Restricting IP addresses for Jetty and Solr

solr ip jetty restriction

17,650

Solution 1

Solr 4.2.1 uses Jetty 8.1.8. Jetty 8 (as noted by jonas789) doesn't support .htaccess. Instead, it uses IPAccessHandler, which doesn't have great documentation available. I had to play with it quite a bit to get it work, so I'm posting an updated solution here.

IPAccessHandler manages a blacklist and a whitelist, accepts arbitrary ranges of IPs, and supports attaching specific URI paths to each white/black -list entry. IPAccessHandler also subclasses HandlerWrapper, which turns out to be important.

The solr app still lives in a WebAppContext (as in Lyndsay's solution), but a WebAppContext is now governed by a ContextHandler, which resides in a ContextHandlerCollection occupying the first handler slot in the server. To stop requests from the wrong IP from getting to the app, we need to wrap it inside an IPAccessHandler somewhere along that path. IPAccessHandler behaves oddly if it's in the wrong spot: I tried inserting it before the context handlers and it gave 403 Forbidden to the wrong machines, threw NullPointerException tantrums with no additional error messages, all sorts of nonsense. I finally got it to work by wrapping the ContextHandlerCollection itself, at the server level.

Go to etc/jetty.xml and scroll to the handlers section. Then wrap the existing ContextHandlerCollection item as follows:

<!-- =========================================================== -->
<!-- Set handler Collection Structure                            --> 
<!-- =========================================================== -->
<Set name="handler">
  <New id="Handlers" class="org.eclipse.jetty.server.handler.HandlerCollection">
    <Set name="handlers">
     <Array type="org.eclipse.jetty.server.Handler">
   <Item>

     <!-- here begins the new stuff -->
     <New class="org.eclipse.jetty.server.handler.IPAccessHandler">
       <Call name="addWhite">
         <Arg>xxx.xxx.xxx.xxx</Arg>
       </Call>
       <Set name="handler">
         <!-- here's where you put what was there before: -->
         <New id="Contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection"/>
       </Set>
     </New>
     <!-- here ends the new stuff -->

   </Item>
       <Item>
         <New id="DefaultHandler" class="org.eclipse.jetty.server.handler.DefaultHandler"/>
       </Item>
       <Item>
         <New id="RequestLog" class="org.eclipse.jetty.server.handler.RequestLogHandler"/>
       </Item>
     </Array>
    </Set>
  </New>
</Set>

Resources:

Solution 2

I found the solution.

Firstly, extract the contents of solr.war in the example/webapps folder. Then create a file called .htaccess and place it in the example/webapps/solr folder (the one you just extracted) containing the following:

<Limit>
    satisfy all
    order deny,allow
    deny from all
    allow from xxx.xxx.xxx.xxx
</Limit>

In example/etc/ edit the jetty.xml file and comment out the org.mortbay.jetty.deployer.WebAppDeployer part. Then finally create a folder in example/ called contexts (if one does not yet exist) and add a file called solr.xml to it containing:

<Configure id="solr" class="org.mortbay.jetty.webapp.WebAppContext">
    <Set name="resourceBase"><SystemProperty name="jetty.home" default="."/>/webapps/solr</Set>
    <Set name="contextPath">/solr</Set>
    <Call name="setSecurityHandler">
        <Arg>
            <New class="org.mortbay.jetty.security.HTAccessHandler">
                <Set name="protegee">
                    <Ref id="solr"/>
                </Set>
            </New>
        </Arg>
    </Call>
</Configure>

Then start up your new secure solr!

17,650

Author by

Lyndsay

Updated on June 04, 2022

Comments

Lyndsay about 2 years

I'm setting up Solr using Jetty. I would like to restrict access to only a few IP addresses. It doesn't seem immediately obvious that this can be done using Jetty. Is it possible and if so, how?
jonas789 over 12 years

For others, this won't work in the newer versions of Jetty hosted at eclipse. Basically there is no more HTAccessHandler. Reference: jetty.4.n6.nabble.com/…
Hakim almost 11 years

I have tried it and it works perfect! It blocks access to solr admin & to the client used from other hosts than the one used by you.
David Smiley over 7 years

I independently arrives at this same solution; I didn't find this first. FYI this IPAccessHandler thing only works with IPv4 -- it's a bug/limitation. So when starting Java, pass: -Djava.net.preferIPv4Stack=true. And for those looking for suggested rules, mine look like this: <Item>127.0.0.1</Item> <Item>-.-.-.-|/solr/techproducts/select</Item> Thus localhost can do anything, and everyone else is severely restricted to a certain "core" and /select Solr RequestHandler.