Skip to content

Commit 1f54205

Browse files
noltenolte
authored
log4j exploit (#199)
* overwrite the log4j config as default * using java 17 for the latest minecraft server version
1 parent d77d106 commit 1f54205

File tree

7 files changed

+84
-39
lines changed

7 files changed

+84
-39
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ This role installs [Minecraft](https://minecraft.net/) or [Spigot](https://www.s
2121
- manages ``server.properties``
2222
- hooks: include arbitrary tasks at specific stages during execution
2323

24-
### Out of Role Scop
24+
### Out of Role Scope
2525

2626
- install a *Java Runtime*, this must be done, before you use this Role, you can use [nolte/ansible-role-msopenjdk](https://github.com/nolte/ansible-role-msopenjdk) for example.
2727
- executing backups and recovery

‎molecule/latest/molecule.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ provisioner:
7474
minecraftserver:
7575
user_accept_minecraft_eula: ${mc_accept_eula}
7676
mc_version: "latest"
77-
jdk_used_version: ${JDK_VERSION:-"16"}
77+
jdk_used_version: ${JDK_VERSION:-"17"}
7878
playbooks:
7979
converge: ../resources/playbooks/playbook.yml
8080
lint:

‎tasks/install/main.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,23 @@
2525
owner: "{{ minecraft_user }}"
2626
group: "{{ minecraft_group }}"
2727
mode: 0755
28-
when:
29-
minecraft_external_log_conf is defined and
30-
minecraft_external_log_conf.fileName is defined
28+
29+
# https://help.minecraft.net/hc/en-us/articles/4416199399693-Security-Vulnerability-in-Minecraft-Java-Edition
30+
- name: set the default log4j config name
31+
set_fact:
32+
_log4j_default_template_file_name: log4j2.xml.j2
33+
34+
- name: set overwrite for special mc versions
35+
set_fact:
36+
_log4j_default_template_file_name: log4j2_17-111.xml.j2
37+
when: (minecraft_version_int is version('1.7', '>=')) and (minecraft_version_int is version('1.11', '<='))
3138

3239
- name: external logging config
3340
template:
34-
src: "{{ minecraft_external_log_conf.template | default('log4j2.xml.j2') }}"
35-
dest: "{{ deploy_helper.shared_path }}/{{ minecraft_external_log_conf.conf_file }}"
41+
src: "{{ minecraft_external_log_conf.template | default(_log4j_default_template_file_name) }}"
42+
dest: "{{ deploy_helper.shared_path }}/{{ minecraft_external_log_conf.conf_file | default('log4j2.xml') }}"
3643
owner: "{{ minecraft_user }}"
3744
group: "{{ minecraft_group }}"
3845
mode: 0600
39-
when:
40-
minecraft_external_log_conf is defined
4146
notify:
4247
- restart Minecraft

‎templates/log4j2.xml.j2‎

Lines changed: 33 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,34 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<Configuration>
3-
<Appenders>
4-
5-
<Console name="console" target="SYSTEM_OUT">
6-
<PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} [%level] %msg%n" />
7-
</Console>
8-
9-
<RollingRandomAccessFile name="rolling_server_log" fileName="{{ minecraft_external_log_conf.fileName | default('logs/server.log') }}"
10-
filePattern="{{ minecraft_external_log_conf.filePattern | default('logs/server_%d{yyyy-MM-dd}.log.gz') }}">
11-
<PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} [%level] %msg%n" />
12-
<Policies>
13-
<TimeBasedTriggeringPolicy />
14-
{% if minecraft_external_log_conf.sizeBased is defined -%}
15-
<SizeBasedTriggeringPolicy size="{{ minecraft_external_log_conf.sizeBased }}" />
16-
{% endif %}
17-
</Policies>
18-
{% if minecraft_external_log_conf.rollover is defined -%}
19-
<DefaultRolloverStrategy max="{{ minecraft_external_log_conf.rollover }}" />
20-
{% endif %}
21-
</RollingRandomAccessFile>
22-
</Appenders>
23-
<Loggers>
24-
<Root level="info">
25-
<AppenderRef ref="rolling_server_log" />
26-
<!-- <AppenderRef ref="console" /> -->
27-
</Root>
28-
</Loggers>
29-
</Configuration>
2+
<Configuration status="WARN">
3+
<Appenders>
4+
<Console name="SysOut" target="SYSTEM_OUT">
5+
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg{nolookups}%n" />
6+
</Console>
7+
<Queue name="ServerGuiConsole">
8+
<PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg{nolookups}%n" />
9+
</Queue>
10+
<RollingRandomAccessFile name="File" fileName="{{ minecraft_external_log_conf.fileName | default('logs/server.log') }}" filePattern="{{ minecraft_external_log_conf.filePattern | default('logs/server_%d{yyyy-MM-dd}.log.gz') }}">
11+
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg{nolookups}%n" />
12+
<Policies>
13+
<TimeBasedTriggeringPolicy />
14+
<OnStartupTriggeringPolicy />
15+
{% if minecraft_external_log_conf.sizeBased is defined -%}
16+
<SizeBasedTriggeringPolicy size="{{ minecraft_external_log_conf.sizeBased }}" />
17+
{% endif %}
18+
</Policies>
19+
{% if minecraft_external_log_conf.rollover is defined -%}
20+
<DefaultRolloverStrategy max="{{ minecraft_external_log_conf.rollover }}" />
21+
{% endif %}
22+
</RollingRandomAccessFile>
23+
</Appenders>
24+
<Loggers>
25+
<Root level="info">
26+
<filters>
27+
<MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
28+
</filters>
29+
<AppenderRef ref="SysOut" />
30+
<AppenderRef ref="File" />
31+
<AppenderRef ref="ServerGuiConsole" />
32+
</Root>
33+
</Loggers>
34+
</Configuration>

‎templates/log4j2_17-111.xml.j2‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Configuration status="WARN" packages="com.mojang.util">
3+
<Appenders>
4+
<Console name="SysOut" target="SYSTEM_OUT">
5+
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
6+
</Console>
7+
<Queue name="ServerGuiConsole">
8+
<PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
9+
</Queue>
10+
<RollingRandomAccessFile name="File" fileName="{{ minecraft_external_log_conf.fileName | default('logs/server.log') }}" filePattern="{{ minecraft_external_log_conf.filePattern | default('logs/server_%d{yyyy-MM-dd}.log.gz') }}">
11+
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
12+
<Policies>
13+
<TimeBasedTriggeringPolicy />
14+
<OnStartupTriggeringPolicy />
15+
{% if minecraft_external_log_conf.sizeBased is defined -%}
16+
<SizeBasedTriggeringPolicy size="{{ minecraft_external_log_conf.sizeBased }}" />
17+
{% endif %}
18+
</Policies>
19+
{% if minecraft_external_log_conf.rollover is defined -%}
20+
<DefaultRolloverStrategy max="{{ minecraft_external_log_conf.rollover }}" />
21+
{% endif %}
22+
</RollingRandomAccessFile>
23+
</Appenders>
24+
<Loggers>
25+
<Root level="info">
26+
<filters>
27+
<MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
28+
<RegexFilter regex="(?s).*\$\{[^}]*\}.*" onMatch="DENY" onMismatch="NEUTRAL" />
29+
</filters>
30+
<AppenderRef ref="SysOut" />
31+
<AppenderRef ref="File" />
32+
<AppenderRef ref="ServerGuiConsole" />
33+
</Root>
34+
</Loggers>
35+
</Configuration>

‎templates/minecraft.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ WorkingDirectory={{ deploy_helper.shared_path }}
1212
StandardInput=socket
1313
StandardOutput=journal
1414
StandardError=journal
15-
ExecStart={{ minecraft_java }} -Xmx{{ minecraft_max_memory }} -Xms{{ minecraft_initial_memory }} {% if minecraft_external_log_conf is defined %}-Dlog4j.configurationFile={{ minecraft_external_log_conf.conf_file }}{% endif %} {{ minecraft_server_java_ops }} -jar {{ minecraft_jar }} nogui
15+
ExecStart={{ minecraft_java }} -Xmx{{ minecraft_max_memory }} -Xms{{ minecraft_initial_memory }} -Dlog4j.configurationFile={{ minecraft_external_log_conf.conf_file | default('log4j2.xml') }} -Dlog4j2.formatMsgNoLookups=true {{ minecraft_server_java_ops }} -jar {{ minecraft_jar }} nogui
1616
ExecStop=/bin/sh -c "echo 'save-all' > {{ minecraft_console_fifo }}"
1717
ExecStop=/bin/sh -c "echo 'stop' > {{ minecraft_console_fifo }}"
1818
Restart=on-failure

‎tox.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ setenv =
5959
fixversion: MC_VERSION = "1.13.1"
6060
oldversion: MC_VERSION = "1.9"
6161
latest: MC_VERSION = "latest"
62-
latest: JDK_VERSION = "16"
62+
latest: JDK_VERSION = "17"
6363
deps= -r{toxinidir}/requirementsDev.txt
6464
commands =
6565
molecule --base-config ./molecule/resources/molecule-maintenance-base.yml --env-file {env:DOCKER_CONFIG_FILE} test -s ci_single_container

0 commit comments

Comments
 (0)