Is my server compromised?
 

There was a random guy came into our server and he could use the (ALL) chat which was really distracting. How do I fix this? AFAIK this is a rcon cmd but he doesnt even have that

Re: Is my server compromised?
 

with no ounce of context, no one will be able to help you.


meta version
meta list
amxx version
amxx plugins
status


or with rcon:

rcon meta version
rcon meta list
rcon amxx version
rcon amxx plugins
rcon status

Re: Is my server compromised?
 

Are you one of the official versions of AMX Mod X? Are you using SteamID to authenticate your admins (users.ini)?

Re: Is my server compromised?
 

If you think rcon is the problem, remove the rcon_password. rcon_password "" will prevent it from being used by malicious actors. I think this is more related towards the ALL chat spam (triggered by using say_team @), which you can block using OciXCrom's Chat Manager, or a custom plugin if someone's interested in making one.

Re: Is my server compromised?
 

Changing the rcon password is good advice. If a password is required, use a very strong password that cannot be guessed.

The "say_team @" message will begin with either "(ADMIN)" or "(PLAYER)". "(ALL)" is only shown when using amx_say. If it's a player doing this directly from their own game, it will show up in the logs so that the person can be banned. If it's going through RCON, the change of password will do wonders.

Re: Is my server compromised?
 

Yes im using steam id. Yes official version.


This is it yep. I actually have rcon password on so im not sure whats happening

this is what happened. Do I just ban the person when he does this lol. No way to remove say_team @? or just install that plugin

Re: Is my server compromised?
 

Wait, so which one is actually occuring? Your original post said that it's the "(ALL)" message which requires admin permissions. So, which one are they using, the one with "(PLAYER)" or the one with "(ALL)"?

If it's one that doesn't require admin permissions, we can remove it. Please post the output of "meta list" and "amxx list" so that we can determine which version you're using.

Re: Is my server compromised?
 

You're right about that, apologies for the mistake.

In that case, you need to also remove that particular player from the users.ini file, because they probably used amx_addadmin to give themselves flags using rcon. A plugin wouldn't help in your case.