CODEWITHSUNDEEP
securityencryptionsolrsolr4
Piotr Tempes
Piotr Tempes

Reputation: 1161

Solr files security

During my solr POC I noticed solr stores data in files in human readable format. So naturally I started to think about security and here are my questions regarding this:

  1. If I mark non sensitive data as indexed and stored and all sensitive data will be marked only as indexed - would it be a lie to tell that data is secured?
  2. Should I do anything else to ensure data security? I read somewhere that using encrypted filesystem is a good thing to do, but is it really good enough? Or even necessary if I do not store sensitive data?

Upvotes: 1

Views: 132

Answers (1)

Piotr Tempes
Piotr Tempes

Reputation: 1161

After couple of meetings and thinking this through we decided that these questions are not relevant at all. As randomstatistic pointed out - it depends on who do we really like to protect our resources from.

I need to give a little background - One of managers asked a question whether it is possible to extract usernames (if we index them) from solr files. So this was a source of this post... and the answer is yes. Transaction logs created by solr contains plain text entries. So person who breaks into a system can see them. But if it happens there is more serious problem than to encrypt solr or not :) so basically you can mount an encrypted filesystem for solr files that only solr process has unencrypted access to... and this is fine, but honestly in my opinion access to these files should only have solr user (linux user) and of course login and password should be protected.

P.S. In our case we have SolrCloud and we also setup SSL and Authentication + Authorization.

Upvotes: 2

Related Questions