2

I'm looking to increase the security of my SOLR environment and wonder how Sitecore will handle with it?

For example, I saw a possibility to use SSL and I guess it would be simply replace HTTP to HTTPS where I point SOLR server on Sitecore, but if I use another way to secure like Basic Authentication, how Sitecore will connect to SOLR?

Also, I'm looking for advises in how to harden Solr if possible.

Improve this question
3
  • 1
    i think one way you can do is definitely include the https but also just restrict access to CM and CD servers for SOLR URL. This may ensure that only certain IPs have access to that URL. Basic authentication may introduce some complexity and for Coveo i know work around but for SOLR i have not tried that since it may get complicated.
    – Mrunal Daftari
    Commented Jan 17, 2017 at 19:15
  • @MrunalDaftari that's a good idea, and by restrict access to SOLR from CM and CD, you mean to say to put a 'rule' on Apache Tomcat, right?
    – Vinicius Deschamps
    Commented Jan 18, 2017 at 12:00
  • Yes @vinicus deschamps, we had done this for coveo via and it worked well.
    – Mrunal Daftari
    Commented Jan 18, 2017 at 12:19

1 Answer 1

Reset to default
3

It used to not support basic authentication, There was a patch from sitecore to add support, but the github repository is now unpublished. (can request via portal) Here is a reference to the old patch https://github.com/ivansharamok/Sitecore.Support.449298/blob/master/README.md "Use patch 438539 that implements basic authentication using SolrNet HttpWebRequestFactory. If one requires Kerberos authenticaiton, consider implementing your own HttpWebRequestFactory that would work over Kerberos protocol."

Here are some more recent posts on the topic. http://santoshpoojari.blogspot.co.uk/2017/03/solr-basic-authentication-secure.html?m=1

See release notes 8.2 update 6 https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/82/Sitecore%20Experience%20Platform%2082%20Update6/Release%20Notes Resolved issues "​​​Solr Basic Authentication does not work." 141324

Sitecore 9 default is for Solr to run over HTTPS.

Would also recommend not making Solr publicly accessible/locked down to only be accessible from sitecore servers.

Here is the apache securing Solr guide https://lucene.apache.org/solr/guide/6_6/securing-solr.html "No Solr API, including the Admin UI, is designed to be exposed to non-trusted parties. Tune your firewall so that only trusted computers and people are allowed access. Because of this, the project will not regard e.g., Admin UI XSS issues as security vulnerabilities. However, we still ask you to report such issues in JIRA."

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.