Upgrading to Minecraft server 1.7.8

First time for everything: since I set up my Minecraft server on version 1.7.4, I've had to upgrade.  Guess a lot of changes were made partly because of the Heartbleed bug and the fact that Mojang is making some changes for the username changes that will be implemented soon.  Thus it jumped from 1.7.6-7-8 pretty quickly!

There wasn't much as far as instructions to be found, so here's a short list of what I had to do to get things running again.

1. Stopped the running version 1.7.4 server
2. Renamed the ops.txt file to ops.txt.bak
3. Renamed the user files in <minecraft root folder>/world/players from playername.dat to playername.dat.bak
4. Downloaded the newest .jar file for the Minecraft server using wget into the root folder (normally I'd link to that file, but that changes often)
5. Ran the script to start up the server using a new screen
6. Wait for the conversions to take place, then first thing from the server console op my username (otherwise, nobody has op status

Probably to be expected, once I connected to the server, I lost any inventory that I had previously.  Also noted, from other users that posted info about the upgrade, you will need to re-do any white-list you had created previously.

The ops file and white-list now are .json files that contain both the usernames and their new UUID.  Otherwise, things looked pretty much back to normal.

---

4/14/2104

Addendum: Doing some more research, it looks like the user files should have upgraded automatically when server 1.7.8 was started for the first time.  I saw an error message stating that the conversion failed (and the server stopped).  That's why I renamed the user files and started over.

At the same time, there were reports that some of the Mojang services were having issues, including the service that would have done the conversion.

Conclusion, step 3 might not have been completely necessary.  User's inventory might have been preserved in the upgrade process, but I haven't seen anyone else post anything about that.

Malware, Local File Insertion and PHP

Getting back into some web development once again.  I've been playing around with some simple CMS applications for blogging, etc.  On one new site, I installed Pixie, which seems to be a nice solution (plus I just like trying out things that are of British origin).

On the new micro server, I installed tinyCMS to try it out.  Getting it setup and working properly can be a topic of another post, but I was doing a little research on the security of the application.  Seems it does have some documented vulnerabilities, along with WordPress and the TinyMCE editor.

In the course of looking at this, I came across this post that suggested some things to help make the PHP more secure. Specifically by disabling these functions in the php.ini:   

disable_functions = create_function,gzinflate,eval,base64_decode

Good reading and never hurts to a least try to keep the sites a little more secure. 

Logwatch and fail2ban

Things are running along pretty smoothly on the Ubuntu server over on Amazon AWS. Doing some research on server admin and security, saw a post on installing Logwatch to more easily scan the logs daily.   Of course, no surprise to see lots of attempts at compromising the server.

Decided to do something about it and found this article (geared more to Debian Wheezy, but still applies to Ubuntu): Install and Config Fail2Ban

I particularly liked the information about apache-badbots and apache-myadmin, both of which would help block a lot of the traffic seen in the logs.

Also saw lots of entries in the logs with w00tw00t.at.blackhats.romanian.anti-sec:)
So looked up a post on this blog that discusses using fail2ban specifically to block it.

Fun stuff!