A security scan is reporting a vulnerability: "Apache Zookeeper Common/Default Nodes Accessible Without ACL found"
I have try to enable ACL in SOLR-8.4.1 and Zookeeper-3.5.5 to remediate VIT's But the scan still reports the vulnerability.
I have done the below changes.
solr.in.cmd
REM Settings for ZK ACL
set SOLR_ZK_CREDS_AND_ACLS=-DzkACLProvider=org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider ^
-DzkCredentialsProvider=org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider ^
-DzkDigestUsername=admin-user -DzkDigestPassword=******* ^
-DzkDigestReadonlyUsername=Admin -DzkDigestReadonlyPassword=********
set SOLR_OPTS=%SOLR_OPTS% %SOLR_ZK_CREDS_AND_ACLS%
solr.xml
<str name="zkCredentialsProvider">${zkCredentialsProvider:org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider}</str>
<str name="zkACLProvider">${zkACLProvider:org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider}</str>
zkcli.bat
REM Settings for ZK ACL
set SOLR_ZK_CREDS_AND_ACLS=-DzkACLProvider=org.apache.solr.common.cloud.VMParamsAllAndReadonlyDigestZkACLProvider ^
-DzkCredentialsProvider=org.apache.solr.common.cloud.VMParamsSingleSetCredentialsDigestZkCredentialsProvider ^
-DzkDigestUsername=admin-user -DzkDigestPassword=****** ^
-DzkDigestReadonlyUsername=Admin -DzkDigestReadonlyPassword=*******
What am I missing to fully enable ACL?