CIS Apache Solr Benchmark

This recommendation verifies that Solr is running the latest stable version on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Solr version
curl -s http://localhost:8983/solr/admin/info/system | python3 -m json.tool | grep -E 'solr-spec-version|lucene-spec-version'

# Update Solr to latest stable
cd /opt
wget https://downloads.apache.org/solr/solr-9.x.x/solr-9.x.x.tgz
tar xzf solr-9.x.x.tgz
./solr-9.x.x/bin/install_solr_service.sh solr-9.x.x.tgz
systemctl restart solr

This recommendation verifies that Solr runs as a dedicated non-root user on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Solr runs as dedicated user
ps -eo user,pid,comm | grep solr
grep '^SOLR_USER=' /etc/default/solr.in.sh

# Configure dedicated user
useradd -r -s /usr/sbin/nologin solr
chown -R solr:solr /var/solr /opt/solr
# In /etc/default/solr.in.sh:
SOLR_USER="solr"

This recommendation verifies that authentication is enabled with blockUnknown on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication enabled
grep -r 'authenticationPlugin' /var/solr/data/security.json 2>/dev/null
curl -s http://localhost:8983/solr/admin/authentication

# Enable BasicAuth
cat > /var/solr/data/security.json << 'EOF'
{
  "authentication": {
    "blockUnknown": true,
    "class": "solr.BasicAuthPlugin",
    "credentials": {}
  },
  "authorization": {
    "class": "solr.RuleBasedAuthorizationPlugin",
    "permissions": [{"name": "security-edit", "role": "admin"}],
    "user-role": {"solradmin": "admin"}
  }
}
EOF
chown solr:solr /var/solr/data/security.json

This recommendation verifies that role-based authorization is configured on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Solr authorization rules
curl -s -u admin:pass http://localhost:8983/solr/admin/authorization | python3 -m json.tool

# Configure role-based authorization
curl -s -u admin:pass http://localhost:8983/solr/admin/authorization \
  -H 'Content-Type: application/json' \
  -d '{
    "set-permission": {"name": "read", "role": "reader"},
    "set-permission": {"name": "update", "role": "writer"},
    "set-permission": {"name": "all", "role": "admin"}
  }'

This recommendation verifies that TLS is enabled for all Solr endpoints on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration
grep -E 'SOLR_SSL_|solr.ssl' /etc/default/solr.in.sh
curl -s https://localhost:8983/solr/ -k

# Configure TLS in /etc/default/solr.in.sh:
SOLR_SSL_ENABLED=true
SOLR_SSL_KEY_STORE=/opt/solr/server/etc/solr-ssl.keystore.p12
SOLR_SSL_KEY_STORE_PASSWORD=changeit
SOLR_SSL_KEY_STORE_TYPE=PKCS12
SOLR_SSL_TRUST_STORE=/opt/solr/server/etc/solr-ssl.truststore.p12
SOLR_SSL_TRUST_STORE_PASSWORD=changeit
SOLR_SSL_NEED_CLIENT_AUTH=false
SOLR_SSL_WANT_CLIENT_AUTH=false
SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION=true

This recommendation verifies that ZooKeeper connections use digest authentication on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ZooKeeper connection security
grep -E 'ZK_HOST|zkACLProvider|zkCredentialsInjector' /etc/default/solr.in.sh

# Secure ZooKeeper communication
# In /etc/default/solr.in.sh:
SOLR_ZK_CREDS_AND_ACLS="-DzkACLProvider=org.apache.solr.common.cloud.DigestZkACLProvider \
  -DzkCredentialsProvider=org.apache.solr.common.cloud.DigestZkCredentialsProvider \
  -DzkDigestUsername=admin -DzkDigestPassword=secureZKpass"
# Add to SOLR_OPTS:
SOLR_OPTS="$SOLR_OPTS $SOLR_ZK_CREDS_AND_ACLS"

This recommendation verifies that audit logging with rotation is configured on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Solr logging configuration
cat /opt/solr/server/resources/log4j2.xml | grep -E 'Root level|Appender'

# Configure audit logging in log4j2.xml
# Add audit appender:
<RollingFile name="AuditFile" fileName="/var/solr/logs/audit.log"
  filePattern="/var/solr/logs/audit-%d{yyyy-MM-dd}.log.gz">
  <PatternLayout pattern="%d %-5p [%t] %c{1.} - %m%n"/>
  <Policies>
    <TimeBasedTriggeringPolicy interval="1"/>
    <SizeBasedTriggeringPolicy size="100MB"/>
  </Policies>
  <DefaultRolloverStrategy max="30"/>
</RollingFile>

This recommendation verifies that slow query logging is enabled on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check request logging
grep -E 'solr.log.dir|slowQueryThresholdMillis' /etc/default/solr.in.sh
ls -la /var/solr/logs/

# Configure request logging
# In /etc/default/solr.in.sh:
SOLR_LOGS_DIR=/var/solr/logs
SOLR_LOG_LEVEL=WARN
# In solrconfig.xml per collection:
<slowQueryThresholdMillis>1000</slowQueryThresholdMillis>
# Configure log rotation:
find /var/solr/logs -name '*.log' -mtime +30 -delete

This recommendation ensures that Solr binds only to required interfaces on the Apache Solr search platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Apache Solr search platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check network binding
grep 'SOLR_HOST\|SOLR_PORT\|SOLR_JETTY_HOST' /etc/default/solr.in.sh
ss -tlnp | grep -E '8983|8984'

# Restrict network binding
# In /etc/default/solr.in.sh:
SOLR_HOST=solr.internal
SOLR_PORT=8983
SOLR_JETTY_HOST=127.0.0.1
# Use firewall to restrict access:
ufw allow from 10.0.0.0/8 to any port 8983

This recommendation verifies that JVM heap and OS resource limits are configured on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check resource limits
grep -E 'SOLR_HEAP|GC_|SOLR_JAVA_MEM' /etc/default/solr.in.sh
ulimit -a | grep -E 'open files|max user'

# Configure resource limits
# In /etc/default/solr.in.sh:
SOLR_HEAP="512m"
SOLR_JAVA_MEM="-Xms512m -Xmx1024m"
GC_LOG_OPTS="-verbose:gc"
# In /etc/security/limits.d/solr.conf:
solr soft nofile 65000
solr hard nofile 65000
solr soft nproc 65000
solr hard nproc 65000

This setting ensures that data directory permissions are restricted on the Apache Solr search platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache Solr search platform is essential for defense in depth.

# Check data directory permissions
find /var/solr -type f -perm /o=rwx -ls 2>/dev/null | head -20
stat -c '%a %U %G' /var/solr/data

# Restrict data directory permissions
chown -R solr:solr /var/solr
chmod -R 750 /var/solr/data
chmod 640 /var/solr/data/security.json
find /var/solr -type f -exec chmod 640 {} \;

This recommendation verifies that Config API and remote streaming are disabled on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Config API protection
curl -s http://localhost:8983/solr/admin/configs | head -20
grep 'configset.upload.enabled' /etc/default/solr.in.sh

# Restrict Config API
# In /etc/default/solr.in.sh:
SOLR_OPTS="$SOLR_OPTS -Dconfigset.upload.enabled=false"
# Disable remote streaming in solrconfig.xml:
<requestParsers enableRemoteStreaming="false"
  enableStreamBody="false"
  multipartUploadLimitInKB="2048"/>

This recommendation verifies that automated backup procedures are configured on the Apache Solr search platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Solr search platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration
ls -la /var/solr/backups/ 2>/dev/null
curl -s http://localhost:8983/solr/admin/collections?action=LISTBACKUP

# Configure automated backups
mkdir -p /var/solr/backups
chown solr:solr /var/solr/backups
# Use Collections API for backups:
curl -s 'http://localhost:8983/solr/admin/collections?action=BACKUP&name=backup_$(date +%F)&collection=mycore&location=/var/solr/backups'
# Schedule via cron:
0 2 * * * /opt/solr/bin/solr export -query '*:*' -out /var/solr/backups/daily.json

This recommendation verifies that unnecessary response writers and handlers are removed on the Apache Solr search platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apache Solr search platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check for unnecessary handlers
curl -s http://localhost:8983/solr/admin/info/system | grep -E 'mode|solr_home'
find /opt/solr -name 'solrconfig.xml' -exec grep -l 'VelocityResponseWriter' {} \;

# Remove unnecessary features
# In solrconfig.xml, remove/comment:
<!-- <queryResponseWriter name="velocity" class="solr.VelocityResponseWriter"/> -->
# Disable the XSLT response writer:
<!-- <queryResponseWriter name="xslt" class="solr.XSLTResponseWriter"/> -->
# Remove unused request handlers:
# Review and remove /debug/dump, /admin/file handlers if not needed