Minecraft Bedrock Edition is the version of Minecraft that powers the iPhone / Android versions (formerly Minecraft Pocket Edition), the Xbox / PlayStation / Nintendo Switch editions and the free Windows 10 Minecraft edition.
Mojang has released a dedicated server which is considered to be in alpha testing. I have found it to be very stable and able to run on a wide variety of hardware.
This script and guide are written to help you get a robust Minecraft Bedrock dedicated server up and running in only a few minutes!
This is the standalone version. The easiest and most problem-free way to run this is using Docker (installed as simply as sudo apt install docker.io): Legendary Minecraft Bedrock Container
Sets up the official Minecraft Bedrock Server (currently in alpha testing)
Fully operational Minecraft Bedrock edition server in a couple of minutes
Ubuntu / Debian distributions supported
Sets up Minecraft as a system service with option to autostart at boot
Automatic backups when server restarts
Supports multiple instances — you can run multiple Bedrock servers on the same system
Updates automatically to the latest or user-defined version when server is started
Easy control of server with start.sh, stop.sh and restart.sh scripts
Adds logging with timestamps to “logs” directory
Optional scheduled daily restart of server using cron
Requirements
A computer with a 64 bit processor (if you are trying to use ARM read my article on the limitations). 32 bit binaries of the official server are not available so it needs to be 64 bit!
1 GB of RAM or higher
The only officially supported platform by Microsoft is Ubuntu 22.04 / 20.04 (current LTS, recommended)
Other Linux flavors supported by this script as well as long as they use systemd (for the service). The script assumes apt is installed but there are minimal dependencies so you could install these on another distro (that doesn’t have apt present) and use the script normally.
Recommended Gear
Game Editions
Minecraft: Bedrock Edition is the “Windows 10” version of Minecraft as well as the version of Minecraft on the Xbox / Playstation / Switch. The versions of Minecraft for Android and iOS are also the Bedrock edition.
All of these versions support cross-platform play with each other (but not with the Java edition).
Minecraft Bedrock Digital Code
This is the PC Minecraft for Windows 10 (Bedrock) edition of Minecraft. It is able to play cross-platform with other players on Android / iOS / Playstation / Xbox / Switch. Available as a code that is instantly activated to give you permanent access to the game!
I strongly recommend a Solid State drive (SSD) for your server. This is because Minecraft is constantly reading/storing chunks to the disk which makes I/O performance very important.
These are much cheaper than they used to be. Here’s a decent 120 GB one (higher capacity options are available) at a very low price:
Kingston A400 2.5″ SATA SSD
The Kingston A400 is reliable, widely available around the world, has low power requirements and performs very well. It’s also very affordable. This drive has been benchmarked over 1000 times at Pi Benchmarks and is the #1 most popular SSD among the community!
If you have a M.2 NVME slot in your motherboard you can go with a high end drive. This will give your server maximum performance even if a large number of players are running around on the server changing blocks and triggering disk writes.
This is the one I have in my machine. These range from 250 GB to 2 TB depending on how big your server might grow:
The Samsung 980 Pro (NVMe) is a professional grade SSD and one of the fastest in the world. The Samsung NVMe drives have been at the top of this category for a long time and are well trusted for both their performance and reliability / long life.
Almost any PC made in the last few years will be a x86_64 bit computer. If you have an older computer around that isn’t being used then it will most likely have the right CPU and amount of memory (as well as fast storage) to run a basic server.
Throwing a SSD in one of these older computers will provide an excellent server experience for small and larger player counts.
The speed of your storage will make the largest difference. Older HDDs are going to have significantly slower performance than any modern SSD even with all other hardware equal. This is because the Minecraft server is constantly reading/writing chunks of your world as well as updates to it to the disk so this tends to be the bottleneck.
Operating System
I highly recommend using Ubuntu Server to run the Minecraft dedicated server. It is available here.
At the time of writing the current version is Ubuntu Server 20.04. This is a secure and robust operating system and will leave plenty of resources available for the server to run.
The script should run on any Debian based flavor of Linux but since the Minecraft Bedrock server is compiled natively for Ubuntu I recommend sticking with it. If you have a GUI flavor of Ubuntu and a decent PC (>= 2 GB of RAM) the server will work just fine on it.
Note: People have reported in the comments that Ubuntu 16.x is no longer working with the latest official Mojang binaries. Ubuntu 18.04 is the minimum requirement for the latest versions, and 20.04 is recommended!
Installation
Log into your Linux server either using SSH or a mouse and keyboard and paste/type the following command:
The script will setup the Minecraft sever and ask you some questions on how to configure it. I’ll explain here what they mean.
The first question will be the installation path. This is the root installation path for ALL servers you will have. If you add additional servers later you should select the exact same installation path. It should always be left as the default (~).
The only exception is if you have something like a completely dedicated disk for the Minecraft server. In that case you should always use the same root path of /mnt/yourdrive or wherever the path is for every new/additional server you install.
“Start Minecraft server at startup automatically (y/n)?” – This will set the Minecraft service to start automatically when your server boots. This is a great option to set up a Minecraft server that is always available.
“Automatically restart and backup server at 4am daily (y/n)?” – This will add a cron job to the server that reboots the server every day at 4am. This is great because every time the server restarts it backs up the server and updates to the latest version. See the “Scheduled Daily Reboots” section below for information on how to customize the time or remove the reboot.
That is it for the setup script. The server will finish configuring and start!
First Run
The server will start up and start displaying output to the console.
Once you see the “Server started” line you will be able to connect from the client.
To add the server to the client open Minecraft and click “Play”. Then at the top of the screen select the “Servers” tab and click “Add Server”.
This will ask you for a Server Name and Server IP Address. For the name you can put anything and for the server IP address put the address of your Linux server. Leave the port as the default 19132. For more information on how to let people from outside your network on go to the “Port Forwarding” section below.
Now choose the server you just added in the list and connect!
Start, Stop and Restart Server
The server can be started, stopped and restarted two different ways. You can use the provided scripts in the Minecraft folder or you can use systemctl. Here are the commands:
The server backs up each time it starts. This helps you recover easily if something goes wrong. This system works best if you configured the server to restart daily since it means you will have a backup every day.
To access these backups type:
cd ~/minecraftbe/backups ls
When a backup is made the filename will be the date and time the backup was taken. If you need to restore a backup it’s very easy. Substitute the timestamp in my example to the backup you want to roll back to. Type:
cd ~/minecraftbe
./stop.sh
rm -rf worlds
tar -xf backups/2019.02.15.22.06.30.tar.gz
./start.sh
Your world has now been restored! It’s a good idea to download these backups off the server periodically just in case the server’s storage fails.
The daily reboots are scheduled using cron. It’s very easy to customize the time your server restarts.
To change the time that the server restarts type: crontab -e
This will open a window that will ask you to select a text editor (I find nano to be the easiest) and will show the cronjobs scheduled on the server. The Minecraft one will look like the following:
0 4 * * * /home/ubuntu/minecraftbe/restart.sh
Crontab’s syntax layout
There are 5 fields here. The default restart time is set to reboot at 0 minutes of the 4th hour of the day (4 AM). The other 3 fields are left as * to represent every day of every month. Make any desired changes here and press Ctrl+X to exit nano and update the cronjob.
To remove the daily reboot simply delete the line and save.
Reconfigure / Update Scripts
The scripts can always be reconfigured and updated by downloading the latest SetupMinecraft.sh and running the installer again. It will update all of the scripts in the Minecraft directory and reinstall the startup service for you.
Running SetupMinecraft.sh again will also give you a chance to reconfigure options such as the memory dedicated to the server, daily reboots, starting the server on boot, etc.
This will not overwrite your world or any other data so it is safe to run!
Port Forwarding
If everyone on your server is on the same LAN or WiFi network as you then you don’t need to do this. If you want people to connect from outside your local network then you need to set up port forwarding on your router.
The process for this is different for every router so the best thing to do is just look at your router and find the model # and put that in google with port forwarding for easy instructions on how to do it for your specific router.
You want to forward port 19132. The type of connection is both TCP and UDP. On some routers you need to do both a TCP entry and then a second entry as UDP.
Once you do this people will be able to connect to your Minecraft server through your public IP address. This is different than your local IP which is usually a 192.x.x.x or 10.x.x.x. If you don’t know what that is just go to google and type “what’s my ip” and Google will kindly tell you!
Version Override
You can revert to a previous version with the revert.sh script included in your directory like this:
james@jamesgigabyte-linux:~/minecraftbe/james$ ./revert.sh
Set previous version in version_pin.txt: bedrock-server-1.19.10.20.zip
If you have a specific version you would like to run you can also create version_pin.txt yourself like this:
The version hold can be removed by deleting version_pin.txt. This will allow it to update to the latest version again!
Wired vs. Wireless
Going with an ethernet (wired) connection is going to be faster and more reliable. There’s so much wireless traffic and other interference in the air that running your server on WiFi is not recommended.
Even if it is working great 99% of the time it can ruin your experience very quickly if the WiFi drops for a couple of seconds and you get blown up by a creeper!
All that being said, the server works fine on wireless. The script will work fine as is with a wireless connection.
Benchmarking / Testing Storage
If you’re getting poor performance you may want to run my storage benchmark with:
PC results won’t show up on the site yet (it’s meant for Raspberry Pi) but it will run on Linux just fine and give you a score. If you search for the model of your drive on Pi Benchmarks you can compare your score with others and make sure the drive is performing correctly!
Troubleshooting Note – Oracle Virtual Machines
A very common problem people have with the Oracle Virtual Machine tutorials out there that typically show you how to use a free VM is that the VM is much more difficult to configure than just about any other product / offering out there.
It is because there are several steps you need to take to open the ports on the Oracle VM. You need to both:
Set the ingress ports (TCP/UDP) in the Virtual Cloud Network (VCN) security list
*and* set the ingress ports in a Network Security Group assigned to your instance
Both of these settings are typically required before you will be able to connect to your VM instance. This is purely configuration related and has nothing to do with the script or the Minecraft server itself.
I do not recommend this platform due to the configuration difficulty but the people who have gone through the pain of configuring an Oracle VM have had good experiences with it after that point. Just keep in mind it’s going to be a rough ride through the configuration for most people.
Troubleshooting Note – Hyper-V
There is a weird bug in Hyper-V that breaks UDP connections on the Minecraft server. The fix for this is that you have to use a Generation 1 VM with the Legacy LAN network driver.
Conclusion
The Minecraft Bedrock Edition dedicated server runs much better than previous third party servers in the past that were missing critical features. The performance is very good even on low end hardware. It has never been easier to set up a Minecraft Bedrock server.
If you have any feedback or suggestions let me know in the comment section. A lot of the changes and developments in this script and guide are directly from readers.
1,551 thoughts on “Minecraft Bedrock Edition – Ubuntu Dedicated Server Guide”
Andrew
Hi, I have executed the installation just as described above. It works and runs great. Many children are happy about their Minecraft server. I wanted to inquire about how the installation and services are setup. Is the service setup for a specific user? Or, is it running as root? I cannot tell where the service file is to check it. As I understand its best to install under a different user without sudo privileges. Thanks!
Great question! I believe I do not allow it to run as root for security purposes. If people try to run it as root it should return an error.
The service is a systemd service and located at:
/etc/systemd/system/yourserver.service
You can adjust the user directly in the service if you create a special user specifically to run the Minecraft server for example. That would be pretty smart these days since we just had the log4j exploit bonanza on Java Minecraft (no impact to Bedrock) and limiting permissions to restricted users sure would have helped protect those people. It’s great to use practices like this because who knows what exploits could be discovered from Bedrock. You’re limiting the damage anyone could possibly do with an isolated / special account for it that has virtually no permissions to log in or access anything else.
After making any changes to the service make sure you do a:
sudo systemctl daemon-reload
otherwise you’ll get an error when you try to start it saying it has changed. The daemon-reload command basically tells the system yes it has changed and we changed it, go ahead and reload it.
It’s absolutely safe to use a different user without sudo privileges. The only other system configuration file the script creates other than the /etc/systemd/system/yourservice.minecraft is a sudoers file that contains very specific commands only allowing it to start/stop the server basically. That file is:
/etc/sudoers.d/minecraftbe
This contains a whitelist of sudo commands that are extremely specific down to the individual parameters even like this:
The entries in this file basically mean that passwordless sudo is allowed for commands that are typed *exactly* as they are in the file. Those are to start and stop the server and run the fix permissions script. No additional parameters or deviations are allowed (you can’t run /bin/bash for example, it has to be /bin/bash $DirName/minecraftbe/$ServerName/fixpermissions.sh -a and nothing else will trigger it).
You don’t need to give the minecraft server user sudo rights because of this basically. It’s taken care of by giving the absolute bare minimum required for the server to basically restart itself in the /etc/sudoers.d sudo registry so you do not need to add it to the sudoers group (and you shouldn’t).
An easy way to set this up is temporarily have them in the sudoers group and run SetupMinecraft.sh as that user. After it’s set up boot them out of the sudoers group, they no longer need to be in it. Doing it manually is fine too for an existing server. You will just need to change the user in the systemd/sudoers files and then run fixpermissions.sh as that user or do a chown to your new user on the minecraft server files.
Removing those two files and the ~/minecraftbe folder basically constitutes a full uninstallation (other than if apt-get installed a prerequisite but the prerequisites are so common 90% of systems should have them already).
Everything you’re trying to do it sounds like (including the sudoless account) should not only work but be encouraged/commended as the correct way to do it. Hopefully that helps!
Ok. I’ve looked into all of this. So basically, the user listed in the MC service is my main user with sudo privileges, but because of the whitelist of sudo commands, anything that might allow someone to access server files and commands is password protected? Or, at this point should i create a new user and transfer the MC server over to that user in the services file? Sorry I literally installed Ubuntu for the first time about 2 weeks ago.
No worries at all. It’s definitely better to be safe than sorry when setting these pieces up!
So right now that sounds like a pretty standard setup just using your main user. Theoretically if that user got breached it would have whatever rights that user has. If that user has sudo rights then that that is pretty much root access. The sudo password prompt would be another line of defense they would have to get around after that.
So basically the minecraft server user will have whatever rights you give it. It’s probably easiest to just add a new user that doesn’t have rights to anything in the GUI. If you wanted to do it by command line it would be something like sudo adduser minecraft, then it would set a password. You’d create a home directory and change the home directory on the account to match it as well as setup the permissions (that’s why I said it would be easier in the GUI). You’d probably want to assign a nologin shell to that user so it can’t get a shell.
Here’s a guide to do it both ways. It’s just a standard user account and it will have whatever rights you do / don’t give it if that makes sense.
The stuff in the script only grants it the rights it needs (meaning you don’t have to worry about ever giving it any rights). It definitely can’t secure against using accounts that have rights to other stuff. If there’s anything else on the machine or it’s not running as a VM or isolated in some other way then you would want to create a blank account. If you’re using an account that has access to that stuff so would an attacker if there was some sort of Minecraft exploit.
Someone would have to have a working Minecraft Bedrock exploit to even start the process of being able to utilize the rights of your account. This means they have a working Minecraft Bedrock account and have already hacked your server. Now they are in as the Minecraft server process and they need to find a way to escalate.
To the attacker they would probably have minecraft folder and that is pretty much it in the setup I’m describing. In your scenario they could sudo with your account (although they would have to pass the password check). If they didn’t have sudo rights they wouldn’t be able to do anything other than mess with the Minecraft server files (that’s what I meant by containing the damage, even during a breach).
As I said before though this just barely happened on the Java version although I don’t think it’s ever happened on Bedrock yet. I’ve never seen it happen to anyone on Bedrock or heard of it happening. It could, but I just wanted to make clear it’s not just rare, I don’t think it has happened yet on Bedrock but does that mean one will never be found? Almost certainly one will be eventually. Right now they remain theoretical threats and it hasn’t happened yet nor could I find any record of it happening.
How you set up your accounts is your second line of defense if your first line has already fallen and someone has hacked your Minecraft server with some exploit. They would need to bypass the sudo password prompt in this scenario so that’s a third line of defense (not impossible to bypass, but it’s not nothing either and is still a significant barrier, it depends on the nature of the exploit).
The rough equivalent in Windows would be a “standard” user account. These accounts do not have admin rights and have to enter the password if an admin action is necessary (similar to sudo). Is it impossible to escalate from a standard account to an admin account in Windows? No, but your paths are limited and the attack complexity / skill level goes way up. It’s the same for Linux and gives enough protection that most attackers would just move on to another target or “low-hanging fruit” as they’re typically just looking at Shodan or another site that lists online servers and going down the list (or it’s a bot).
These are just standard security practices for Linux basically. They provide substantial protection against any type of breach known or unknown. I would recommend setting up practically any service the same way. If you look in your /etc/passwd file you’ll see many services already have service accounts that are separated out. It’s just good standard security practice and adds a bunch of layers that make it increasingly more difficult to attack.
With those security measures in place someone has to also defeat sudo (if the account is even in the group) or other highly secure/frequently patched systems or somehow leverage multiple other exploits together to break out and there’s an overwhelming chance they can’t (or even if they could it’s not going to be worth how much time it will take vs. going to the next computer on the list). It’s extremely rare to be individually singled out and targeted by this skilled of an individual (they are too expensive and there are far too few of them). It’s almost entirely automated bots and script kiddies that make all of the noise you’ll see on firewall / security logs.
It’s a little tricky to learn the first time but once you’ve done it once or twice it will be trivial to do the same thing for anything else you’re hosting / may host in the future.
Hopefully that clears things up and let me know if I need to clarify anything!
Ok, all of that makes sense now after about 4 hours of poking around and typing a lot of things.
I screwed up the transfer of the files to the ownership and operation of the other user.
Finally I ended up rerunning the above setup on the new user with sudo privileges, transferring the world data under the new user, then removed sudo privileges with my root user account. Everything works including service at startup and the save data.
Is there any downfall to doing this? If I now list the sudo privileges for the new user, the only commands that show up are the ones listed in the file for starting stopping and restarting the server mentioned above.
Excellent! Yeah, the permissions are really a pain. I made the fixpermissions script to automate some of the really annoying commands you have to try to construct to do it because honestly almost any time you touch it with a text editor or anything like that there’s an excellent chance the permissions are broken (especially if they sudo’d and edited them as root or even editing it as another user — keep that in mind as you will probably edit them from your main account). I’m very glad you got it going!
The sudo command only listing those specific commands is exactly how it’s intended. It’s called the “Principle of Least Privilege” in security and states “a subject should be given only those privileges needed for it to complete its task”. That’s basically what the sudo command is telling you. The minecraft user you have can’t do anything with sudo other than run those extremely narrow commands, therefore neither would an attacker if your server was exploited.
We only need it to start and stop the server as well as fix the permissions occasionally (usually updates trigger this, otherwise it wouldn’t even do that but it breaks the automation) therefore that is all it can do. Nothing good can come from giving it more rights than that because the script literally will never use them. It would only be useful to an attacker if that makes sense.
The only downside in these situations normally would be if you needed to actually do other things with the account but since this is just a service account to host a single service it doesn’t really apply here. That’s the flipside of limiting access is if you limit it too much it won’t have enough access to work correctly or it will be too annoying. That shouldn’t be the case here since you did basically a purpose built account that is just meant to host the server and access the minecraft server files (and basically nothing else).
An easier way to explain it would be to imagine how much damage (or how little damage) someone could do if you just gave them the password to the account and told them to go crazy and destroy/pilfer as much as they can. That’s pretty much what we are talking about here. If they are an administrator it’s game over. If they are a standard user and they have full sudo rights it’s maybe game over as well if they are able to find any other holes in your setup to break out / escalate privileges. Still way better off than if it was running as root. If it’s a limited user it will just be what they have read/write access to that is at risk. The attacker inherits the rights of the process they are exploiting and the user that is running it essentially.
It’s pretty similar to having the password when it comes to a lot of rights. There are some exceptions like when you get prompted from sudo. They need to be able to type the password in that case but you can do a lot with the rights the running process has that got hacked. Sudo is a great defense though because if you’re running as root they can do anything right off the bat with a single exploit. Yours is now even more locked down than that because instead of having it in the sudo group to be able to restart processes it’s limited to only those few commands you saw listed in sudo.
Hopefully that clears up any lingering questions about what is good / bad about that. It would be pretty annoying (maybe even torture) to use a computer as a normal person with rights this restrictive and not be in the sudo group (as in the one that can sudo to admin, as you’ve learned there can be a bunch of different sudo groups/configurations in there). The minecraft server user will not complain though fortunately and is happy to do that for us.
Congratulations on getting it all set up, enjoy and have fun!
(BONUS TIP): Another smart thing to do is to not actually allow that account to log into the computer when it’s all set up. You do this by setting the ‘nologin’ shell like this:
sudo usermod minecraftuser -s /sbin/nologin
Now if you try to log in as that user it will not allow you to. This will not impact it running the Minecraft server. It’s allowed to run those as sudo due to the whitelist. It will only stop anyone/anything that shouldn’t be so it’s the perfect security setup for service accounts.
If you ever need to log back into it to do updates you can just change the shell back with the same command to /bin/bash or whatever the shell is on your system. It’s a quick one liner and completely shuts down countless attacks. Think of it as “locking” and “unlocking” the shell basically / the ability to log into the machine through ssh/remotely/other nasty things you don’t want.
It’s a terrible/sad feeling for a hacker to crack a password hash for a service account and then figure out it has a nologin shell (makes it about 90% less useful and an order of magnitude more complicated to do anything with) and that is a price I’m willing to have them pay if they are attacking your Minecraft server. Take care!
Hi Guys,
it would be cool if you can add the option just “update” i mean i do not need to modify the server every time.
also would it be cool if the backup will delete more than 10 older backup for example.
and last but not least if i run only one server why do i have to install it under a subfolder and can’t install it under the main “minecraft” home folder ?
The updates are all automatic. You do not have to update the Bedrock one at all yourself. If you ever get the message that the server is out of date and you’ve already restarted it then it’s because Microsoft hasn’t put out the updated zip yet. I never update anything for it. These are just scripts basically to help manage it. I have nothing to do with the updates, the server that the updates are hosted on or Microsoft’s development/release of the server. The script just connects to their web site.
Speaking of which if you open the start.sh script you can change the 10 backups to whatever you’d like. They’re really easy to modify / pretty clear for sure if you want to tweak things like this to match your hard drive / SSD space / requirements / etc. which are not the same for everyone and there are people that keep 100+ backups that have access to enterprise grade hardware.
The reason you have to install it to a subfolder is because it supports running/installing multiple servers at once and there needs to be a base folder. If you try to install it to the main folder using a custom path it will probably break and prune your backups as someone did that once before and it was not good. It’s meant to be that way for multiple server support which would not be possible and then people would be saying “why can’t I choose a base folder”.
People also change their mind about thinking they are only going to have a single server (or the thought had never crossed their mind until they wanted to do it) at least 50% of the time and it is ready to go for them should they choose to do that. The way you do this is just run SetupMinecraft.sh again and pick different a different server name (and different ports) and the new server will be side with side with your first one in the folder.
That’s why it’s designed the way it is at least. There’s no configuration or magic # of backups or exact setup that is going to be right for every situation. The goal of this is to give a decent enough base to work with and really automate the painful stuff like the updates. The scripts themselves aren’t updated that often and honestly if you checked up on them like every 6 months to a year you’d probably be fine not updating any more often that that. Some people have gone for years without updating the scripts themselves. I could definitely add it as an option during SetupMinecraft.sh though to make it easier / do it during setup for you and that is definitely not a bad idea.
If you think that Microsoft not releasing the zips for the dedicated server at the same time as the client comes out occasionally is bad (and I’m not saying it isn’t) you should try running the server without these scripts manually. Then you will know the definition of pain.
How would you like to download a zip file from the web site and extract it yourself every single update? That is exactly what Microsoft expects you to do, and the whole point of these scripts (or at least my primary motivation of making them) was because it was so awful and frankly unsustainable to do that when updates come out *constantly* for it and nobody can connect until you manually do them. It’s impossible to just set up a Bedrock server and “forget about it” letting it run in the background without using these scripts as far as I know. You should not have to do anything though when it’s set up.
Hopefully that helps clarify some of this stuff / design choices!
I’m very glad to hear it! I definitely tend to go into too much detail if anything. I just figure as long as I help the person (even if they skip 50% of what I say) it’s okay to have some extra details as probably most people’s interaction with it will be reading it later and it may be the very details they are looking for.
This automates everything and runs very smooth. Great work! I do have a question. Can I limit the number of backups saved so that it overwrites older backups after a certain number is reached?
Great question! So originally it did not and it actually filled up people’s hard drives and crashed the server (one was my own) so I did add this in years ago but only after some pain / lessons learned.
It will by default prune to 10 backups. This is easily adjustable in start.sh as well but it’s definitely in there. Hopefully that helps!
I came here to wonder how I would setup a Minecraft bedrock edition server on Android 11 with 64 bit. 6gb of ram and 256 GB of storage.
I know I could install termux. But then I’d need a proper gui of Ubuntu to do this. I was wondering if it is possible
Welcome! I swear this had come up a long time ago but I could not find it for the life of me anywhere. The biggest problem with Bedrock is that they don’t release a copy of the dedicated server for ARM.
I have definitely heard in the past of people hosting servers using the Android client. What was this called….
Welcome! So basically to add another world you will just run SetupMinecraft.sh again. Pick two different ports than your original server used when running the SetupMinecraft.sh script. It will create a separate folder for each server.
Basically right now there will be a “minecraftbe” folder in your home directory (usually ~/minecraftbe). That should only have one server in there at the moment (your original one). When you run SetupMinecraft.sh again it will have a separate folder. You just have to make sure they have a different name and ports.
You can actually pull up the separate server consoles with screen -r yourorigserver and screen -r yournewserver. You can press Ctrl+A followed by Ctrl+D to minimize those screen/console windows back to the background and switch between them.
I am glad you took that one, I was going to explain how to bring up the debug menus and I’m sure this is what they meant. Thanks! This is definitely the way to go for this one.
Hi, I have executed the installation just as described above. It works and runs great. Many children are happy about their Minecraft server. I wanted to inquire about how the installation and services are setup. Is the service setup for a specific user? Or, is it running as root? I cannot tell where the service file is to check it. As I understand its best to install under a different user without sudo privileges. Thanks!
Hey Andrew,
Great question! I believe I do not allow it to run as root for security purposes. If people try to run it as root it should return an error.
The service is a systemd service and located at:
/etc/systemd/system/yourserver.serviceYou can adjust the user directly in the service if you create a special user specifically to run the Minecraft server for example. That would be pretty smart these days since we just had the log4j exploit bonanza on Java Minecraft (no impact to Bedrock) and limiting permissions to restricted users sure would have helped protect those people. It’s great to use practices like this because who knows what exploits could be discovered from Bedrock. You’re limiting the damage anyone could possibly do with an isolated / special account for it that has virtually no permissions to log in or access anything else.
After making any changes to the service make sure you do a:
sudo systemctl daemon-reloadotherwise you’ll get an error when you try to start it saying it has changed. The daemon-reload command basically tells the system yes it has changed and we changed it, go ahead and reload it.
It’s absolutely safe to use a different user without sudo privileges. The only other system configuration file the script creates other than the /etc/systemd/system/yourservice.minecraft is a sudoers file that contains very specific commands only allowing it to start/stop the server basically. That file is:
/etc/sudoers.d/minecraftbeThis contains a whitelist of sudo commands that are extremely specific down to the individual parameters even like this:
sudoline="$UserName ALL=(ALL) NOPASSWD: /bin/bash $DirName/minecraftbe/$ServerName/fixpermissions.sh -a, /bin/systemctl start $ServerName, /bin/bash $DirName/minecraftbe/$ServerName/start.sh"The entries in this file basically mean that passwordless sudo is allowed for commands that are typed *exactly* as they are in the file. Those are to start and stop the server and run the fix permissions script. No additional parameters or deviations are allowed (you can’t run /bin/bash for example, it has to be
/bin/bash $DirName/minecraftbe/$ServerName/fixpermissions.sh -aand nothing else will trigger it).You don’t need to give the minecraft server user sudo rights because of this basically. It’s taken care of by giving the absolute bare minimum required for the server to basically restart itself in the /etc/sudoers.d sudo registry so you do not need to add it to the sudoers group (and you shouldn’t).
An easy way to set this up is temporarily have them in the sudoers group and run SetupMinecraft.sh as that user. After it’s set up boot them out of the sudoers group, they no longer need to be in it. Doing it manually is fine too for an existing server. You will just need to change the user in the systemd/sudoers files and then run fixpermissions.sh as that user or do a chown to your new user on the minecraft server files.
Removing those two files and the ~/minecraftbe folder basically constitutes a full uninstallation (other than if apt-get installed a prerequisite but the prerequisites are so common 90% of systems should have them already).
Everything you’re trying to do it sounds like (including the sudoless account) should not only work but be encouraged/commended as the correct way to do it. Hopefully that helps!
Ok. I’ve looked into all of this. So basically, the user listed in the MC service is my main user with sudo privileges, but because of the whitelist of sudo commands, anything that might allow someone to access server files and commands is password protected? Or, at this point should i create a new user and transfer the MC server over to that user in the services file? Sorry I literally installed Ubuntu for the first time about 2 weeks ago.
Hey Andrew,
No worries at all. It’s definitely better to be safe than sorry when setting these pieces up!
So right now that sounds like a pretty standard setup just using your main user. Theoretically if that user got breached it would have whatever rights that user has. If that user has sudo rights then that that is pretty much root access. The sudo password prompt would be another line of defense they would have to get around after that.
So basically the minecraft server user will have whatever rights you give it. It’s probably easiest to just add a new user that doesn’t have rights to anything in the GUI. If you wanted to do it by command line it would be something like sudo adduser minecraft, then it would set a password. You’d create a home directory and change the home directory on the account to match it as well as setup the permissions (that’s why I said it would be easier in the GUI). You’d probably want to assign a nologin shell to that user so it can’t get a shell.
Here’s a guide to do it both ways. It’s just a standard user account and it will have whatever rights you do / don’t give it if that makes sense.
The stuff in the script only grants it the rights it needs (meaning you don’t have to worry about ever giving it any rights). It definitely can’t secure against using accounts that have rights to other stuff. If there’s anything else on the machine or it’s not running as a VM or isolated in some other way then you would want to create a blank account. If you’re using an account that has access to that stuff so would an attacker if there was some sort of Minecraft exploit.
Someone would have to have a working Minecraft Bedrock exploit to even start the process of being able to utilize the rights of your account. This means they have a working Minecraft Bedrock account and have already hacked your server. Now they are in as the Minecraft server process and they need to find a way to escalate.
To the attacker they would probably have minecraft folder and that is pretty much it in the setup I’m describing. In your scenario they could sudo with your account (although they would have to pass the password check). If they didn’t have sudo rights they wouldn’t be able to do anything other than mess with the Minecraft server files (that’s what I meant by containing the damage, even during a breach).
As I said before though this just barely happened on the Java version although I don’t think it’s ever happened on Bedrock yet. I’ve never seen it happen to anyone on Bedrock or heard of it happening. It could, but I just wanted to make clear it’s not just rare, I don’t think it has happened yet on Bedrock but does that mean one will never be found? Almost certainly one will be eventually. Right now they remain theoretical threats and it hasn’t happened yet nor could I find any record of it happening.
How you set up your accounts is your second line of defense if your first line has already fallen and someone has hacked your Minecraft server with some exploit. They would need to bypass the sudo password prompt in this scenario so that’s a third line of defense (not impossible to bypass, but it’s not nothing either and is still a significant barrier, it depends on the nature of the exploit).
The rough equivalent in Windows would be a “standard” user account. These accounts do not have admin rights and have to enter the password if an admin action is necessary (similar to sudo). Is it impossible to escalate from a standard account to an admin account in Windows? No, but your paths are limited and the attack complexity / skill level goes way up. It’s the same for Linux and gives enough protection that most attackers would just move on to another target or “low-hanging fruit” as they’re typically just looking at Shodan or another site that lists online servers and going down the list (or it’s a bot).
These are just standard security practices for Linux basically. They provide substantial protection against any type of breach known or unknown. I would recommend setting up practically any service the same way. If you look in your /etc/passwd file you’ll see many services already have service accounts that are separated out. It’s just good standard security practice and adds a bunch of layers that make it increasingly more difficult to attack.
With those security measures in place someone has to also defeat sudo (if the account is even in the group) or other highly secure/frequently patched systems or somehow leverage multiple other exploits together to break out and there’s an overwhelming chance they can’t (or even if they could it’s not going to be worth how much time it will take vs. going to the next computer on the list). It’s extremely rare to be individually singled out and targeted by this skilled of an individual (they are too expensive and there are far too few of them). It’s almost entirely automated bots and script kiddies that make all of the noise you’ll see on firewall / security logs.
It’s a little tricky to learn the first time but once you’ve done it once or twice it will be trivial to do the same thing for anything else you’re hosting / may host in the future.
Hopefully that clears things up and let me know if I need to clarify anything!
Ok, all of that makes sense now after about 4 hours of poking around and typing a lot of things.
I screwed up the transfer of the files to the ownership and operation of the other user.
Finally I ended up rerunning the above setup on the new user with sudo privileges, transferring the world data under the new user, then removed sudo privileges with my root user account. Everything works including service at startup and the save data.
Is there any downfall to doing this? If I now list the sudo privileges for the new user, the only commands that show up are the ones listed in the file for starting stopping and restarting the server mentioned above.
Hey Andrew,
Excellent! Yeah, the permissions are really a pain. I made the fixpermissions script to automate some of the really annoying commands you have to try to construct to do it because honestly almost any time you touch it with a text editor or anything like that there’s an excellent chance the permissions are broken (especially if they sudo’d and edited them as root or even editing it as another user — keep that in mind as you will probably edit them from your main account). I’m very glad you got it going!
The sudo command only listing those specific commands is exactly how it’s intended. It’s called the “Principle of Least Privilege” in security and states “a subject should be given only those privileges needed for it to complete its task”. That’s basically what the sudo command is telling you. The minecraft user you have can’t do anything with sudo other than run those extremely narrow commands, therefore neither would an attacker if your server was exploited.
We only need it to start and stop the server as well as fix the permissions occasionally (usually updates trigger this, otherwise it wouldn’t even do that but it breaks the automation) therefore that is all it can do. Nothing good can come from giving it more rights than that because the script literally will never use them. It would only be useful to an attacker if that makes sense.
The only downside in these situations normally would be if you needed to actually do other things with the account but since this is just a service account to host a single service it doesn’t really apply here. That’s the flipside of limiting access is if you limit it too much it won’t have enough access to work correctly or it will be too annoying. That shouldn’t be the case here since you did basically a purpose built account that is just meant to host the server and access the minecraft server files (and basically nothing else).
An easier way to explain it would be to imagine how much damage (or how little damage) someone could do if you just gave them the password to the account and told them to go crazy and destroy/pilfer as much as they can. That’s pretty much what we are talking about here. If they are an administrator it’s game over. If they are a standard user and they have full sudo rights it’s maybe game over as well if they are able to find any other holes in your setup to break out / escalate privileges. Still way better off than if it was running as root. If it’s a limited user it will just be what they have read/write access to that is at risk. The attacker inherits the rights of the process they are exploiting and the user that is running it essentially.
It’s pretty similar to having the password when it comes to a lot of rights. There are some exceptions like when you get prompted from sudo. They need to be able to type the password in that case but you can do a lot with the rights the running process has that got hacked. Sudo is a great defense though because if you’re running as root they can do anything right off the bat with a single exploit. Yours is now even more locked down than that because instead of having it in the sudo group to be able to restart processes it’s limited to only those few commands you saw listed in sudo.
Hopefully that clears up any lingering questions about what is good / bad about that. It would be pretty annoying (maybe even torture) to use a computer as a normal person with rights this restrictive and not be in the sudo group (as in the one that can sudo to admin, as you’ve learned there can be a bunch of different sudo groups/configurations in there). The minecraft server user will not complain though fortunately and is happy to do that for us.
Congratulations on getting it all set up, enjoy and have fun!
(BONUS TIP): Another smart thing to do is to not actually allow that account to log into the computer when it’s all set up. You do this by setting the ‘nologin’ shell like this:
sudo usermod minecraftuser -s /sbin/nologinNow if you try to log in as that user it will not allow you to. This will not impact it running the Minecraft server. It’s allowed to run those as sudo due to the whitelist. It will only stop anyone/anything that shouldn’t be so it’s the perfect security setup for service accounts.
If you ever need to log back into it to do updates you can just change the shell back with the same command to /bin/bash or whatever the shell is on your system. It’s a quick one liner and completely shuts down countless attacks. Think of it as “locking” and “unlocking” the shell basically / the ability to log into the machine through ssh/remotely/other nasty things you don’t want.
It’s a terrible/sad feeling for a hacker to crack a password hash for a service account and then figure out it has a nologin shell (makes it about 90% less useful and an order of magnitude more complicated to do anything with) and that is a price I’m willing to have them pay if they are attacking your Minecraft server. Take care!
Hi Guys,
it would be cool if you can add the option just “update” i mean i do not need to modify the server every time.
also would it be cool if the backup will delete more than 10 older backup for example.
and last but not least if i run only one server why do i have to install it under a subfolder and can’t install it under the main “minecraft” home folder ?
thanks eike
Hey Eike,
The updates are all automatic. You do not have to update the Bedrock one at all yourself. If you ever get the message that the server is out of date and you’ve already restarted it then it’s because Microsoft hasn’t put out the updated zip yet. I never update anything for it. These are just scripts basically to help manage it. I have nothing to do with the updates, the server that the updates are hosted on or Microsoft’s development/release of the server. The script just connects to their web site.
Speaking of which if you open the start.sh script you can change the 10 backups to whatever you’d like. They’re really easy to modify / pretty clear for sure if you want to tweak things like this to match your hard drive / SSD space / requirements / etc. which are not the same for everyone and there are people that keep 100+ backups that have access to enterprise grade hardware.
The reason you have to install it to a subfolder is because it supports running/installing multiple servers at once and there needs to be a base folder. If you try to install it to the main folder using a custom path it will probably break and prune your backups as someone did that once before and it was not good. It’s meant to be that way for multiple server support which would not be possible and then people would be saying “why can’t I choose a base folder”.
People also change their mind about thinking they are only going to have a single server (or the thought had never crossed their mind until they wanted to do it) at least 50% of the time and it is ready to go for them should they choose to do that. The way you do this is just run SetupMinecraft.sh again and pick different a different server name (and different ports) and the new server will be side with side with your first one in the folder.
That’s why it’s designed the way it is at least. There’s no configuration or magic # of backups or exact setup that is going to be right for every situation. The goal of this is to give a decent enough base to work with and really automate the painful stuff like the updates. The scripts themselves aren’t updated that often and honestly if you checked up on them like every 6 months to a year you’d probably be fine not updating any more often that that. Some people have gone for years without updating the scripts themselves. I could definitely add it as an option during SetupMinecraft.sh though to make it easier / do it during setup for you and that is definitely not a bad idea.
If you think that Microsoft not releasing the zips for the dedicated server at the same time as the client comes out occasionally is bad (and I’m not saying it isn’t) you should try running the server without these scripts manually. Then you will know the definition of pain.
How would you like to download a zip file from the web site and extract it yourself every single update? That is exactly what Microsoft expects you to do, and the whole point of these scripts (or at least my primary motivation of making them) was because it was so awful and frankly unsustainable to do that when updates come out *constantly* for it and nobody can connect until you manually do them. It’s impossible to just set up a Bedrock server and “forget about it” letting it run in the background without using these scripts as far as I know. You should not have to do anything though when it’s set up.
Hopefully that helps clarify some of this stuff / design choices!
Hi James,
that clears everything …and thanks for the detailed answer and be wondeful script. 🙂
Hey Eike,
I’m very glad to hear it! I definitely tend to go into too much detail if anything. I just figure as long as I help the person (even if they skip 50% of what I say) it’s okay to have some extra details as probably most people’s interaction with it will be reading it later and it may be the very details they are looking for.
Enjoy and have fun!
This automates everything and runs very smooth. Great work! I do have a question. Can I limit the number of backups saved so that it overwrites older backups after a certain number is reached?
Hey Steve,
Great question! So originally it did not and it actually filled up people’s hard drives and crashed the server (one was my own) so I did add this in years ago but only after some pain / lessons learned.
It will by default prune to 10 backups. This is easily adjustable in start.sh as well but it’s definitely in there. Hopefully that helps!
I came here to wonder how I would setup a Minecraft bedrock edition server on Android 11 with 64 bit. 6gb of ram and 256 GB of storage.
I know I could install termux. But then I’d need a proper gui of Ubuntu to do this. I was wondering if it is possible
Hey Woodman,
Welcome! I swear this had come up a long time ago but I could not find it for the life of me anywhere. The biggest problem with Bedrock is that they don’t release a copy of the dedicated server for ARM.
I have definitely heard in the past of people hosting servers using the Android client. What was this called….
Here is a Java one for sure.
The only one I know of for Android (or that even mentions it) is PocketMine which is an older version of the server but it is possible:.
It’s quite tricky unfortunately. The Java one is definitely easier for Android. Hopefully those help!
how can i change the minecraft game mode and difficulty ? thanks
Hey daiki23,
My preferred way is pull up your Minecraft console with:
screen -r
and then type in
op yourplayeror
op "your player"You can also use the gamemode player creative or gamemode player adventure from the console. Hopefully that helps!
Hi, thanks for the very good tutorial !!! It´s working fine. How can I add a second World ?
Hey Michael,
Welcome! So basically to add another world you will just run SetupMinecraft.sh again. Pick two different ports than your original server used when running the SetupMinecraft.sh script. It will create a separate folder for each server.
Basically right now there will be a “minecraftbe” folder in your home directory (usually ~/minecraftbe). That should only have one server in there at the moment (your original one). When you run SetupMinecraft.sh again it will have a separate folder. You just have to make sure they have a different name and ports.
You can actually pull up the separate server consoles with screen -r yourorigserver and screen -r yournewserver. You can press Ctrl+A followed by Ctrl+D to minimize those screen/console windows back to the background and switch between them.
That’s all there is to it, hopefully that helps!
Hi, may i ask how to enable show coordination on minecraft server
Type the following in Chat: /gamerule showcoordinates true
Hey Michael,
I am glad you took that one, I was going to explain how to bring up the debug menus and I’m sure this is what they meant. Thanks! This is definitely the way to go for this one.