Secure a new server

Reviewed

You need access to the server's storyforce_server.cfg before the server is first started.

The root credential is read once, on an empty database, and every later boot ignores it.

Set the root password before first boot

On the first boot of an empty database StoryForce creates one account from these 2 cvars and gives it membership and leadership admin. Edit them before the first start:

set  sf_seedaccount           "storyforce"
set  sf_seedaccountpass       "<your own password>"

Get back into a locked root account

sf_rootreset runs at the server console or over rcon, never from a player's in-game console.

It re-hashes the password and restores membership and leadership admin.

Harden rcon

rconpassword ships commented out, so a new server has no remote control at all.

Set a strong password that you do not use anywhere else in your private config:

set rconpassword "<your own password>"

Rcon has the same authority as the server console.

RCON commands without as=<account> have full console authority. Where supported, as= applies that account's permissions. by= only records attribution.

Run commands over RCON covers these options and the commands that accept them.

Control who can join and register

g_password ships empty, so anybody can connect. Set it and a client must know the password to join.

Registration is closed out of the box. sf_allowvisitortoregister ships at 0, so only staff can create accounts, and the REGISTER button dims rather than disappearing.

Three cooldowns throttle anybody probing for usernames. Each can be tweaked.

  • sf_registercooldown is 10 minutes between successful registrations.
  • sf_registerfailcooldown is 45 seconds after a failed one.
  • sf_logincooldown is 3 seconds after a failed login.

Additional security options

  • Set sf_unauthcanchat to 0 to stop a player who has not logged in from talking.
  • sf_injectionattempt decides what happens when a command trips the injection guard: 0 logs, 1 kicks, 2 bans. Discord can receive these alerts too.

Ban mechanism

/sfban creates a connection ban from the player's IP address and, where available, GUID.

StoryForce saves its record in <fs_homepath>/<fs_game>/bannedips.cfg, outside the account database.

Disabling an account is a separate action. Kick and ban covers both.