Setting up ZooKeeper access control lists with Solr

By default anyone has the permission to do anything with the Solr content stored in ZooKeeper. Protect the Solr content in ZooKeeper by setting up a more restrictive Access control list (ACL).

1. Stop the Solr service on all nodes:
   For Ubuntu:

   systemctl stop solr

   For RHEL:

   service solr stop

2. Connect to one of the Solr nodes and change to the root user, if this is not already the case:

   sudo su -

3. Edit the solr.xml file:

   nano /opt/solr/server/solr/solr.xml

4. In the <solrcloud> section of the solr.xml file change the default settings as follows (changes are marked in bold):

   <str name="zkCredentialsProvider">${zkCredentialsProvider:
   org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider}</str>
   <str name="zkACLProvider">${zkACLProvider:
   org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider}</str>

5. Save your changes and exit the editor.
6. Edit the solr.in.sh file:

   nano /etc/default/solr.in.sh

7. Uncomment the following lines in the solr.in.sh file and replace the passwords with ones you choose to enable the ACL and credentials providers:

   #SOLR_ZK_CREDS_AND_ACLS="-DzkACLProvider=org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider \
   #  -DzkCredentialsProvider=
   org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider \
   #  -DzkDigestUsername=admin-user -DzkDigestPassword=CHANGEME-ADMIN-PASSWORD \
   #  -DzkDigestReadonlyUsername=readonly-user -DzkDigestReadonlyPassword=CHANGEME-READONLY-PASSWORD"
   #SOLR_OPTS="$SOLR_OPTS $SOLR_ZK_CREDS_AND_ACLS"

8. Save your changes and exit the editor.
9. Edit the zkcli.sh file:

   nano /opt/solr/server/scripts/cloud-scripts/zkcli.sh

10. Uncomment the following lines in the zkcli.sh file and replace the passwords with ones you choose to enable the ACL and credentials providers:

    #SOLR_ZK_CREDS_AND_ACLS="-DzkACLProvider=org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider \
    #  -DzkCredentialsProvider=
    org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider \
    #  -DzkDigestUsername=admin-user -DzkDigestPassword=CHANGEME-ADMIN-PASSWORD \
    #  -DzkDigestReadonlyUsername=readonly-user -DzkDigestReadonlyPassword=CHANGEME-READONLY-PASSWORD"

11. Save your changes and exit the editor.
12. Repeat the steps 3 to 8 on all other Solr nodes.
13. Start the Solr service on all nodes:
    For Ubuntu:

    systemctl start solr

    For RHEL:

    service solr start