Is this safe on a production server?

Question

I have a database application (or search engine) which is called Solr.

I connect to it via port 8983.

I do this from php code, so I add and remove records from it via php.

On my server I have a firewall.

I have set this firewall to only allow connections to and from this port (8983) from the ip adress of my own server. In other words, only allow servers IP to access this port.

Is that safe? Or am I thinking all wrong here? Will others be able to "simulate" my ip adress and act as the server?

This is because otherwise others may add/remove records as they want from their own ip adresses...

Thanks

Answer 1

Yes, you are safe as long as no one gains control of your local server.

You can also cause Solr to bind to the "localhost" or "127.0.0.1" adapter as opposed to "0.0.0.0", which would have a similar effect. It never hurts to layer the firewall above that just in case the configuration is messed up.

Answer 2

You would not be safe if you are worried of tampering from the same network. There are many situations where the real threats are from inside the network, not from some script kiddie a continent away.

I agree with theatrus to use only localhost.

If you are deployed on multiple hosts there are several ways to create a secure tunnel, e.g

ssh -l 8983:localhost:8983 solr.server

this will create a secure tunnel. (Although it takes non trivial CPU when the bandwidth is high). There are also other solutions.

An additional advantage is that for a developer you can use a sample solr server locally and your code in your IDE, and it will just work with the same config as in production. The less that needs to be changed when deploying, the better.

Answer 3

It might be a good idea to also block all outgoing traffic from port 8983 on the server to anywhere but your own server's IP address. This, in addition to dropping any packet to that port not from your server, will doubly ensure that, even if someone is somehow able to modify the daemon listening on port 8983 on the server, allowing it to mirror traffic to another host, it would be dropped before it leaves your computer.

Answer 4

This is safe. The ip address used in a TCP connection because of the three way handshake. This is a good firewall rule-set, but you should always test your rulesets with nmap.

What you do have to worry about is running an open proxy server on the server that is executing the PHP.