Solr：复制选项
我有一个在防火墙后面运行的 SOLR 实例。我即将建立另一个不受防火墙保护的实例。但是，SOLR 似乎只支持拉式复制，不支持推式复制。
为了保持相同的安全级别，我有哪些选择？我不想在防火墙中打开太多端口。通过 SSH 隧道的 HTTP 是最佳选择吗？是否也可以使用普通的旧 rsync（不使用任何 SOLR 特定功能）复制索引文件，或者这会破坏某些内容？
I've got a SOLR instance running behind a firewall. I'm about to put up another instance which will not be firewalled. Howevever, SOLR appears to only support pull replication and not push replication.
What are my options with regard to maintaining the same level of security? I'd rather not open too many ports in the firewall. Would HTTP over a SSH tunnel be the best option? Would it also be possible to just replicate the index files using plain old rsync (not using any SOLR specific features) or would this break something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
Solr 实际上通过其
snappuller机制支持这种分布，记录如下：http://wiki.apache.org/solr/CollectionDistributionSolr actually supports this kind of distribution with its
snappullermechanism, documented here: http://wiki.apache.org/solr/CollectionDistribution我会打开一个端口并指定从机的IP地址，然后使用普通的基于HTTP的复制；我认为这将非常安全，并且可能更容易维护。我知道这不是你钓鱼的地方，但这是我推荐的地方。
I would open a port and specify the IP address of the slave, and just use ordinary HTTP-based replication; that would be quite secure, I think, and easier to maintain probably. I know it's not exactly where you were angling, but it's what I'd recommend.
我正在回答我自己的问题，因为我寻求的解决方案与其他两个答案所建议的不同。我最终使用 SSH 隧道来传输 HTTP 流量。因此，我使用 SSH 通过 SSH 隧道将主机 A 上端口 8080 的所有流量重定向到主机 B 上端口 8080。
该解决方案似乎运行良好。我正在使用 脚本每 5 分钟左右验证一次隧道。
I'm answering my own question as the solution i went for is different than what the two other answers suggested. I ended up using a SSH tunnel for HTTP traffic. Thus, i used SSH to redirect all traffic to port 8080 on the HostA to port 8080 on hostB through a SSH tunnel.
The solution appears to be working fine. I'm using a script which validates the tunnel every 5 minutes or so.
您可以使用 HTTP 基本身份验证（请参阅 https://wiki.apache.org/solr/SolrReplication#Slave ），但由于密码将以纯文本形式传递，因此还需要 SSH 隧道或安全 VPN，以阻止更坚定的攻击者。
如果我们觉得无法对内部网络给予足够的信任，我将首先选择 VPN 解决方案，并在投入生产之前考虑使用 SSH 隧道。
You could use HTTP basic authentication (see https://wiki.apache.org/solr/SolrReplication#Slave) but since the password will be passed in plain text, an SSH tunnel or secure VPN would also be required in order to deter more determined attackers.
I'll be going for a VPN solution to start with and consider an SSH tunnel before moving to production if we feel we are unable to place sufficient trust in our internal networks.