Mailing-List: contact solr-user-help@lucene.apache.org; run by ezmlm
Precedence: bulk
Reply-To: solr-user@lucene.apache.org
Subject: Re: Admin Login
To: solr-user@lucene.apache.org
References: 
 <CAKH91096C_jH2g0AAb8CCrMFSfVwagMLYQhSSJOoXq_kRjyQ8g@mail.gmail.com>
 <CAN4YXvefVGEWBQ52EJ3A4Pg-K=4thGuQh9J30AAG6kcJR+CmzA@mail.gmail.com>
 <55CFC812.20403@tnstaafl.net>
 <4CD96F00-513B-4559-BD7B-2F38D68F514C@wunderwood.org>
 <55CFEE25.7030206@tnstaafl.net>
 <CAN4YXvenvN7T-R7u_KBEHBb3vmTNaSno11PV30jMd=567YUctw@mail.gmail.com>
From: Scott Derrick <scott@tnstaafl.net>
Message-ID: <55D088E0.2000101@tnstaafl.net>
Date: Sun, 16 Aug 2015 06:58:08 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.1.0
MIME-Version: 1.0
In-Reply-To: 
 <CAN4YXvenvN7T-R7u_KBEHBb3vmTNaSno11PV30jMd=567YUctw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Erik,

After Walters reply I started thinking along the lines you mentioned and 
realized the folly of doing that!

Scott


On 8/15/2015 9:57 PM, Erick Erickson wrote:
> Scott:
>
> You better not even let them access Solr directly.
>
> http://server:port/solr/admin/collections?ACTION=delete&name=collection.....
>
> Try it sometime.... on a collection that's not important ;)
>
> But as Walter said, that'd be similar to allowing end users
> unrestricted access to
> a SOL database, that Solr URL is akin to "drop database".....
>
> Or, if you've locked down the admin stuff,
>
> http://solr:port/solr/collection/update?commit=true&stream.body=<delete><query>*:*</query></delete>
>
> Best
> Erick
>
> On Sat, Aug 15, 2015 at 6:57 PM, Scott Derrick <scott@tnstaafl.net> wrote:
>> Walter,
>>
>> actually that explains it perfectly!  I will move behind my apache server...
>>
>> thanks,
>>
>> Scott
>>
>>
>> On 8/15/2015 6:15 PM, Walter Underwood wrote:
>>> No one runs a public-facing Solr server. Just like no one runs a
>>> public-facing MySQL server.
>>>
>>> wunder
>>> Walter Underwood
>>> wunder@wunderwood.org
>>> http://observer.wunderwood.org/  (my blog)
>>>
>>>
>>> On Aug 15, 2015, at 4:15 PM, Scott Derrick <scott@tnstaafl.net> wrote:
>>>
>>>> I'm somewhat puzzled there is no built in security.  I can't image
>>>> anybody is running a public facing solr server with the admin page wide
>>>> open?
>>>>
>>>> I've searched and haven't found any solutions that work out of the box.
>>>>
>>>> I've tried the solutions here to no avail.
>>>> https://wiki.apache.org/solr/SolrSecurity
>>>>
>>>> and here.  http://wiki.eclipse.org/Jetty/Tutorial/Realms
>>>>
>>>> The Solr security docs say to use the application server and if I could
>>>> run it on my tomcat server I would already be done.  But I'm told I can't do
>>>> that?
>>>>
>>>> What solutions are people using?
>>>>
>>>> Scott
>>>>
>>>> --
>>>> Leave no stone unturned.
>>>> Euripides
>>>
>>
>> ---
>> This email has been checked for viruses by Avast antivirus software.
>> https://www.avast.com/antivirus
>>


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus