MarcusSorealheis commented on a change in pull request #1141: SOLR-14147 change
the Security manager to default to true.
URL: https://github.com/apache/lucene-solr/pull/1141#discussion_r374978247
##########
File path: solr/solr-ref-guide/src/securing-solr.adoc
##########
@@ -95,6 +94,15 @@ It is also strongly recommended that Solr listen to only
those network interface
----
// end::security-network-binding-1[]
-== Enable Security Manager
+// tag::security-network-binding-1[]
+Administrators should consider their security setup carefully as an important
step in moving to production. Solr provides a number of features out of the
box to meet the security needs of users: authentication and authorization can
be configured using a range of security plugins, privacy can be bolstered by
enabling SSL/TLS, and (in SolrCloud) ZooKeeper data can be protected with ACL
rules to prevent unauthorized reads and writes.
+
+Even if these measures or others are taken, it is strongly recommended that
Solr always be protected by a firewall. Solr is not designed to be exposed on
the open internet.
-Solr can run in a Java Security Manager sandbox by setting
`SOLR_SECURITY_MANAGER_ENABLED=true` via environment variable or in
`solr.in.sh`/`solr.in.cmd`. This feature is incompatible with Hadoop.
+It is also strongly recommended that Solr listen to only those network
interfaces that are strictly required. To prevent administrators from
unintentionally exposing Solr more broadly, Solr only listens on the loopback
interface ("127.0.0.1") by default. Most deployments will need to change this
value to something less restrictive so that it can be reached from other boxes.
This can be done by setting a `SOLR_JETTY_HOST` value in your environment's
"include script" (`solr.in.sh` or `solr.in.cmd`):
+
+[source,bash]
+ ----
+ SOLR_JETTY_HOST="0.0.0.0"
+ ----
+// end::security-network-binding-1[]
Review comment:
This is fixed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
