Solr on FIPS 140-3 clusters

Overview

Cloudera Search runs on clusters that are already configured for FIPS 140-3. Host FIPS mode, validated cryptographic modules, JDK configuration, and Cloudera Manager FIPS settings are documented in the Cloudera platform FIPS installation guides, not in this Search library.

In Cloudera Runtime 7.3.2.10000 SP1, Solr includes updated cryptographic modules and Cloudera SASL support for FIPS 140-3. Configure Solr TLS, Solr ZooKeeper TLS, and Kerberos using the same procedures as on non-FIPS clusters. On FIPS hosts, Search clients and batch indexing tools that run outside Solr server roles must use BCFKS truststores and SafeLogic CryptoComply JVM module options in addition to secure ZooKeeper and Kerberos settings.

For platform preparation, see Installing and Configuring Cloudera with FIPS.

Solr service on FIPS clusters

Install and configure the Solr service on a FIPS-enabled cluster using the standard Cloudera Manager workflow. Enable TLS for Solr HTTPS, TLS for Solr ZooKeeper, and Kerberos when your security policy requires them.

• Configure Solr TLS/SSL in Cloudera Manager. For more information, see Configure TLS/SSL encryption for Solr.
• Enable TLS for Solr ZooKeeper when clients connect to ZooKeeper over TLS. For more information, see Enabling SSL for Solr ZooKeeper.
• On Kerberized clusters, enable Kerberos for Search and create JAAS configuration files as described in Enabling Solr clients to authenticate with a secure Solr and Creating a JAAS configuration file.

Cloudera Manager applies FIPS-related JVM options to Java-based services through global settings such as Extra JVM arguments for Java-based services. Solr server roles inherit those settings. You do not need separate Solr service safety valves for CryptoComply module paths unless your cluster policy requires tool-specific overrides.

BCFKS truststores on FIPS hosts

On FIPS-enabled hosts, truststores are often Bouncy Castle FIPS (BCFKS) keystores with the CryptoComply (CCJ) provider. Search clients and MapReduce tasks must set truststore type and provider explicitly when connecting to TLS-enabled ZooKeeper or Solr.

The Cloudera Manager AutoTLS global truststore is available on cluster hosts at /var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks. On FIPS clusters this file is typically BCFKS, not JKS. Set both ZooKeeper SSL properties and standard javax.net.ssl truststore properties, including trustStore.type=BCFKS and trustStore.provider=CCJ.

On FIPS hosts, the JVM default trust store at java.home/lib/security/cacerts may also be BCFKS. Tools that rely on the default SSL context may fail until you point Java to a usable truststore (for example /etc/pki/java/cacerts on RHEL) or set explicit truststore JVM options.

FIPS JVM module options for Search clients

Search clients and batch tools that run in a shell or submit YARN or MapReduce jobs on FIPS hosts must include SafeLogic CryptoComply module options in JDK_JAVA_OPTIONS (or append them to existing JDK_JAVA_OPTIONS values). Align module paths with the SafeLogic JAR location on your cluster hosts (commonly under /cdep/extra_jars/).

Example FIPS module options for Search clients on JDK 17:

export JDK_JAVA_OPTIONS="--module-path=/cdep/extra_jars/ \
--add-modules=com.safelogic.cryptocomply.fips.core,bctls \
--add-reads=bctls=com.safelogic.cryptocomply.fips.core \
--add-exports=com.safelogic.cryptocomply.fips.core/com.safelogic.cryptocomply.asn1.eac=bctls,ALL-UNNAMED \
--add-exports=java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core \
--add-exports=java.base/sun.security.provider=bctls \
-Dcom.safelogic.cryptocomply.fips.approved_only=true"

In Cloudera Manager, compare these options with the values in Administration > Settings under Extra JVM arguments for Java-based services. Use the same module path and exports on client hosts when you run Search tools manually.

For secure ZooKeeper and Kerberos on shell clients (for example solrctl, ZooKeeper CLI scripts, and hbase-indexer), define a reusable variable (for example SECURE_FLAGS) and export it through the environment variable required by each tool. Example secure ZooKeeper flags for FIPS truststores:

export TRUST_PW="[***TRUSTSTORE_PASSWORD***]"
export SECURE_FLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.client.secure=true \
-Dzookeeper.ssl.trustStore.location=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
-Dzookeeper.ssl.trustStore.password=$TRUST_PW \
-Dzookeeper.ssl.trustStore.type=BCFKS \
-Dzookeeper.ssl.trustStore.provider=CCJ \
-Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
-Djavax.net.ssl.trustStorePassword=$TRUST_PW \
-Djavax.net.ssl.trustStoreType=BCFKS \
-Djavax.net.ssl.trustStoreProvider=CCJ \
-Djava.security.auth.login.config=[***PATH/TO/JAAS.CONF***] \
-Dzookeeper.ssl.hostnameVerification=false \
-Djavax.security.auth.useSubjectCredsOnly=false"

On Kerberized clusters, add Solr Kerberos client options (for example -Dsolr.kerberos.jaas.appname=Client) to SECURE_FLAGS when the tool uses SolrJ against a secure Solr cluster.

For MapReduceIndexerTool, CrunchIndexerTool, and HBaseMapReduceIndexerTool on FIPS 140-3 SP1 clusters, configure YARN default_truststore_pwd in Cloudera Manager (see YARN truststore password for MapReduce jobs). Pass FIPS JDK_JAVA_OPTIONS and secure ZooKeeper flags to map and reduce tasks, but do not include -Djavax.net.ssl.trustStorePassword in -Dmapreduce.map.java.opts or -Dmapreduce.reduce.java.opts. Example task flags for FIPS truststores:

export SECURE_TASK_FLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty \
-Dzookeeper.client.secure=true \
-Dzookeeper.ssl.trustStore.location=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
-Dzookeeper.ssl.trustStore.password=[***TRUSTSTORE_PASSWORD***] \
-Dzookeeper.ssl.trustStore.type=BCFKS \
-Dzookeeper.ssl.trustStore.provider=CCJ \
-Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
-Djavax.net.ssl.trustStoreType=BCFKS \
-Djavax.net.ssl.trustStoreProvider=CCJ \
-Djava.security.auth.login.config=[***PATH/TO/JAAS.CONF***] \
-Dzookeeper.ssl.hostnameVerification=false \
-Djavax.security.auth.useSubjectCredsOnly=false \
-Dsolr.kerberos.jaas.appname=Client"

Pass $JDK_JAVA_OPTIONS $SECURE_TASK_FLAGS through -Dmapreduce.map.java.opts and -Dmapreduce.reduce.java.opts on yarn jar or hadoop jar commands.

YARN truststore password for MapReduce jobs

On FIPS 140-3 clusters in Cloudera Runtime 7.3.2.10000 SP1, YARN injects the DEFAULT_TRUSTSTORE_PWD environment variable into map and reduce task containers and sets javax.net.ssl.trustStorePassword at task startup. Configure the password in Cloudera Manager instead of passing -Djavax.net.ssl.trustStorePassword in per-job JVM options.

To configure the default truststore password for YARN containers:

1. In Cloudera Manager, open the YARN service and click the Configuration tab.
2. Search for default_truststore_pwd.
3. Set default_truststore_pwd to the BCFKS truststore password for your cluster.
4. Enter a Reason for Change, save, and deploy stale configuration through the Stale Configuration wizard.

For more information about YARN truststore handling on FIPS clusters, see Behavioral Changes in YARN in the Cloudera Runtime release notes.

Search clients and batch tools

The following table summarizes where to configure FIPS and secure-cluster options for common Search clients. Set FIPS JDK_JAVA_OPTIONS and secure ZooKeeper flags before you run the tool unless the host role already inherits them from Cloudera Manager client configuration.