The admin settings do not apply to direct solr queries. Is there no setting to limit solr queries?
I am investigating this because a server on the Yacy network has been crashing from too many requests.
/ConfigNetwork_p.html
/SearchAccessRate_p.html
These settings also do not limit solr queries. I set it to 1 search per 3 seconds, but the logs show 3 searches in the same second from the same IP address.
/ConfigAccounts_p.html
Password-protecting the pages only affects the web browser, but again, does not stop direct solr queries, which can be done without a browser, even in shell. The URL for solr queries is not password-protected.
It would be good for security, if the admin could limit solr queries, especially when there is a flood of DDoS-like network activity.
Good news: Yacy does have a setting to stop solr queries!
SOLUTION:
/ConfigProperties_p.html
Turn off the publicSearchpage, by changing the boolean value from true to false. Now a login is required to use both: the Yacy search interface AND the solr queries.
So, Yacy does have the ability built-in to require a login to make solr queries. This is helpful to protect a server that is either under a DDoS-like attack, or is experiencing frequent crashes from too much query activity.
I am only doing this (currently only on the server that was crashing) because of the query flood, but when/if network activity resumes to bearable levels, I would want to open the public search to everyone.
I wish there were a setting to keep public search available, while also rate-limiting the solr queries, instead of turning it off completely to unauthorized users.
Hi there, thank you for sharing that. Very helpful! I am currently collecting evidence, but this could be very helpful in the future. I would still like to see about implementing rate limiting for solr queries, or find out if there is some really good reason that isn’t already a thing. (Would it break something else?)
Thanks for digging around and finding something. I wish more people were in the forums, and could thank you for the helpful post, but with the verification e-mails apparently never being sent, it is hard for people to log in here if they don’t want to tie their account to another service. And yet, somehow, this casino spammer seems to have no trouble making their presence known.
