- 此次實(shí)驗(yàn)的elasticsearch版本為7.5.1和7.10.1
下載log4j最新版jar包
# wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-api/2.15.0/log4j-api-2.15.0.jar
# wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.15.0/log4j-core-2.15.0.jar
rpm包安裝的es7修補(bǔ)log4j漏洞過(guò)程
# mdir /opt/log4j
# cp /usr/share/elasticsearch/lib/log4j-*.jar /opt/log4j
# cp log4j-*.jar /usr/share/elasticsearch/lib/
# rm -f /usr/share/elasticsearch/lib/log4j-*2.11.1.jar
- 在es的jvm.options文件末尾添加 -Dlog4j2.formatMsgNoLookups=true
# vim /etc/elasticsearch/jvm.options
-Dlog4j2.formatMsgNoLookups=true
# systemctl restart elasticsearch
# curl -XGET localhost:9200
源碼包安裝的es7修補(bǔ)log4j漏洞過(guò)程
# mkdir /opt/log4j
# cp /usr/local/elasticsearch-7.5.1/lib/log4j-*.jar /opt/log4j/
# ls /opt/log4j/
- 替換es的log4j包到最新版本（源碼安裝的es不能用root啟動(dòng)馆铁，需要?jiǎng)?chuàng)建子用戶，我創(chuàng)建的子用戶名稱為：user-es）
# cp log4j-*.jar /usr/local/elasticsearch-7.5.1/lib/
# rm -f /usr/local/elasticsearch-7.5.1/lib/log4j-*2.11.1.jar
# chown user-es: /usr/local/elasticsearch-7.5.1/lib/*
- 在es的jvm.options文件末尾添加 -Dlog4j2.formatMsgNoLookups=true
# vim /usr/local/elasticsearch-7.5.1/config/jvm.options
-Dlog4j2.formatMsgNoLookups=true
# su - user-es
$ ps aux|grep elastic
user-es 7093 2.5 19.8 6609416 1584568 pts/0 Sl 15:25 4:49 /usr/local/elasticsearch-7.5.1/jdk/bin/java...
$ kill 7093
$ ps aux|grep elastic
user-es 29541 0.0 0.0 115924 1000 pts/0 S+ 18:33 0:00 grep --color=auto elastic
$ /usr/local/elasticsearch-7.5.1/bin/elasticsearch -d
$ ps aux|grep elastic
# curl -XGET localhost:9200
最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
