Prior to this commit, Solr's Jetty listened for connections on all
network interfaces. This commit changes it to only listen on localhost,
to prevent incautious administrators from accidentally exposing their
Solr deployment to the world.
Administrators who wish to override this behavior can set the
SOLR_JETTY_HOST property in their Solr include file
(solr.in.sh/solr.in.cmd) to "0.0.0.0" or some other value.
A version of this commit was previously reverted due to inconsistency
between SOLR_HOST and SOLR_JETTY_HOST. This commit fixes this issue.
Prior to this commit, Solr's Jetty listened for connections on all
network interfaces. This commit changes it to only listen on localhost,
to prevent incautious administrators from accidentally exposing their
Solr deployment to the world.
Administrators who wish to override this behavior can set the
SOLR_JETTY_HOST property in their Solr include file
(solr.in.sh/solr.in.cmd) to "0.0.0.0" or some other value.
* SOLR-13984: add (experimental, disabled by default) security manager support.
User can set SOLR_SECURITY_MANAGER_ENABLED=true to enable security manager at runtime.
The current policy file used by tests is moved to solr/server
Additional permissions are granted for the filesystem locations set by bin/solr, and networking everywhere is enabled.
This takes advantage of the fact that permission entries are ignored if properties are not defined:
https://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html#PropertyExp
SOLR-14136: ip whitelist/blacklist via env vars
This makes it easy to restrict access to Solr by IP. For example SOLR_IP_WHITELIST="127.0.0.1, 192.168.0.0/24, [::1], [2000:123:4:5::]/64" would restrict access to v4/v6 localhost, the 192.168.0 ipv4 network, and 2000:123:4:5 ipv6 network. Any other IP will receive a 403 response.
Blacklisting functionality can deny access to problematic addresses or networks that would otherwise be allowed. For example SOLR_IP_BLACKLIST="192.168.0.3, 192.168.0.4" would explicitly prevent those two specific addresses from accessing solr.
User can now set SOLR_REQUESTLOG_ENABLED=true to enable the jetty request log, instead of editing XML. The location of the request logs will respect SOLR_LOGS_DIR if that is set. The deprecated NCSARequestLog is no longer used, instead it uses CustomRequestLog with NCSA_FORMAT.
Prior to this commit, SOLR-13155 added support for an 'autoscaling' tool
to bin/solr, but not to the Windows equivalent bin/solr.cmd. This
commit adds the necessary plumbing to the Windows version of this
script. It also removes some dead help-text from the bin/solr script.
JEP 158 (https://openjdk.java.net/jeps/158) says the filesize parameter is the “file size in kb” however that appears to not be the case since when it is set to a value of 20000 you end up with GC logs that are only 20000 bytes in length. Setting the value to 20M produces the desired result of GC log files that are 20MB in size.
The bin/solr scripts print a warning message when a user creates a
collection that makes use of the default config (which has settings
not recommended for production).
While helpful, this warning was a little too noisy. It also suggested
users resolve the issue with a provided curl command, but bin/solr is
also capable of performing the same action.
This commit cleans up the error message a bit.
The bin/solr scripts contain a number of independent tools. Many of
these can be run anywhere and just pointed at the correct Solr or ZK
host. Some must run on the machine hosting Solr itself.
This commit clarifies help text for each bin/solr command, indicating
whether it can be run remotely, or must be run locally.
Chris Hostetter
Marcus
Jason Gerlowski
Kevin Risden
Jason Gerlowski
Robert Muir
Andy Vuong
Jan Høydahl
Ishan Chattopadhyaya
Noble Paul
Uwe Schindler
Tim Underwood
Erick Erickson
Erick Erickson
Steve Rowe
Mark Miller
Varun Thacker
Christine Poerschke
Anshum Gupta
Ishan Chattopadhyaya