You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@lucene.apache.org by "David Smiley (Jira)" <ji...@apache.org> on 2020/01/06 13:37:00 UTC
[jira] [Comment Edited] (SOLR-14158) package manager to read keys
from packagestore and not ZK
[ https://issues.apache.org/jira/browse/SOLR-14158?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17008846#comment-17008846 ]
David Smiley edited comment on SOLR-14158 at 1/6/20 1:36 PM:
-------------------------------------------------------------
This is perhaps a bigger issue that needs discussion on the dev list. It gets at Solr's security posture and what assumptions we have about securing Solr. I'm not for or against what's happening in the issue; I just want more eye-balls on it.
was (Author: dsmiley):
This is perhaps a bigger issue that needs discussion on the dev list. It gets at Solr's security posture and what assumptions we have about securing Solr. I'm for/against what's happening in the issue but just want more eye-balls on it.
> package manager to read keys from packagestore and not ZK
> ----------------------------------------------------------
>
> Key: SOLR-14158
> URL: https://issues.apache.org/jira/browse/SOLR-14158
> Project: Solr
> Issue Type: Bug
> Security Level: Public(Default Security Level. Issues are Public)
> Components: packages
> Affects Versions: 8.4
> Reporter: Noble Paul
> Assignee: Noble Paul
> Priority: Blocker
> Labels: packagemanager
> Fix For: 8.4.1
>
>
> The security of the package system relies on securing ZK. It's much easier for users to secure the file system than securing ZK.
> We provide an option to read public keys from file store.
> This will
> * Have a special directory called {{_trusted_}} . Direct writes are forbidden to that directory over http
> * The CLI directly writes to the keys to {{<SOLR_HOME>/filestore/_trusted_/keys/}} directory. Other nodes are asked to fetch the public key files from that node
> * Package artifacts will continue to be uploaded over http
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org