[karil]

This thread was created to provide information to fellow server administrators about the best latest server security plugins and scripts.

If you see a plugin/script has been updated please message me ASAP on PM!


Firstly some basic advice:

• Use a safe RCON password with at least 10 characters (preferably letters + numbers).*
• Give admin privileges only to trustworthy players! Be especially careful when giving out RCON password or even FTP/shell info.
• Never ever use plugins or scripts which set cvar sv_cheats 1. Keep sv_cheats 0 in server configuration file at all times.

*

Also use these RCON cvars in your server configuration file! rcon_password Set rcon passsword. Leave blank to disable rcon sv_rcon_banpenalty <mins> Number of minutes to ban users who fail rcon authentication. Default: 0 sv_rcon_maxfailures <0-20> Max number of times a user can fail rcon authentication before being banned. Default: 10 sv_rcon_minfailures <0-20> Number of times a user can fail rcon authentication in sv_rcon_minfailuretime before being banned. Default: 5 sv_rcon_minfailuretime <1-seconds> Number of seconds to track failed rcon authentications. Default: 30 Source: http://www.cstrike-planet.com/cvarlist

Now to the server security plugins and scripts. I'll divide them in sections depending on their primary tasks.

• Protection of RCON password/access:
  • Rcon locker / exploit fix | version 0.6.5 (released on 8/4/2010) | download @ https://forums.alliedmods.net/showthread.php?p=841590
• Protection to unauthorized file uploading or downloading from the server*:
  • D-FENS (includes linux binaries, tested) | version 1.1 (released on 29/11/2009) | download @ http://forums.alliedmods.net/showthread.php?t=109453
    *it is recommended to set sv_allowupload 0 in your server configuration file (this will disable sprays but also protect your files well)
• Protection to prevent server lags, hacking attempts, abuse and crashes:
  • ServSecurity | version 0.7.1 (released on 23/3/2010) | download @ http://forums.eventscripts.com/viewt...p?f=27&t=33974
    Protection against various harmful commands, connection flooders, unauthorized changes to server configuration file, Mani's clients.txt file, LUA scripts users, etc..
  • Kigen's Anti-Cheat | version 1.2.0.9 (released on 23/3/2010 ) -> auto-updates when released | download @ http://www.kigenac.com/viewtopic.php?f=4&t=231
    Protection against various harmful commands, connection flooders, LUA scripts users, ANTI-CHEAT (wallhack, aimbot,...), rcon crash prevention, etc..
• Protection against DDoS attacks*:
  • DoS Attack Fixer for CSS (includes linux binaries, untested) | version 3 (released on 1/1/2010) | download @ http://www.sourceop.com/modules.php?...download&cid=9
  • SRCDS Denial of Service protect (includes linux binaries, tested) | version 1.0.0.0 (released on 22/6/2009 ) | download @ http://forums.alliedmods.net/showthread.php?t=95312
    DAF v3 is preffered to SRCDS DoS protect.
• Protection against two commonly known SRCDS crashing techniquest (RCON crash, connecting command approach):
  • CrashBlock (includes linux binaries, tested) | version 2.0 (released on 8/12/2009) | download @ http://zblock.mgamez.eu/downloads/crashblock_v2.zip

Log of recent changes to the post:
(example: "UPDATE! | 20/4/2010 | ServSecurity | version 0.7.1 to 0.8 |" OR "NEW! | 1/4/2010 | Karil's anti DDoS | version 1.0 | Prevents a new kind of DDoS attacks on SRCDS servers |")

UPDATE! | 8/4/2010 | Rcon locker / exploit fix | version 0.6.4 to 0.6.5 |

I hope the links to ES plugins are OK. If not, please contact me ASAP.

Regards, Karil.

[karil]

double post, please delete

[Mavrick4283]

Um..not to be a buzz kill but

*it is recommended to set sv_allowupload 0 in your server configuration file (this will disable sprays but also protect your files well)

will not do any thing the exploit will work with it set to 0

ServSecurity | version 0.7.1 (released on 23/3/2010) | download @ http://forums.eventscripts.com/viewt...p?f=27&t=33974
Protection against various harmful commands, connection flooders, unauthorized changes to server configuration file, Mani's clients.txt file, LUA scripts users, etc..

this will not do any thing i have tested it and only got banned buy it once es does not have the power to stop any exploits......it can only slow them down.

Kigen's Anti-Cheat | version 1.2.0.9 (released on 23/3/2010 ) -> auto-updates when released | download @ http://www.kigenac.com/viewtopic.php?f=4&t=231
Protection against various harmful commands, connection flooders, LUA scripts users, ANTI-CHEAT (wallhack, aimbot,...), rcon crash prevention, etc..

Well if you have a very good server and do not mind crashes and lag spikes then go a head and put it on there and also this will only stop sv_Cheat bypass the other stuff in it does not work every time.

CrashBlock (includes linux binaries, tested) | version 2.0 (released on 8/12/2009) | download @ http://zblock.mgamez.eu/downloads/crashblock_v2.zip

I have NEVER seen this work on CSS win and linux but that may be me .

[Scone]

If you have a dedicated server, surely the best defence is simply to block RCON entirely using your firewall? (i.e. allow UDP but block TCP) That would stop the majority of problems here.

[Bacardi]

Your right.
And there is already
Sticky: Protecting your server! devicenull
what lead/have been added in AMWiki
http://wiki.alliedmods.net/SRCDS_Hardening

This thread is useless... trash

[karil]

Actually this thread was intented to inform admins of new versions of security plugins/scripts. I hope you distinguish between mine and devicenulls article.

1. it's recommended not necessary...
2. If you're doing well without SS and KAC great, but I don't imagine my server being secure without these.
3. I've disabled that crashing technique with CB 2.0. I've even tested it, as I got myself that damn program to analyse what is making my server crash every hour.

I've spent dozens of hours in investigating crashes, lag spikes, admin hacks on my server but I can say most of these plugins were life saving and if I can help at least couple of admins in finding security fixes earlier I'll be happy.

[devicenull]

We don't need threads duplicating content on the wiki, for no real reason.