# Protect NCP from Log4shell - disable of log4j

**URL:** <https://help.nextcloud.com/t/protect-ncp-from-log4shell-disable-of-log4j/129041>\
**Category:** 📦 Appliances (Docker, Snappy, VM, NCP, AIO)\
**Tags:** apache, ncp\
**Created:** [December 11, 2021, 8:39am UTC](https://help.nextcloud.com/t/protect-ncp-from-log4shell-disable-of-log4j/129041 "2021-12-11T08:39:52Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![TP75](https://help.nextcloud.com/user_avatar/help.nextcloud.com/tp75/32/12565_2.png) [@TP75](https://help.nextcloud.com/u/TP75)\
**Post date:** [December 11, 2021, 1:23pm UTC](https://help.nextcloud.com/t/protect-ncp-from-log4shell-disable-of-log4j/129041/3 "2021-12-11T13:23:08Z")

</div>

You may find my below post useful:

> [@Apache and Log4j, should Nextcloud servers be concerned?](https://help.nextcloud.com/t/apache-and-log4j-should-nextcloud-servers-be-concerned/129022/5):
>
> The assumption by @bb77 seems to hold for standard Debian installations. A normal Apache Web-Server install on Debian does not include Log4j and or Java, if I am correct. However, users of a community version of Nextcloud deployed on a Debian system with Java capabilities installed may find the below information useful: [https://packages.debian.org/bullseye/liblog4j2-java](https://packages.debian.org/bullseye/liblog4j2-java)[https://security-tracker.debian.org/tracker/source-package/apache-log4j2](https://security-tracker.debian.org/tracker/source-package/apache-log4j2)[https://security-tracker.debian.org/tracke…](https://security-tracker.debian.org/tracker/CVE-2021-44228)

I took this opportunity to add some information on **mitigation** i.e. **disabling log4j** in my o.m. article.

Happy hacking.  
🌻

---

_[View the full topic](https://help.nextcloud.com/t/protect-ncp-from-log4shell-disable-of-log4j/129041)._