Server protection

[VortDyn]

I want to know the ways by which you can protect the server from file theft / hacking, cheating and other unpleasant ..

Edited October 25, 2020 by VortDyn

[Gordon_G]

Cheating - if you mean like giving weapons and so on like on other multiplayer mods, it's almost impossible (or well, i dont know how). The only cheat I've already seen is possible walking through walls by removing their collision on their game's files but you can easily counter it by restricting allowed mods in server.conf

 

Theft - This might be the hardest part but here are some sulutions provided by @Dutchman101 

 Some others here : 

 Hacking - I guess you might talk about a client injecting stuff in their client-side part. The best way to counter this is by ALWAYS verifying server-side when a player request an action, especially when it's an admin action of your gamemode (i don't know, like adding something to you database by a client-side GUI, you would verify server-side if the player is really an administrator) 

 

EDIT : About the last part, you should also not use synced elementData. You may know that it's a waste of performance but it also has security issues (because you can read-write it from client so a malicious client could put anything in that elementData)

Edited October 25, 2020 by Gordon_G

[Tut]

Thread has been moved to a better suited forum for best results.

 

4 hours ago, Gordon_G said:

The only cheat I've already seen is possible walking through walls by removing their collision on their game's files but you can easily counter it by restricting allowed mods in server.conf

Allowing custom gta3.img does block custom collisions of world objects. I'm not sure which configuration allows custom collisions?

[Dutchman101]

Read these pages for some information:

https://wiki.multitheftauto.com/wiki/Anti-cheat_guide

https://wiki.multitheftauto.com/wiki/Script_security

Now, all you need to do is:

- Ensure a good enough script security in your gamemode (and also think about stuff againt abuse or DoS attacks: anti-spam in your commands and buttons, etcetera)

- Always keep minclientversion in mtaserver.conf to the latest supported version (as visible at https://nightly.multitheftauto.com/ver/), preferably by enabling minclientversion_auto_update

If you do these basic things, then MTA anti-cheat (which is very strong) will do the rest. Then when a day comes that it can't, which is very unlikely, but yeah nothing is impossible in tech - then you'll still have script security, for instance to not let anyone with an working Lua injector (even though, again, very unlikely due to the strength of AC) deal any damage to your server.

You should be able to think about more things to keep abuse out of your server, such as choosing a good, DDoS-protected server host. Besides, there are many topics on the forums where all sorts of methods to protect (to a certain degree) your resources and materials against theft are being discussed

[Gordon_G]

6 hours ago, Tut said:

Thread has been moved to a better suited forum for best results.

 

Allowing custom gta3.img does block custom collisions of world objects. I'm not sure which configuration allows custom collisions?

I don't know wich setting allowed that, I wasn't the server owner and it's been a long time since then (it in 2016 or earlier so I don't remember pricesely to be honest ^^' )

[ds1-e]

Don't use fileDelete for client-side scripts, i consider cache="false" in meta.xml more reliable for that.