the JDK
(SOLR_SSL_KEY_STORE_TYPE=JKS) that its JKS when it is in fact not, due
to how keystore backwards compatibility was implemented.
Fix docs to explicitly create a PKCS12 keystore with .p12 extension and
so on instead of a PKCS12 keystore masquerading as a JKS one. This
simplifies the SSL steps since the "conversion" step (which was doing
nothing) from .JKS -> .P12 can be removed.
* SOLR-13984: add (experimental, disabled by default) security manager support.
User can set SOLR_SECURITY_MANAGER_ENABLED=true to enable security manager at runtime.
The current policy file used by tests is moved to solr/server
Additional permissions are granted for the filesystem locations set by bin/solr, and networking everywhere is enabled.
This takes advantage of the fact that permission entries are ignored if properties are not defined:
https://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html#PropertyExp
SOLR-14136: ip whitelist/blacklist via env vars
This makes it easy to restrict access to Solr by IP. For example SOLR_IP_WHITELIST="127.0.0.1, 192.168.0.0/24, [::1], [2000:123:4:5::]/64" would restrict access to v4/v6 localhost, the 192.168.0 ipv4 network, and 2000:123:4:5 ipv6 network. Any other IP will receive a 403 response.
Blacklisting functionality can deny access to problematic addresses or networks that would otherwise be allowed. For example SOLR_IP_BLACKLIST="192.168.0.3, 192.168.0.4" would explicitly prevent those two specific addresses from accessing solr.
User can now set SOLR_REQUESTLOG_ENABLED=true to enable the jetty request log, instead of editing XML. The location of the request logs will respect SOLR_LOGS_DIR if that is set. The deprecated NCSARequestLog is no longer used, instead it uses CustomRequestLog with NCSA_FORMAT.
whoami displays a warning if the effective-uid is not in /etc/password.
This can happen in certain situations when running in a docker
container. This replaces the 'whoami' usage with a safer check.
Prior to this commit, SOLR-13155 added support for an 'autoscaling' tool
to bin/solr, but not to the Windows equivalent bin/solr.cmd. This
commit adds the necessary plumbing to the Windows version of this
script. It also removes some dead help-text from the bin/solr script.
JEP 158 (https://openjdk.java.net/jeps/158) says the filesize parameter is the “file size in kb” however that appears to not be the case since when it is set to a value of 20000 you end up with GC logs that are only 20000 bytes in length. Setting the value to 20M produces the desired result of GC log files that are 20MB in size.
The bin/solr scripts print a warning message when a user creates a
collection that makes use of the default config (which has settings
not recommended for production).
While helpful, this warning was a little too noisy. It also suggested
users resolve the issue with a provided curl command, but bin/solr is
also capable of performing the same action.
This commit cleans up the error message a bit.
The bin/solr scripts contain a number of independent tools. Many of
these can be run anywhere and just pointed at the correct Solr or ZK
host. Some must run on the machine hosting Solr itself.
This commit clarifies help text for each bin/solr command, indicating
whether it can be run remotely, or must be run locally.
Robert Muir
Andy Vuong
Jason Gerlowski
Jan Høydahl
Ishan Chattopadhyaya
Erick Erickson
Cao Manh Dat
Noble Paul
Andrzej Bialecki
Uwe Schindler
Tomas Fernandez Lobbe
Cassandra Targett
Tim Underwood
Erick Erickson
Steve Rowe
Chris Hostetter
Mark Miller
Varun Thacker
Shalin Shekhar Mangar
Christine Poerschke