Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a php-application which connects to another app called Solr (database search engine). I can via this php app add/remove documents (records) from the Solr index.

However, the Solr security is low, and anybody with the right port nr can access Solr and remove documents (records).

I wonder, is it possible to ONLY allow my own php-app to have access to Solr somehow? Prefferably via Iptables. I am thinking I can only allow my own servers IP to that port, and it would solve my problem, because PHP is a server-side code. But I am not sure.

About the Php-app:
The website is a classifieds website, and when users wants to add or remove classifieds, they do so through a php app, which is this one. The app has a function which connects to solr and updates the database (index).

I appreciate detailed answers...

Thanks

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You cannot do that with iptables. Your best bet is using something in solr

http://wiki.apache.org/solr/SolrSecurity

share|improve this answer

No you can't control what application connects to a specific port, even on the local machine (you can do this with file permissions and Unix domain sockets - but not across a network).

Yes, you should restrict network access onthe SOLR port to a specific white-list. And if there are machines connecting from outside the local LAN, consider using IPSEC or a VPN and restricting access to that.

Alternatively, for remote access you might consider disallowing ALL access to the SOLR port, except for the localhost then running stunnel at both ends and require client certificate validation - and run your own snake oil CA if required.

HTH

C.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.