当前位置:网站首页>Records about log4j security vulnerabilities and version to replace
Records about log4j security vulnerabilities and version to replace
2022-08-07 04:12:00 【herbal tea ice】
目录
Specify external configuration
pom依赖
log4jof security breaches are big events,A few months earlier projects have finished patch,replaced the package.
Simply record the use of the log. 目前jdk是java8及以上,要求log4j的版本必须是2.17.1.
看下pom依赖:
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.8.1</version>
</dependency>
<!--日志-->
<!-- <dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-log4j2</artifactId>
<version>2.6.2</version>
</dependency>-->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
<version>2.17.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-web</artifactId>
<version>2.17.1</version>
</dependency>
</dependencies>正常SpringBoot集成的时候,先在spring-boot-starter-web依赖中排除掉spring-boot-starter-logging的依赖,然后再引入spring-boot-starter-log4j2就能用了.But this time the defaultlog4j版本太低,We need to import the required version ourselves, Import as above.
log4j2配置
Posting a commonly usedlog4j2的配置,如下:
<?xml version="1.0" encoding="UTF-8"?>
<!-- Configuration后面的status,这个用于设置log4j2自身内部的信息输出,可以不设置,当设置成trace时,
你会看到log4j2内部各种详细输出.可以设置成OFF(关闭) 或 Error(只输出错误信息).
30s 刷新此配置
-->
<configuration status="INFO" monitorInterval="30">
<Properties>
<Property name="APP_NAME">nicc-unicom-file-listener</Property>
<Property name="LOG_PATTERN">%d{yyyy-MM-dd HH:mm:ss.SSS} |-%-5level [%thread] %c [%L] -| %msg%n</Property>
<Property name="LOG_FILE_PATH">logs</Property>
<property name="rolling_pattern">%d{yyyy-MM-dd}-%i.gz</property>
<property name="every_file_size">10MB</property><!-- 日志切割的最小单位 -->
</Properties>
<Appenders>
<!-- 输出控制台日志的配置 -->
<Console name="console" target="SYSTEM_OUT">
<!-- 输出日志的格式 -->
<PatternLayout pattern="${LOG_PATTERN}"/>
</Console>
<!-- per day and fixed size(10MB)生成日志文件【最新的日志,no date no numbers】 -->
<RollingFile name="fileInfoAppender" fileName="${LOG_FILE_PATH}/${APP_NAME}.log"
filePattern="${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}-%i.log">
<PatternLayout>
<Pattern>${LOG_PATTERN}</Pattern>
</PatternLayout>
<Filters>
</Filters>
<Policies>
<SizeBasedTriggeringPolicy size="10MB" />
<!-- 每天创建一个日志文件 -->
<TimeBasedTriggeringPolicy interval="1" />
</Policies>
<DefaultRolloverStrategy max="10"/>
</RollingFile>
<!--Error log output separately-->
<RollingFile name="fileErrorAppender" fileName="${LOG_FILE_PATH}/${APP_NAME}-error.log"
filePattern="${LOG_FILE_PATH}/${APP_NAME}-error-%d{yyyy-MM-dd}-%i.log">
<PatternLayout>
<Pattern>${LOG_PATTERN}</Pattern>
</PatternLayout>
<Filters>
<ThresholdFilter level="ERROR" onMatch="ACCEPT" onMismatch="DENY"/>
</Filters>
<Policies>
<SizeBasedTriggeringPolicy size="10MB" />
<!-- 每天创建一个日志文件 -->
<TimeBasedTriggeringPolicy interval="1" />
</Policies>
<DefaultRolloverStrategy max="10"/>
</RollingFile>
</Appenders>
<Loggers>
<logger name="com.jgsmart" level="INFO"/>
<Root level="INFO">
<AppenderRef ref="console"/>
<AppenderRef ref="fileInfoAppender"/>
<AppenderRef ref="fileErrorAppender"/>
</Root>
</Loggers>
</configuration>Specify external configuration
SpringBoot工程和SpringMVCThe project is specified externallylog4jThe configuration items are different when.
SpringBoot
正常情况下,log4j2.xml都是在resource目录下,打包成jar之后,不管jarIs there a corresponding directory at the same level?log4j2.xml文件,He is alljarThe configuration file in the package takes effect as the main.SpringBootClass projects can be started atjarWhen packaged by specifyinglogging.fileway to specify the location of the configuration file.例如:
nohup java -Xms100m -Xmx100m -jar ../${name}-0.0.1-SNAPSHOT.jar -Dlogging.config=../config/log4j2.xml > ../logs/${name}.log & tail -f ../logs/${name}.log或者
nohup java -Xms100m -Xmx100m -jar ../${name}-0.0.1-SNAPSHOT.jar --logging.config=../config/log4j2.xml > ../logs/${name}.log & tail -f ../logs/${name}.log--】和【-D】的区别在于,The former is actually equivalent toSpringboot的application.propertiesA config was added to the config file,The latter is to add a value to the system variable. 参考:Springboot command injection properties[--]&[-D] - No water - 博客园
If we can specify an external configuration file,其实可以直接通过 Modify the external configuration filelogging.configto specify the absolute path of the log configuration file
配置文件同理,可以通过指定-Dconfig.path来指定,如下:
nohup java -Xms100m -Xmx100m -jar nicc-0.0.1-SNAPSHOT.jar -Dlogging.config=../config/log4j2.xml -Dconfig.path=/../config/application.properties > ../logs/${name}.log & tail -f ../logs/${name}.logSpringMVC
SpringMVCit needs to be madewar包在tomcat中运行的,By default we canweb.xml中配置log4j2.xml的指定位置,可以在web.xmlset as follows:
<context-param>
<param-name>log4jConfiguration</param-name>
<param-value>classpath:log4j2.xml</param-value>
</context-param>
<context-param>
<param-name>log4jRefreshInterval</param-name>
<param-value>60000</param-value>
</context-param>
<listener>
<listener-class>org.apache.logging.log4j.web.Log4jServletContextListener</listener-class>
</listener>其中log4jConfigurationSpecifies the configuration file path,可以写成绝对路径,也可以写成classpath下的某个路径.
This method has certain disadvantages,那就是web.xmlwill eventually be hitwar包中,we cannot dynamicallywarBefore starting is specifiedlog4j2.xml配置文件的位置.
How to specify dynamically? SpringMVC使用maven配置SLF4J和Log4J2_newcih的博客-CSDN博客
Can be specified directly by setting a system variable,可以修改tomcat的catalin.sh文件,Add a line to inject system variables,如下:
declare -x CATALINA_OPTS="-Dlog4j.configurationFile=D:\vm\log4j2.xml"You can also specify multiple configuration items,如下:
declare -x CATALINA_OPTS="-Dconfig.path='/app/api-gateway/config/default.properties' -Dlog4j.configurationFile=/app/api-gateway/config/log4j2.xml"重点就是:log4j.configurationFile的指定,注意如果在web.xmlconfigure as above,再通过-Dlog4j.configurationFile指定,The latter will not take effect.所以如果使用-Dlog4j.configurationFileway to specify dynamically,就不要再web.xml文件中配置.
一个标准的startup.sh
#!/bin/bash
pid=`ps -ef |grep cmo-0.0.1-SNAPSHOT.jar |grep -v grep|grep -v startup.sh|awk '{ print $2 }'`
sleep 3
echo "be stoping"
if [ "$pid" = "" ]
then
echo "not running"
else
kill -9 $pid
fi
echo "start running..."
cd /app/ars-api
nohup java -Dlogging.config=/app/ars-api/config/log4j2.xml -Dconfig.path=/app/ars-api/config/application.properties -jar cmo-asr.jar > /dev/null 2>&1 &
echo "has started!!"边栏推荐
猜你喜欢

水质自动监测和视频监控,巩固提升饮用水安全保障水平

不是吧,10:00面试,10:08就出来了 ,问的实在是太...

从简历被拒到收割8个大厂offer,我用了3个月成功破茧成蝶

What is SaaS service platform software?

小程序的父------------>子的通信

如何快速开发app?小程序+插件少不了

From the rejection of my resume to the harvest of 8 big company offers, it took me 3 months to successfully break through the cocoon and become a butterfly

Find My资讯|AirTag 正在帮更多人找到丢失的行李,Find My用处越来越大

MySQL进阶1——底层数据结构B+树

Automatic water quality monitoring and video monitoring to consolidate and improve the level of drinking water safety
随机推荐
tiup cluster import
Golang 作用域的坑
Problems encountered with Flutter environment configuration
记录WPF的技巧(二)16-30
Tables that come with MySQL
What is SaaS service platform software?
微信小程序中rpx
项目管理知识点
阅读笔记——RetinaFace: Single-stage Dense Face Localisation in the Wild
【Metaverse系列一】元宇宙的奥秘
Scrollbar for TreeView in wpf
集合与迭代器
Interview experience with points for job hunting + future career planning
golang server proxy
The problem that members of Golang map structure cannot be modified
Tips for recording WPF (2) 16-30
mysql8修改密码
机器学习初学者易踩的5个坑
[Swift] Add copy function to custom object
c# multi-thread synchronous execution