I'm working with a client that is looking at how to use Solr in FedRAMP
environments, specifically around how to secure Solr. As I got into it, I
realized that our story about a secure Solr is VERY fragmented. It's spread
across topics like HTTPS, inter node communication, zookeeper, and of course
our security.json architecture.
Then I thought back "How many times ahve I ever deployed Solr securely" and
relaized it wasn't that often, and each time I had to rely heavily on very
smart DevOps folks to help me because I didn't know a lot of the concepts.
Then I realized, you know, there are plenty of times i SHOULD have deplyoed
Solr with security and didn't ;-).
I've been exploring a bit on How Can Solr be Run Securely Easily? And I found
that it's actually not that hard, we just don't have any good docs or examples.
In this PR https://github.com/apache/solr/pull/5107 I experimented with:
Added a bin/solr -e secure-setup example that spins up a 2 node cluster (1
embedded zk) that has it's own generated self signed HTTPS certificate, has
ACLs enabled for the embedded ZK, and has a security.json that has an
admin/index/search roles and locks everything down exept anonymous
metris/health.
This was really impactful for me as all of a sudden I could quickly stand up a
secure environment and start finding issues!
So, some observations or comments:
1) For example, if you lock down Zookeeper, then our bin/solr zk commands only
work if you have a custom solr.in.sh! So I added a --zk-credentials helper to
our various bin/solr zk commands.
If we decided that only "bin/solr zk" took in a ZK url, and all the other tools
only take in solr-url's, then we could just have --credentials for the bin/solr
zk tools, which would be nice.
2) I discovered that the Admin UI burps if you log in as someone wiht search or
index only permissions, becuase we assume you basically have access to
everyapi. Yes, we give an error, and no, it's not great! We could do some
minor stuff to make that UI nicer, and we should definitly be testing out the
new Solr UI with different sets of permissioned users.
3) The secure-setup example currently requires "openssl" on the command line
for generating the PEM, I'm curious if we could just use Bouncy Castle? But
that might have issues? It's another 11 MB of jars ;-). Plus we have to
decide FIPS or not. It would be nice to be an all-java solution! Maybe
augment the bin/solr ssl tool?
4) How opinionated should we be on waht a good well thought out "security.json"
structure should look like?
5) Also, ugh, building a custom local security.json is odd. I wanted to
instead have some sort of "bin/solr start --bootstrap-security-json
./mycustom/security.json" option. If we did that, then maybe we go a bit
furthur and that security.json file could also define our Zookeeper ACLS???
6) I'd love some feedback ont he tutorial I wrote.. It leverages the bin/solr
start -e secure-setup. Should I change the tutorial to not even use the
secure-setup example? I worry that obfuscates too much waht is going on..
7) Should creating roles and users be enabled in our bin/solr auth command?
Likewise, should for zookeeper there be bin/solr zk auth ?
Lastly, there might be a bit of overlap with SIP-26
https://cwiki.apache.org/confluence/spaces/SOLR/pages/421957642/SIP-26+Role+Based+Authentication+using+Apache+Shiro
but I think this is more about just surfacing what we already have better,
versus rethinking our security model!
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
