Securing Apache Solr - part II

This is the second post in a series of articles on securing Apache Solr. The first post looked at setting up a sample SolrCloud instance and securing access to it via Basic Authentication. In this post we will temporarily deviate from the concept of "securing Apache Solr", and instead look at how the Apache Ranger admin service can be configured to store audit information in Apache Solr.

1) Download and extract the Apache Ranger admin service

The first step is to download the source code, as well as the signature file and associated message digests (all available on the download page). Verify that the signature is valid and that the message digests match. Now extract and build the source, and copy the resulting admin archive to a location where you wish to install the UI:

• tar zxvf apache-ranger-incubating-1.0.0.tar.gz
• cd apache-ranger-incubating-1.0.0
• mvn clean package assembly:assembly 
• tar zxvf target/ranger-1.0.0-admin.tar.gz
• mv ranger-1.0.0-admin ${rangerhome}

2) Install MySQL

The Apache Ranger Admin UI requires a database to keep track of users/groups as well as policies for various big data projects that you are securing via Ranger. For the purposes of this tutorial, we will use MySQL. Install MySQL in $SQL_HOME and start MySQL via:

• sudo $SQL_HOME/bin/mysqld_safe --user=mysql

Now you need to log on as the root user and create two users for Ranger. We need a root user with admin privileges (let's call this user "admin") and a user for the Ranger Schema (we'll call this user "ranger"):

• CREATE USER 'admin'@'localhost' IDENTIFIED BY 'password';
• GRANT ALL PRIVILEGES ON * . * TO 'admin'@'localhost' WITH GRANT OPTION;
• CREATE USER 'ranger'@'localhost' IDENTIFIED BY 'password';
• FLUSH PRIVILEGES;

Finally,  download the JDBC driver jar for MySQL and put it in ${rangerhome}.

3) Configure Apache Solr to support auditing from Ranger

Before installing the Apache Ranger admin service we will need to configure Apache Solr. The Apache Ranger admin service ships with a script to make this easier to configure. Edit 'contrib/solr_for_audit_setup/install.properties' with the following properties:

• SOLR_USER/SOLR_GROUP - the user/group you are running solr as
• SOLR_INSTALL_FOLDER - Where you have extracted Solr to as per the first tutorial.
• SOLR_RANGER_HOME - Where to install the Ranger configuration for Solr auditing.
• SOLR_RANGER_PORT - The port to be used (8983 as per the first tutorial).
• SOLR_DEPLOYMENT - solrcloud
• SOLR_HOST_URL - http://localhost:8983
• SOLR_ZK - localhost:2181

Make sure that the user running Solr has permission to write to the value configured for "SOLR_LOG_FOLDER" (/var/log/solr/ranger_audits). Now in 'contrib/solr_for_audit_setup' run 'sudo -E ./setup.sh'. The Solr configuration is now copied to $SOLR_RANGER_HOME.

4) Start Apache Zookeeper and SolrCloud

Before starting Apache Solr we will need to start Apache Zookeeper. Download Apache Zookeeper and start it on port 2181 via (this step was not required in the previous tutorial as we were launching SolrCloud with an embedded Zookeeper instance):

• bin/zkServer.sh start

As per the first post, we want to secure access to SolrCloud via Basic Authentication (note that this is only recently fixed in Apache Ranger). So follow the steps in this post to upload the security.json to Zookeeper via:

• server/scripts/cloud-scripts/zkcli.sh -zkhost localhost:2181 -cmd putfile /security.json security.json

Start Solr as follows in the '${SOLR_RANGER_HOME}/ranger_audit_server/scripts' directory:

• ./add_ranger_audits_conf_to_zk.sh 
• ./start_solr.sh

Edit 'create_ranger_audits_collection.sh' and change 'curl --negotiate -u :' to 'curl -u "alice:SolrRocks"'. Save it and then run:

• ./create_ranger_audits_collection.sh

5) Install the Apache Ranger Admin UI

Edit ${rangerhome}/install.properties and make the following changes:

• Change SQL_CONNECTOR_JAR to point to the MySQL JDBC driver jar that you downloaded above.
• Set (db_root_user/db_root_password) to (admin/password)
• Set (db_user/db_password) to (ranger/password)
• audit_solr_urls: http://localhost:8983/solr/ranger_audits
• audit_solr_user: alice
• audit_solr_password: SolrRocks
• audit_solr_zookeepers: localhost:2181

Now you can run the setup script via "sudo -E ./setup.sh". When this is done then start the Apache Ranger admin service via: "sudo ranger-admin start".

6) Test that auditing is working correctly in the Ranger Admin service

Open a browser and navigate to "http://localhost:6080". Try to log on first using some made up credentials. Then log in using "admin/admin". Click on the "Audit" tab and then select "Login Sessions". You should see the incorrect and the correct login attempts, meaning that ranger is successfully storing and retrieving audit information in Solr: