Mailing-List: contact solr-user-help@lucene.apache.org; run by ezmlm
Precedence: bulk
Reply-To: solr-user@lucene.apache.org
MIME-Version: 1.0
In-Reply-To: <2DA56D5B-C2E7-419E-8577-0E8D3C112C87@gmail.com>
References: 
 <CALHkrMmNe8GpvZ6GN+7b8fZXNx-pOa6DOU+VdM8O1S3TXaGFmw@mail.gmail.com>
	<5610D12A.7000909@elyograg.org>
	<2DA56D5B-C2E7-419E-8577-0E8D3C112C87@gmail.com>
Date: Sun, 4 Oct 2015 17:07:13 -0400
Message-ID: 
 <CALHkrMnR+cSezZX9TPOO4AK=gyxftm_fZkhkGr5NuA6+5yc-Mw@mail.gmail.com>
Subject: Re: How to disable the admin interface
From: Siddhartha Singh Sandhu <sandhusolr@gmail.com>
To: solr-user@lucene.apache.org
Content-Type: multipart/alternative; boundary=089e0122a3fadfe3f505214dc7eb

--089e0122a3fadfe3f505214dc7eb
Content-Type: text/plain; charset=UTF-8

Hi Shawn and Andrew,

I am on page with you guys about the ssh authentication and communicating
with the API's that SOLR has to provide. I simply don't want the GUI as it
is nobody will be able to access it once I set the policy on my server
except for servers in the same network. Also, now that we are on that
issue, does SOLR URL's have checks to guard against penetration attacks as
the "prod setup" guide is so openly available?

Regards,
Sid.

On Sun, Oct 4, 2015 at 4:55 AM, Andrea Open Source <
andrearoggerone.osrc@gmail.com> wrote:

> Hi,
> As Shawn is saying, disabling the Admin interface is not the right way to
> go. If you just disable the admin interface users could still run queries
> and you don't want that. The solution that you're looking for, is enabling
> the ssh authentication so only the users with the right certificate can
> query Solr or reach the admin.
>
>
> King Regards,
> Andrea Roggerone
>
> > On 04/ott/2015, at 08:11, Shawn Heisey <apache@elyograg.org> wrote:
> >
> >> On 10/3/2015 9:17 PM, Siddhartha Singh Sandhu wrote:
> >> I want to disable the admin interface in SOLR. I understand that
> >> authentication is available in the solrcloud mode but until that
> happens I
> >> want to disable the admin interface in my prod environment.
> >>
> >> How can I do this?
> >
> > Why do you need to disable the admin interface?  The admin interface is
> > just a bunch of HTML, CSS, and Javascript.  It downloads code that runs
> > inside your browser and turns it into a tool that can manipulate Solr.
> >
> > The parts of Solr that need protecting are the APIs that the admin
> > interface calls.  When authentication is enabled in the newest Solr
> > versions, it is not the admin interface that is protected, it is those
> > APIs called by the admin interface.  Anyone can use those APIs directly,
> > completely independent of the interface.
> >
> > Thanks
> > Shawn
> >
>

--089e0122a3fadfe3f505214dc7eb--