[
https://issues.apache.org/jira/browse/SOLR-4580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14089275#comment-14089275
]
Mark Miller commented on SOLR-4580:
-----------------------------------
bq. If you try and use zk security without a chroot, it fails to start.
I realize I may have been unclear here. It fails to start because I added code
to make it so - if you attempt to configure zk/solr security and are not using
a chroot, Solr throws an exception starting up telling you to use a chroot if
you want to use zk/solr security. I did this simply because I'm worried about
how easy it is to not actually have security working correctly at the root
level.
Everything is working as expected AFAIK though.
My only concern is reviewing any issues around loading custom imlpls - as we
don't use the SolrResourceLoader, I just need to try it out manually and fully
understand any implications of that. I understand SolrResourceLoader cannot
easily be used because these custom impls are necessary for solrj clients and
such, I just want to test and review for my own peace of mind.
> Support for protecting content in ZK
> ------------------------------------
>
> Key: SOLR-4580
> URL: https://issues.apache.org/jira/browse/SOLR-4580
> Project: Solr
> Issue Type: New Feature
> Components: SolrCloud
> Affects Versions: 4.2
> Reporter: Per Steffensen
> Assignee: Mark Miller
> Labels: security, solr, zookeeper
> Attachments: SOLR-4580.patch, SOLR-4580.patch,
> SOLR-4580_branch_4x_r1482255.patch
>
>
> We want to protect content in zookeeper.
> In order to run a CloudSolrServer in "client-space" you will have to open for
> access to zookeeper from client-space.
> If you do not trust persons or systems in client-space you want to protect
> zookeeper against evilness from client-space - e.g.
> * Changing configuration
> * Trying to mess up system by manipulating clusterstate
> * Add a delete-collection job to be carried out by the Overseer
> * etc
> Even if you do not open for zookeeper access to someone outside your "secure
> zone" you might want to protect zookeeper content from being manipulated by
> e.g.
> * Malware that found its way into secure zone
> * Other systems also using zookeeper
> * etc.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
