You are viewing a plain text version of this content. The canonical link for it is here.
Posted to solr-user@lucene.apache.org by Russell Bahr <ru...@manzama.com> on 2019/08/20 19:46:25 UTC
sorl 8.1.1 all of sudden requiring https
Hi All,
I have a solr 8.1.1 cloud that I set up and have been testing to replace
our solr 4.10.4 cloud implementation.
I have been testing on the solr 8.1.1 cloud for a couple of weeks now and
needed to shut down temporarily and then restart the cluster. When I did
this the members would not come back from recovering. As I trouble shot
further I noticed the follwoing error messages
"null:org.apache.solr.common.SolrException:
Error trying to proxy request for url:
https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/" . I
have not enabled security on this as it is behind a firewall and not
exposed to the outside.
solr 8.1.1
lucene 8.1.1
OpenJDK 12
Debian 9.8
6 shards, 5 replica each shard
here is a snip from the solr cloud graph. as you can see some are listing
https now and some still show http as it was before the restart.
shard1
https://p-solr-e-be-d-20.c.domain.internal (N)
http://p-solr-e-be-d-16.c.domain.internal (N)
https://p-solr-e-be-d-17.c.domain.internal (N)
https://p-solr-e-be-d-28.c.domain.internal (N)
https://p-solr-e-be-d-23.c.domain.internal (N)
What would cause them to all of the sudden require https, and how do I
disable that and return to http?
Thank you,
Russ Bahr
Re: sorl 8.1.1 all of sudden requiring https
Posted by Russell Bahr <ru...@manzama.com>.
Hi Jorn,
I was finally able to get the entire cluster back up on http. I ended up
having to reload the collection from the Web interface on each individual
server and then restart the members 1 at a time until 1 of them came up as
master and was able to locate and load the core.
I am still not sure why it went into such a weird state in the first place
but I guess good for troubleshooting incase something goes awry in the
future.
I am now going to set up HTTPs and make sure all is working then will
continue with testing and tuning.
Thank you for your help and guidance.
Russ
*Manzama*a MODERN GOVERNANCE company
Russell Bahr
Lead Infrastructure Engineer
USA & CAN Office: +1 (541) 306 3271
USA & CAN Support: +1 (541) 706 9393
UK Office & Support: +44 (0)203 282 1633
AUS Office & Support: +61 (0) 2 8417 2339
543 NW York Drive, Suite 100, Bend, OR 97703
LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
<https://twitter.com/ManzamaInc> | Facebook
<http://www.facebook.com/manzamainc> | YouTube
<https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
On Tue, Aug 20, 2019 at 11:49 PM Jörn Franke <jo...@gmail.com> wrote:
> This is strange that it does not work. Have you checked the logs if there
> is a different error message?
> Here is the guide:
> https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html
>
> Please do not use self signed certificates, but certificates signed by the
> CA of your company.
>
> > Am 21.08.2019 um 01:00 schrieb Russell Bahr <ru...@manzama.com>:
> >
> > I was able to change this setting in Zookeeper, and also using the Solr
> > REST interface. But even after restarting and verifying that the
> urlScheme
> > in clusterprops.json had http and not https, each of the servers still
> are
> > trying to talk to eachother and on the Cloud Graph are still showing as
> > https. I am going to try to set up security and see if things are back
> to
> > working properly after I do that. Is there a step by step guide or video
> > how to on setting up ssl on solr cloud with external zookeeper? I have
> > searched and not found anything for 6.6 or newer to follow. hopefully
> > something specific to 8.1. Can you recommend something?
> >
> >
> > *Manzama*a MODERN GOVERNANCE company
> >
> > Russell Bahr
> > Lead Infrastructure Engineer
> >
> > USA & CAN Office: +1 (541) 306 3271
> > USA & CAN Support: +1 (541) 706 9393
> > UK Office & Support: +44 (0)203 282 1633
> > AUS Office & Support: +61 (0) 2 8417 2339
> >
> > 543 NW York Drive, Suite 100, Bend, OR 97703
> >
> > LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
> > <https://twitter.com/ManzamaInc> | Facebook
> > <http://www.facebook.com/manzamainc> | YouTube
> > <https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
> >
> >
> >> On Tue, Aug 20, 2019 at 2:31 PM Russell Bahr <ru...@manzama.com> wrote:
> >>
> >> I am a very new to both solr and zookeeper. I have inherited the
> existing
> >> clusters from my predecessor without any training or explanation before
> he
> >> left. I have modeled the new zookeepers and solr cloud off of the basic
> >> configuration that was in place in the existing cluster and zookeepers.
> >>
> >> I loaded my collection into zookeeper, but did not set any security in
> >> zookeeper. is this possibly a bug in zookeeper then? how would I
> change
> >> it back to http for the time being to complete my other testing? If I
> do
> >> enable HTTPs will I have to rebuild anyway?
> >>
> >> *Manzama*
> >> a MODERN GOVERNANCE company
> >>
> >> Russell Bahr
> >> Lead Infrastructure Engineer
> >>
> >> USA & CAN Office: +1 (541) 306 3271
> >> USA & CAN Support: +1 (541) 706 9393
> >> UK Office & Support: +44 (0)203 282 1633
> >> AUS Office & Support: +61 (0) 2 8417 2339
> >>
> >> 543 NW York Drive, Suite 100, Bend, OR 97703
> >>
> >> LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
> >> <https://twitter.com/ManzamaInc> | Facebook
> >> <http://www.facebook.com/manzamainc> | YouTube
> >> <https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
> >>
> >>
> >>> On Tue, Aug 20, 2019 at 1:49 PM Jörn Franke <jo...@gmail.com>
> wrote:
> >>>
> >>> You should definitely enable HTTPs even if it is not exposed to the
> >>> Internet. Even within your own company network it is a good security
> >>> practice to enable HTTPs.
> >>> About your error. This is due to a setting in Zookeeper:
> >>>
> >>>
> https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html#EnablingSSL-ConfigureZooKeeper
> >>>
> >>> I do not recommend to do any setting for SolrCloud directly in
> Zookeeper,
> >>> but use the corresponding Solr REST interfaces, e.g. for urlScheme in
> >>> clusterprops.json
> >>>
> >>>
> https://lucene.apache.org/solr/guide/8_1/collections-api.html#clusterprop-parameters
> >>>
> >>>> Am 20.08.2019 um 21:46 schrieb Russell Bahr <ru...@manzama.com>:
> >>>>
> >>>> Hi All,
> >>>> I have a solr 8.1.1 cloud that I set up and have been testing to
> replace
> >>>> our solr 4.10.4 cloud implementation.
> >>>>
> >>>> I have been testing on the solr 8.1.1 cloud for a couple of weeks now
> >>> and
> >>>> needed to shut down temporarily and then restart the cluster. When I
> >>> did
> >>>> this the members would not come back from recovering. As I trouble
> shot
> >>>> further I noticed the follwoing error messages
> >>>> "null:org.apache.solr.common.SolrException:
> >>>> Error trying to proxy request for url:
> >>>> https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/"
> >>> . I
> >>>> have not enabled security on this as it is behind a firewall and not
> >>>> exposed to the outside.
> >>>>
> >>>> solr 8.1.1
> >>>> lucene 8.1.1
> >>>> OpenJDK 12
> >>>> Debian 9.8
> >>>>
> >>>> 6 shards, 5 replica each shard
> >>>>
> >>>> here is a snip from the solr cloud graph. as you can see some are
> >>> listing
> >>>> https now and some still show http as it was before the restart.
> >>>>
> >>>> shard1
> >>>> https://p-solr-e-be-d-20.c.domain.internal (N)
> >>>> http://p-solr-e-be-d-16.c.domain.internal (N)
> >>>> https://p-solr-e-be-d-17.c.domain.internal (N)
> >>>> https://p-solr-e-be-d-28.c.domain.internal (N)
> >>>> https://p-solr-e-be-d-23.c.domain.internal (N)
> >>>>
> >>>> What would cause them to all of the sudden require https, and how do I
> >>>> disable that and return to http?
> >>>>
> >>>> Thank you,
> >>>>
> >>>> Russ Bahr
> >>>
> >>
>
Re: sorl 8.1.1 all of sudden requiring https
Posted by Jörn Franke <jo...@gmail.com>.
This is strange that it does not work. Have you checked the logs if there is a different error message?
Here is the guide:
https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html
Please do not use self signed certificates, but certificates signed by the CA of your company.
> Am 21.08.2019 um 01:00 schrieb Russell Bahr <ru...@manzama.com>:
>
> I was able to change this setting in Zookeeper, and also using the Solr
> REST interface. But even after restarting and verifying that the urlScheme
> in clusterprops.json had http and not https, each of the servers still are
> trying to talk to eachother and on the Cloud Graph are still showing as
> https. I am going to try to set up security and see if things are back to
> working properly after I do that. Is there a step by step guide or video
> how to on setting up ssl on solr cloud with external zookeeper? I have
> searched and not found anything for 6.6 or newer to follow. hopefully
> something specific to 8.1. Can you recommend something?
>
>
> *Manzama*a MODERN GOVERNANCE company
>
> Russell Bahr
> Lead Infrastructure Engineer
>
> USA & CAN Office: +1 (541) 306 3271
> USA & CAN Support: +1 (541) 706 9393
> UK Office & Support: +44 (0)203 282 1633
> AUS Office & Support: +61 (0) 2 8417 2339
>
> 543 NW York Drive, Suite 100, Bend, OR 97703
>
> LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
> <https://twitter.com/ManzamaInc> | Facebook
> <http://www.facebook.com/manzamainc> | YouTube
> <https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
>
>
>> On Tue, Aug 20, 2019 at 2:31 PM Russell Bahr <ru...@manzama.com> wrote:
>>
>> I am a very new to both solr and zookeeper. I have inherited the existing
>> clusters from my predecessor without any training or explanation before he
>> left. I have modeled the new zookeepers and solr cloud off of the basic
>> configuration that was in place in the existing cluster and zookeepers.
>>
>> I loaded my collection into zookeeper, but did not set any security in
>> zookeeper. is this possibly a bug in zookeeper then? how would I change
>> it back to http for the time being to complete my other testing? If I do
>> enable HTTPs will I have to rebuild anyway?
>>
>> *Manzama*
>> a MODERN GOVERNANCE company
>>
>> Russell Bahr
>> Lead Infrastructure Engineer
>>
>> USA & CAN Office: +1 (541) 306 3271
>> USA & CAN Support: +1 (541) 706 9393
>> UK Office & Support: +44 (0)203 282 1633
>> AUS Office & Support: +61 (0) 2 8417 2339
>>
>> 543 NW York Drive, Suite 100, Bend, OR 97703
>>
>> LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
>> <https://twitter.com/ManzamaInc> | Facebook
>> <http://www.facebook.com/manzamainc> | YouTube
>> <https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
>>
>>
>>> On Tue, Aug 20, 2019 at 1:49 PM Jörn Franke <jo...@gmail.com> wrote:
>>>
>>> You should definitely enable HTTPs even if it is not exposed to the
>>> Internet. Even within your own company network it is a good security
>>> practice to enable HTTPs.
>>> About your error. This is due to a setting in Zookeeper:
>>>
>>> https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html#EnablingSSL-ConfigureZooKeeper
>>>
>>> I do not recommend to do any setting for SolrCloud directly in Zookeeper,
>>> but use the corresponding Solr REST interfaces, e.g. for urlScheme in
>>> clusterprops.json
>>>
>>> https://lucene.apache.org/solr/guide/8_1/collections-api.html#clusterprop-parameters
>>>
>>>> Am 20.08.2019 um 21:46 schrieb Russell Bahr <ru...@manzama.com>:
>>>>
>>>> Hi All,
>>>> I have a solr 8.1.1 cloud that I set up and have been testing to replace
>>>> our solr 4.10.4 cloud implementation.
>>>>
>>>> I have been testing on the solr 8.1.1 cloud for a couple of weeks now
>>> and
>>>> needed to shut down temporarily and then restart the cluster. When I
>>> did
>>>> this the members would not come back from recovering. As I trouble shot
>>>> further I noticed the follwoing error messages
>>>> "null:org.apache.solr.common.SolrException:
>>>> Error trying to proxy request for url:
>>>> https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/"
>>> . I
>>>> have not enabled security on this as it is behind a firewall and not
>>>> exposed to the outside.
>>>>
>>>> solr 8.1.1
>>>> lucene 8.1.1
>>>> OpenJDK 12
>>>> Debian 9.8
>>>>
>>>> 6 shards, 5 replica each shard
>>>>
>>>> here is a snip from the solr cloud graph. as you can see some are
>>> listing
>>>> https now and some still show http as it was before the restart.
>>>>
>>>> shard1
>>>> https://p-solr-e-be-d-20.c.domain.internal (N)
>>>> http://p-solr-e-be-d-16.c.domain.internal (N)
>>>> https://p-solr-e-be-d-17.c.domain.internal (N)
>>>> https://p-solr-e-be-d-28.c.domain.internal (N)
>>>> https://p-solr-e-be-d-23.c.domain.internal (N)
>>>>
>>>> What would cause them to all of the sudden require https, and how do I
>>>> disable that and return to http?
>>>>
>>>> Thank you,
>>>>
>>>> Russ Bahr
>>>
>>
Re: sorl 8.1.1 all of sudden requiring https
Posted by Russell Bahr <ru...@manzama.com>.
I was able to change this setting in Zookeeper, and also using the Solr
REST interface. But even after restarting and verifying that the urlScheme
in clusterprops.json had http and not https, each of the servers still are
trying to talk to eachother and on the Cloud Graph are still showing as
https. I am going to try to set up security and see if things are back to
working properly after I do that. Is there a step by step guide or video
how to on setting up ssl on solr cloud with external zookeeper? I have
searched and not found anything for 6.6 or newer to follow. hopefully
something specific to 8.1. Can you recommend something?
*Manzama*a MODERN GOVERNANCE company
Russell Bahr
Lead Infrastructure Engineer
USA & CAN Office: +1 (541) 306 3271
USA & CAN Support: +1 (541) 706 9393
UK Office & Support: +44 (0)203 282 1633
AUS Office & Support: +61 (0) 2 8417 2339
543 NW York Drive, Suite 100, Bend, OR 97703
LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
<https://twitter.com/ManzamaInc> | Facebook
<http://www.facebook.com/manzamainc> | YouTube
<https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
On Tue, Aug 20, 2019 at 2:31 PM Russell Bahr <ru...@manzama.com> wrote:
> I am a very new to both solr and zookeeper. I have inherited the existing
> clusters from my predecessor without any training or explanation before he
> left. I have modeled the new zookeepers and solr cloud off of the basic
> configuration that was in place in the existing cluster and zookeepers.
>
> I loaded my collection into zookeeper, but did not set any security in
> zookeeper. is this possibly a bug in zookeeper then? how would I change
> it back to http for the time being to complete my other testing? If I do
> enable HTTPs will I have to rebuild anyway?
>
> *Manzama*
> a MODERN GOVERNANCE company
>
> Russell Bahr
> Lead Infrastructure Engineer
>
> USA & CAN Office: +1 (541) 306 3271
> USA & CAN Support: +1 (541) 706 9393
> UK Office & Support: +44 (0)203 282 1633
> AUS Office & Support: +61 (0) 2 8417 2339
>
> 543 NW York Drive, Suite 100, Bend, OR 97703
>
> LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
> <https://twitter.com/ManzamaInc> | Facebook
> <http://www.facebook.com/manzamainc> | YouTube
> <https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
>
>
> On Tue, Aug 20, 2019 at 1:49 PM Jörn Franke <jo...@gmail.com> wrote:
>
>> You should definitely enable HTTPs even if it is not exposed to the
>> Internet. Even within your own company network it is a good security
>> practice to enable HTTPs.
>> About your error. This is due to a setting in Zookeeper:
>>
>> https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html#EnablingSSL-ConfigureZooKeeper
>>
>> I do not recommend to do any setting for SolrCloud directly in Zookeeper,
>> but use the corresponding Solr REST interfaces, e.g. for urlScheme in
>> clusterprops.json
>>
>> https://lucene.apache.org/solr/guide/8_1/collections-api.html#clusterprop-parameters
>>
>> > Am 20.08.2019 um 21:46 schrieb Russell Bahr <ru...@manzama.com>:
>> >
>> > Hi All,
>> > I have a solr 8.1.1 cloud that I set up and have been testing to replace
>> > our solr 4.10.4 cloud implementation.
>> >
>> > I have been testing on the solr 8.1.1 cloud for a couple of weeks now
>> and
>> > needed to shut down temporarily and then restart the cluster. When I
>> did
>> > this the members would not come back from recovering. As I trouble shot
>> > further I noticed the follwoing error messages
>> > "null:org.apache.solr.common.SolrException:
>> > Error trying to proxy request for url:
>> > https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/"
>> . I
>> > have not enabled security on this as it is behind a firewall and not
>> > exposed to the outside.
>> >
>> > solr 8.1.1
>> > lucene 8.1.1
>> > OpenJDK 12
>> > Debian 9.8
>> >
>> > 6 shards, 5 replica each shard
>> >
>> > here is a snip from the solr cloud graph. as you can see some are
>> listing
>> > https now and some still show http as it was before the restart.
>> >
>> > shard1
>> > https://p-solr-e-be-d-20.c.domain.internal (N)
>> > http://p-solr-e-be-d-16.c.domain.internal (N)
>> > https://p-solr-e-be-d-17.c.domain.internal (N)
>> > https://p-solr-e-be-d-28.c.domain.internal (N)
>> > https://p-solr-e-be-d-23.c.domain.internal (N)
>> >
>> > What would cause them to all of the sudden require https, and how do I
>> > disable that and return to http?
>> >
>> > Thank you,
>> >
>> > Russ Bahr
>>
>
Re: sorl 8.1.1 all of sudden requiring https
Posted by Russell Bahr <ru...@manzama.com>.
I am a very new to both solr and zookeeper. I have inherited the existing
clusters from my predecessor without any training or explanation before he
left. I have modeled the new zookeepers and solr cloud off of the basic
configuration that was in place in the existing cluster and zookeepers.
I loaded my collection into zookeeper, but did not set any security in
zookeeper. is this possibly a bug in zookeeper then? how would I change
it back to http for the time being to complete my other testing? If I do
enable HTTPs will I have to rebuild anyway?
*Manzama*
a MODERN GOVERNANCE company
Russell Bahr
Lead Infrastructure Engineer
USA & CAN Office: +1 (541) 306 3271
USA & CAN Support: +1 (541) 706 9393
UK Office & Support: +44 (0)203 282 1633
AUS Office & Support: +61 (0) 2 8417 2339
543 NW York Drive, Suite 100, Bend, OR 97703
LinkedIn <http://www.linkedin.com/company/manzama> | Twitter
<https://twitter.com/ManzamaInc> | Facebook
<http://www.facebook.com/manzamainc> | YouTube
<https://www.youtube.com/channel/UCBo3QoqewyNoo7HiT_BFuRw>
On Tue, Aug 20, 2019 at 1:49 PM Jörn Franke <jo...@gmail.com> wrote:
> You should definitely enable HTTPs even if it is not exposed to the
> Internet. Even within your own company network it is a good security
> practice to enable HTTPs.
> About your error. This is due to a setting in Zookeeper:
>
> https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html#EnablingSSL-ConfigureZooKeeper
>
> I do not recommend to do any setting for SolrCloud directly in Zookeeper,
> but use the corresponding Solr REST interfaces, e.g. for urlScheme in
> clusterprops.json
>
> https://lucene.apache.org/solr/guide/8_1/collections-api.html#clusterprop-parameters
>
> > Am 20.08.2019 um 21:46 schrieb Russell Bahr <ru...@manzama.com>:
> >
> > Hi All,
> > I have a solr 8.1.1 cloud that I set up and have been testing to replace
> > our solr 4.10.4 cloud implementation.
> >
> > I have been testing on the solr 8.1.1 cloud for a couple of weeks now and
> > needed to shut down temporarily and then restart the cluster. When I did
> > this the members would not come back from recovering. As I trouble shot
> > further I noticed the follwoing error messages
> > "null:org.apache.solr.common.SolrException:
> > Error trying to proxy request for url:
> > https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/" .
> I
> > have not enabled security on this as it is behind a firewall and not
> > exposed to the outside.
> >
> > solr 8.1.1
> > lucene 8.1.1
> > OpenJDK 12
> > Debian 9.8
> >
> > 6 shards, 5 replica each shard
> >
> > here is a snip from the solr cloud graph. as you can see some are
> listing
> > https now and some still show http as it was before the restart.
> >
> > shard1
> > https://p-solr-e-be-d-20.c.domain.internal (N)
> > http://p-solr-e-be-d-16.c.domain.internal (N)
> > https://p-solr-e-be-d-17.c.domain.internal (N)
> > https://p-solr-e-be-d-28.c.domain.internal (N)
> > https://p-solr-e-be-d-23.c.domain.internal (N)
> >
> > What would cause them to all of the sudden require https, and how do I
> > disable that and return to http?
> >
> > Thank you,
> >
> > Russ Bahr
>
Re: sorl 8.1.1 all of sudden requiring https
Posted by Jörn Franke <jo...@gmail.com>.
You should definitely enable HTTPs even if it is not exposed to the Internet. Even within your own company network it is a good security practice to enable HTTPs.
About your error. This is due to a setting in Zookeeper:
https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html#EnablingSSL-ConfigureZooKeeper
I do not recommend to do any setting for SolrCloud directly in Zookeeper, but use the corresponding Solr REST interfaces, e.g. for urlScheme in clusterprops.json
https://lucene.apache.org/solr/guide/8_1/collections-api.html#clusterprop-parameters
> Am 20.08.2019 um 21:46 schrieb Russell Bahr <ru...@manzama.com>:
>
> Hi All,
> I have a solr 8.1.1 cloud that I set up and have been testing to replace
> our solr 4.10.4 cloud implementation.
>
> I have been testing on the solr 8.1.1 cloud for a couple of weeks now and
> needed to shut down temporarily and then restart the cluster. When I did
> this the members would not come back from recovering. As I trouble shot
> further I noticed the follwoing error messages
> "null:org.apache.solr.common.SolrException:
> Error trying to proxy request for url:
> https://p-solr-e-be-d-20.c.domain.internal:8983/solr/content/select/" . I
> have not enabled security on this as it is behind a firewall and not
> exposed to the outside.
>
> solr 8.1.1
> lucene 8.1.1
> OpenJDK 12
> Debian 9.8
>
> 6 shards, 5 replica each shard
>
> here is a snip from the solr cloud graph. as you can see some are listing
> https now and some still show http as it was before the restart.
>
> shard1
> https://p-solr-e-be-d-20.c.domain.internal (N)
> http://p-solr-e-be-d-16.c.domain.internal (N)
> https://p-solr-e-be-d-17.c.domain.internal (N)
> https://p-solr-e-be-d-28.c.domain.internal (N)
> https://p-solr-e-be-d-23.c.domain.internal (N)
>
> What would cause them to all of the sudden require https, and how do I
> disable that and return to http?
>
> Thank you,
>
> Russ Bahr