> On Oct 30, 2026, at 4:29 PM, Dmitri Maziuk <[email protected]> wrote: > > On 10/30/26 15:00, Gus Heck wrote: > ...> If you are unable to protect everything but queries with >> blockUnknown:false, a rule for all, and * as the required role for queries >> then you may have found a bug. > I haven't tried and TBH I am not planning to. If I get a go-ahead to rebuild > our current cluster I'll be very tempted to off-load both SSL and ACLs to the > proxy node and leave the backend "woefully insecure". (And then our security > theater won't complain about "information disclosure" defaults and > "untrusted" self-signed certificates and the rest of it.) > > (I get that Solr has to have it for standalone deployments etc. where people > don't have that option.) > > Dima >
Dima, one thing you may be interested in is my attempts to make running Solr in a secure mode more obvious. For me, reading the Ref Guide, it’s all very confusing and content is spread out all over the place. Plus, we don’t give a lot of specific best practices like how your security.json SHOULD be structured. I have put together an exploration of what it would take to make running a secure solr easier. I started with “How can I simplify the documentation problem?” For me, it is about having a nice example with a tutorial on running solr with SSL, basic auth security, and controlling access to ZK. https://github.com/apache/solr/pull/5107 This exploration led to these features: - New bin/solr start -e secure-setup example: walks through HTTPS, Basic Authentication, role-based authorization, and ZooKeeper access control in a local SolrCloud setup. - Automatic TLS setup: generates a 30-day localhost certificate, private key, keystore, and truststore. Prints the file locations and prompts users to verify HTTPS with curl against the v2 system API. - Separate administration and data-access accounts: creates solr, index, and search users. The administrator has no document indexing/search roles; sample documents are loaded over HTTPS using the indexing account. - Protected ZooKeeper data: configures digest authentication and ACLs, including a readonly account that cannot access security configuration. - New --zk-credentials option: supports direct digest authentication across all eight bin/solr zk commands, independently of HTTP credentials. - New picocli-based bin/solr ssl command: imports existing PEM certificates and keys into JKS or PKCS12 stores, updates the include file, and optionally sets the cluster’s HTTPS URL scheme. - Documentation and regression coverage: adds a securing-Solr tutorial, CLI reference updates, and tests covering authentication, permissions, TLS, ZooKeeper access, and restarts. I’m going to be starting a thread soon on the dev@ list that you may be interested. I’d love some input on what you think would make a better experience. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast, a leader in email security and cyber resilience. Mimecast integrates email defenses with brand protection, security awareness training, web security, compliance and other essential capabilities. Mimecast helps protect large and small organizations from malicious activity, human error and technology failure; and to lead the movement toward building a more resilient world. To find out more, visit our website.
