Securing Your Server

### The Basics

This guide assumes you are using a Minecraft server host **NOT** self-hosting, using a Virtual Private Server (VPS), or a Dedicated Server. Those 3 methods are *MUCH* more difficult to secure than just using a Minecraft host as they manage most of the security for you.

**First, let's identify some threats** (From most common to least common):

1. Hacked Client Players
2. Staff Abuse
3. DDOS Attacks
	* Essentially someone overloads your server and shuts it down temporarily.
4. Social Engineering / Tricking Server Owners
5. Actual Hackers (Or, more commonly, Script Kiddies)
6. Malicious Software / Plugins / Mods
7. Database Credential Abuse

### Hacked Client Players

* A "Hacked Client" is a modded client that is designed to give players an unfair advantage in-game. It can allow players to run or mine incredibly quickly, fly, kill everything around the player at maximum efficiency, etc.
* Force OP hacks and similar aren't as much a threat as they used to be. However, it is still important to know what is possible with hacks so you can catch hackers and stop them before they cause damage.
* Installing a hacked client runs the risk of installing malware or PUPs (Potentially Unwanted Programs) and for this reason I do not recommend installing hacked clients to learn about hacks. Better safe than sorry. However, you can lookup videos regarding hacks being used on more updated versions of Minecraft to help you learn about the threats they pose.
* Last I tested (back in Minecraft 1.8 - 1.12) it was (and likely still is) possible for hacked clients with creative mode to spawn in command blocks that can run commands, as well as, items that would be impossible to obtain normally (such as Wurst's Kill Potion).
* So, before you run into command block issues, disable them entirely by going into `server.properties` then find: `enable-command-block=true` and set it to `false` and restart your server. Better safe than sorry.
* You may also install an anti-cheat plugin in order to reduce the risk hackers can get an advantage over normal players on your server. No anti-cheat is perfect unfortunately so this may resolve in false-positives (AKA a normal player getting kicked for "hacking" when they weren't). As a result it would likely be best to disable automatic kicks/banning and just to have it block hacks without taking action.

### Staff Abuse

One of the most common forms of players gaining OP and such is due to staff abuse. Solution? **ONLY** give owner / op permissions to those you know well and trust 100%. Even if an abusive staff member is only given OP for a mere 10 minutes, that is enough time for them to destroy the server one way or another.

* I've seen abusive staff on servers create EssentialsX admin signs to do things like [Gamemode], [Free], [Buy] (such as buy 2304 diamond blocks for $1), [Sell] (such as 1 Dirt for $10,000), etc.
* I've also seen players hide command blocks in the world at random places and have them be triggered by redstone so when their OP powers were removed, they could still use those command blocks. And when they were banned they could use alternate accounts to use those command blocks again.
* One of the most common forms of abuse I've seen is CoreProtect's Rollback feature to duplicate items. I've seen this more times than I can count on more servers than I can count.

**Over the years of watching staff abuse on servers I played, there were two things I learned:**

1. **DO NOT EVER give your staff permissions they don't *NEED* to do their job.** I cannot emphasize enough how many servers will give their admins things like creative mode or OP when literally nothing for their job requires those powers. And maybe you'll tell me: "*But they're responsible/trustworthy so they won't use those.*" And my reaction will be (click GIFs to enlarge):
	* **If they have no reason to use them, don't give them it!! ...** You are literally asking your staff to abuse the powers, otherwise why would you give them it? And just because you don't see your staff abusing doesn't mean they aren't.
2. **Even the most trustworthy, friendly, and professional staff may be abusing their powers.**
	* I've seen this on several servers but it was especially engraved into my head on the main server I played as a teenager. All the staff behaved professionally and friendly. They were considered very trustworthy and veteran players. However, literally all the high ranking staff given good commands / powers abused them. Most weren't caught for 2+ years because they were very careful. Some weren't even caught at all- but they admitted it to me and a few other people later on.
	* Whether it be staff abused their powers to spawn-in/rollback items (duplicate items) for economical gain, or use worldedit to help their friends, or for saving time like copy and pasting cacti farms to make them even larger with worldedit, etc. Staff will abuse so don't give them that chance. Don't take that risk. Sure, there is a chance they are responsible. There is also a good chance they are not. And if they don't need the permissions to do their jobs then there is no reason for them to have it!

### DDOS Attacks

Hooray! We have an easy solution for this potential threat! Make sure the Minecraft host you are using uses DDOS protection. The more the better. Some will only offer 5 Gigabytes (GB) or so. Others will offer a full TB (1000 GB) of DDOS protection!

### Social Engineering / Tricking Server Owners

**Social Engineering** is defined as:

```
(in the context of information security) the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.
```
In the case of Minecraft servers it is the act of a malicious user trying to trick you into providing them your server credentials, your Minecraft account credentials, your Discord credentials, or website administration credentials. Then using that they may abuse their powers to mess up your server. This may take place in the form of Phishing.
**Phishing** is defined as:

```
the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
```
However, it does not always come in the form of malicious emails. Someone may provide you with a URL or you may find a URL (or website link) on the web that leads to a fake website (that looks like an identical or similar copy of the website it is trying to replicate). In order to avoid these types of issues, never click links in emails you receive. Furthermore, always type an official website link into your browser instead of clicking them from other websites. This is relevant for your important financial information in real life and your important server credentials for your Minecraft server.

Similarly, a player may login to your server stating they are from the staff team of your Minecraft host and they need your server panel credentials to do some necessary administration that is crucial to the functioning of your server. Your Minecraft host team will NEVER contact you through your Minecraft server. If anyone does, they are a malicious player.

Just keep these types of risks in mind.

### Actual Hackers (Or, more commonly, Script Kiddies)

There is a common misconception about hackers in games. Players using a "hacked" client are actually using a modded client that offers unfair advantages and hence it is commonly referred to as a "hacked client". They are not actual hackers. In truth, they are modders.

Now, when I say actual hackers we're talking about people that know how to use Kali Linux, Password Crackers, and other malicious things for blackhat purposes. Most hackers that play Minecraft will be Script Kiddies. In other words, someone that uses a pre-made script to hack because they don't know enough to do real / efficient hacking. They are still a threat but are easier to stop than an experienced hacker.

Now, if someone tries to hack your server then **your server is only as strong as your weakest link.** In other words, if your Minecraft password is very strong but your recovery questions are very weak, your account is not much safer than it was with a weak password.

**How To Prevent Getting Hacked**

1. Use different and very strong passwords for everything that is important.
	* For example, your Microsoft/Mojang account(s), the emails connected to those accounts, the password you use to connect to your server files via FTP or SFTP, the password you use to connect to your host's website, and even your recovery question answers for all of these things.
	* Here are a couple strategies for strong password creation.
		+ First, you could generate a random password from a website (like this one). It is recommended to change the result slightly because you should never put your actual password (or new password) from a website. Then store your password in a safe spot so you can copy/paste it later.
		+ The second option is to create a password sentence then take the first letter of each word in the sentence (CAsE-SenSiTiVE), as well as, any symbols and numbers. This allows you to create easier to type passwords that are more memorable in the event you are unable to copy/paste your password. For instance, I could have the sentence: "*When 23 kittens and 14 lions appear at my doorstep waiting to be fed I cower in fear behind the couch!*" This would equal the password: "*W23ka14laamdwtbfIcifbtc!*". Having a mixture of letters, numbers, and symbols is best.
	* Using this site we can predict how long it would take a hacker to crack our password. Do not input your exact password as you should never input your password into a website. Just input a password similar to it. Above I provided a password sentence and the password it equaled. I input that password into the website I linked and it determined it would take centuries for someone to crack the password (even with a high-end password cracking system).
2. Use a well-known, free, and reliable password manager to store your difficult passwords. I have had good experiences with LastPass. While no software is 100% secure, as long as you take the recommended precautions it will minimize your risk.
	* It is a browser extension, website, and app.
	* It supports storing multiple accounts per website, selecting your data to fill out, and auto-filling your data.
	* You can store passwords, add notes, and more!
	* **Just be sure** your LastPass password itself is **very strong** (like the one in the image above) and that you have that password safely written down somewhere. Do not store the password ANYWHERE except in real life in a safe location. After all, if someone is able to crack (guess your password using software) then they will have access to ALL of your important passwords. It is also recommended to change your password periodically.
	* For even better security you can enable 2FA (Two-Factor Authentication) for LastPass! Whenever you try to sign in it will ask for a code from your 2FA app. While this may seem inconvenient at first, the pros FAR outweigh the cons and you will get used to it. This means even if someone were to obtain your password they would still need that code in order to access your account.
	* LastPass offers a free version and premium version. I've used the free version for years and it is perfect in my experience. But the free version can only be used on either Desktop **OR** Mobile.
3. Lastly, when connecting to a website it is best practice to connect using "https://" in front of the website's link (instead of "http://"). The S stands for secure and it encrypts your network traffic between your computer and the web server you're accessing. While this isn't a huge deal when you're on a secure private network like your home, it becomes a larger deal when on a public network such as in a library, school, or coffee shop.
	* Both Google Chrome and FireFox will allow you to set websites to load with HTTPS by default and warn you if a website does not support HTTPS. Just go to their settings and search for "https" to find the setting and enable it.

### Malicious Software / Plugins / Mods

#### Using an Anti-Virus On Your Computer

On your own computer you should, of course, be using an anti-malware (AKA anti-virus) program. I recommend Windows Defender for real-time protection on Windows computers. It is free and comes with Windows. While third-party solutions used to be the best way to handle malware protection- Microsoft has really upped their game and now Microsoft Defender is one of the best real-time protection solutions on the market (and it is free!). Be sure it is set to scan periodically and you can go through and change various options if desired.

I also recommend the browser extension "Malwarebytes Browser Guard" (Chrome link, FireFox link). It is free and blocks malicious pop-ups and website cookies that may show you malicious ads or cause other problems.

If you're determined to use a third-party solution then BitDefender and ESET are the most effective as of May 2021 at least. Bear in mind these cost money.

#### The Risk of Downloading

Every time you download something there is a risk that it has malware in it and may harm your computer or steal your important data such as passwords. Risk varies depending on the site you're downloading from. It is important to ONLY download from well-known sites such as:

* https://bukkit.org/, (plugins)
* https://www.spigotmc.org/, (plugins)
* https://www.mc-market.org/ (plugins, server setups, etc)
* https://www.curseforge.com/ (mods)

While these websites **do still pose *some*** risk, they are much safer than most alternatives. People can post malicious plugins on those websites but they will often be taken down fairly quickly. If you're hesitant, just don't download plugins/mods from users with new accounts (or new plugins/mods).

A malicious plugin may not directly harm your computer but it could allow the developer to take control of your server, op players, etc. The only way to stop them is by removing the plugin. However, some malicious plugins can infect other jar files in your server files. Meaning it can infect every single plugin jar & possibly the server jar within your server files. This has occurred with leaked plugins as well- so instead of trying to get paid plugins free and watching your server get destroyed.. Just buy the plugin you wish to use or don't use it.

### Database Credential Abuse

Whenever you report bugs, server crashes, etc to developers or people you're asking for help, you may provide your plugin configuration files to them. **Be sure the configuration files do NOT include your MySQL database login details.** Otherwise anyone who reads that information can access your MySQL database and depending on your plugins and their abilities, they could give themselves OP etc with solely your database. This would be an *extremely* difficult thing to catch / figure out probably so don't let it happen to start with!

### Summary

1. To prevent players from using "hacked" clients on your server- use an anti-cheat plugin.
2. To prevent your staff from abusing their powers ensure you only promote staff to higher ranks after they've proven themselves to be trustworthy and reliable. Furthermore, only give staff the permissions they ***NEED*** to do their job (NO EXCEPTIONS!). On a Survival server under no circumstances do non-owner staff need creative mode, OP, etc.
3. Ensure your Minecraft host has DDOS Protection in order to prevent your server from getting DDOSed.
4. Keep your eye out for players, emails, websites, etc that are trying to trick you into providing them your administrator credentials so they can steal your accounts and ruin your server.
5. Use a good anti-virus software on your computer (I.e. Windows Defender) and only download plugins/mods from trustworthy and popular websites such as SpigotMC, MC-Market, and CurseForge. Furthermore, regardless of where you download files, stick to the files that are not from new members and already have many downloads because they are the ones most likely to be safe. Malicious plugins and mods might not impact your PC but they could allow a malicious user to get OP on your server.
6. When asking for help on forums and sharing your plugin config files- be sure to remove your MySQL database credentials first. No one should ever have access to your MySQL database credentials except you and your plugin config files.