I have a php-application which connects to another app called Solr (database search engine). I can via this php app add/remove documents (records) from the Solr index.

However, the Solr security is low, and anybody with the right port nr can access Solr and remove documents (records).

I wonder, is it possible to ONLY allow my own php-app to have access to Solr somehow? Prefferably via Iptables. I am thinking I can only allow my own servers IP to that port, and it would solve my problem, because PHP is a server-side code. But I am not sure.

About the Php-app:
The website is a classifieds website, and when users wants to add or remove classifieds, they do so through a php app, which is this one. The app has a function which connects to solr and updates the database (index).

I appreciate detailed answers...



You cannot do that with iptables. Your best bet is using something in solr



No you can't control what application connects to a specific port, even on the local machine (you can do this with file permissions and Unix domain sockets - but not across a network).

Yes, you should restrict network access onthe SOLR port to a specific white-list. And if there are machines connecting from outside the local LAN, consider using IPSEC or a VPN and restricting access to that.

Alternatively, for remote access you might consider disallowing ALL access to the SOLR port, except for the localhost then running stunnel at both ends and require client certificate validation - and run your own snake oil CA if required.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.