CF 2021 Solr uninstall, but what package

[seth_1207]

Hello all,
Others have noted the security issue with Solr and version 7.
We don't need it on our servers, so I would like to uninstall, I am not sure yet if I can disable the add-on service cause I think the cfhtml2pdf tag might be used in our code.

So if I can just uninstall SOLR then I would like to do that....but I have no idea which package in package manager I can uninstall.
I have looked at them and none seem to relate to SOLR.
So which one is it?

[AbhishekJha]

@seth_1207 Please reach out to us at cfsup@adobe.com

Thanks,

Abhishek

[Charlie Arehart · Accepted solution]

It's the one called "search". 

[seth_1207]

Awesome!  You are correct it is part of that package.  So weird.
Thank you.

[seth_1207]

I uninstalled the pkg, and restarted CF service.  Still solr comes up to a webpage when I go to Localaddress:8993

Edit:Restarted Add-On service, page still comes up as well.

[Charlie Arehart]

So a few points of clarification (it can all get confusing):

• Solr is indeed an open source text search engine (built into cf since cf9). That's why it's packaged as that "search" module (since cf2021 started breaking features and their mgr into modules/packages) 
• As for the 8993 port you're testing, that's not "solr". That's "jetty", which is the underlying open-source application server that Adobe implemented in cf9 for the deployment of solr.
• That jetty implementation is called the cf "add on service", and it was also leveraged to support the cfhtmltopdf tag you'd mentioned (introduced in cf11, and now in the "package" called htmltopdf). If you want to use either that or solr, you need that add on service
• So when you visit that 8993 port in your browser, you're seeing its "listing" of what it's got implemented. Do you see solr there? I just can't recall if removing the package called search does remove it from that add on service. It's at least removing the support of CALLING upon solr from cf (cfsearch, cfindex, cfcollection). 
• If solr still appears in that 8993 page (which would be a different port in different cf versions), then to REMOVE solr from that addon service, you would want to stop that Cf addon service (such as in the Services panel if using Windows), then delete the solr.war file found (by default) within the cfusion/jetty/webapps folder. Then restart the add on service, and the jetty feature that controls will now detect that removal and so should keep solr from being imemented within jetty

Try that and let us know how it goes. 

Or maybe Adobe (or someone else) may propose yet another solution. 

[seth_1207]

Thank you for the info!! Much appreciated.

What I did on one of our servers (will do 2 more when we can schedule downtime)

1) Rename the existing jetty folder under cfusion to jetty_old

2) Make a new folder jetty under cfusion

3) Go to control panel and uninstall CF2021 Add On services

4) Once completed, please reboot the server

5) After reboot, run the Add On installer from this link: https://cfdownload.adobe.com/pub/adobe/coldfusion/2021/add-on/ColdFusion_2021_Addon_WWEJ_win64.exe

6) During installation, point it to cfusion\jetty folder (new created)

7) In the install screens, uncheck the Solr service and proceed. Please see the below screenshot

I did need to add my account to the permissions on the folder so I could change the name of the jetty folder.

[Charlie Arehart]

Glad to hear if that's "solved" your problem, Seth.

That said, it's not at all what I proposed. Is that what Adobe suggested? I'm sure it "worked". I could argue it was both overkill and could potentially hold unforeseen trouble, whereas my approach was simpler and held no such trouble.

Even so, I realize you may be satisfied with the result you achieved, which may prove sufficient for you.

For readers who may wonder what are my concerns with that other approach, there at a couple of matters.

First:

• Sometimes that add-on installer IS NOT kept updated so as to result in the exact same files as woukd have been put there by the cf installer and subsequent updates to that (which does sometimes update files in that jetty folder)
• If you'd made ANY changes to config files within that jetty folder, you'd have lost them.
• There are logs within that jetty folder that it maybe helpful to preserve 

Some good news is that you were told to make that copy of the original jetty folder; therefore you could (if you were motivated) use a compare tool to help with each of my points, noting differences and considering what to "restore". (I favor the wonderful Beyond Compare tool for such tasks.) 

Second, another thing to beware about running that add-on installer is that some people don't notice its default is to install itself into to a new folder OUTSIDE of the cf folder (which it offers by default). In that case, subsequent cf updates don't know about or update that different location...as they expect to update only that jetty folder within cf. Thankfully you were steered clear of that reef.

Finally, some people will wonder what you mean by your step 3: some will presume that by "control panel" you mean Windows Services, and of course one can't "uninstall" a service there. But I assume you mean instead Windows "add or remove programs", which would let you uninstall the add-on service--as was implemented based on choices made when cf itself was originally installed.

Sorry for what may seem excessive elaboration. It's just that I know these forum posts will be found in years to come as people search for help. The info you were given didn't presume to explain these things, but I know from spending my days helping people that the info should benefit some folks. 🙂 

[seth_1207]

Don't apologize, I appreciate the detailed elaboration.
I may try your approach with our other servers.  I would prefer as little impact to our setup as possible.
I don't need more issues to deal with.

Thank you Charlie.

[Charlie Arehart]

Thanks, Seth. And good to hear on that prospect. Just remember then how they would differ from each other., which may become important down the road:-)

As for my apology, it's simply that while some appreciate such elaboration, I know that some others really do not. But we soldier on here... or cowboy up...or run the race set before us, to pick among metaphors:-)  

[seth_1207]

Excactly, which is why I would prefer your way if it works and achieves the results needed....as our PCI audit is finding issues with it.

I for one like detail, I would rather understand what is happening.

[Charlie Arehart]

That's indeed the audience I'm usually writing for. 🙂 Great to meet another member of the club!

[seth_1207]

Hey Charile, I tried your option to disable SOLR.  Seems to have worked.  There is no longer a web page coming up when I go to that port.
This was in my test environment.  If I do this in Production.  Can you think of anyway that our security auditors might scan the systems and still get some response from SOLR?
When they tagged us on this issue, they found 2 issues

- Missing Patches (since it was version 7.2.1 and version 8 is out)
- No authentication

Regards

[Charlie Arehart]

Good to hear. As for the port, again that's jetty rather than solr. If you're wanting to ensure solr is gone, if it's no longer in that cfusion/jetty/webapps  (as either a war file or folder), then it can't be served via jetty (that port), and so it's gone with respect to this implementation within cf.

I'll just remind readers that if someone gets the separate cf add-ons installer, that defaults to implementing itself in a folder separate from cf. So you'd want to remove THAT to ensure "no solr related to cf remains".

BTW, when Adobe updates CF, some of those updates do update solr. I see that the Oct 2024 cf update for cf2023 updated its solr 8, and the same one for cf2021 updated its solr 7. Finally, newer cf versions implement still newer solr versions, with Cf2025 coming with solr 9.