Solr; "rookie" question

Question

I have a SolrPhpClient on my classifieds website, and whenever users wants to add/remove classified the index in Solr gets updated via Php code.

So I wonder, does this mean that my Solr index is open for anybody to alter with?

Same Q applies to the Solr Admin page. If I set a password for the admin page, does this mean that my classifieds website wont have access to updating/removing documents from the Solr index?

Thanks

Answer 1

If your Solr instance is available to the public so that anyone can make an http connection to it, you are vulnerable.

Think of Solr as a back-end service (like your MySql database). You should prevent all public access to the Solr instance. You can run a firewall or do some IPTables magic to allow only your PHP application to connect to Solr (and obviously your administrator to connect to the admin interface).