Server crashing

[Rexonius]

Lately, we've had a slight problem on our Japlus enhanced server. It seems we have certain visitors with the power to crash our server. A friend and I haven't come up with any solution yet, and I have now solely come to this forum to seek for an answer to this problem. The server-logs doesn't show any IP-address of this visitor, and we can't keep this visitor from ruining the game-play of others, so I would highly appreciate an answer or solution to this in a matter of time.

I'll do my best to provide further information if thus is required.

[Gamall]

Hello and welcome,

First off, let me state that I have been retired from JKA for about 2 years, I think. Therefore I might be quite behind the times as far as exploits are concerned.


This being said, one very obvious question: is your (linux?)jampded server patched against q3infoboom ?

Another obvious question: are you certain your RCon pass (and others JA+ specific passwords) has not been leaked ? (a very common cause of problems, often overlooked)

edit: to help with the last point, the server can be set to "debug mode"; it will then log RCon requests. I've forgotten the exact command to do that, though, I'll look it up when I get back home.

[Rexonius]

Thank you, I'm glad I could register and get such a quick response.
It was silly of me to come with such request without being the owner of the server, but I'll forward this to the owner and see if he'll find this useful.
I can tell just now that we're not certain if rcon-pass has leaked yet, but I'm sure he/we'll try changing it first of all.

I yet again appreciate this quick response, for now I can only hope I can get these suggestions forwarded to the owner.
Thanks again.


edit: What does this q3infoboom do to the server, I'd appreciate if you could explain this.

[Gamall]

Ok,

BTW, I think the command for debug mode is set developer 1. Many more events are logged than with the default settings. Of course this should go either in serv.cfg or in the command line (prefixed by a +).

[Rexonius]

I've forwarded this to the owner, and he's certain the server already is set on debugmode.

PS: I just received the word of q3infoboom actually being the cause of our problem. It's just speculations, but we'll hope that this will solve the problem.

Thanks a lot for your support and admirably quick response.

Edit: Do you know which patch we will have to download in order to fix this problem?

SECOND EDIT: I can only assume right now the owner has managed to fix the problem and is now in full control of the server again. I thank you on the behalf of the two of us and the entire clan of {SITH}.

[Gamall]

You're welcome.

Good luck with your clan --- quite an old one I think, unless there are several {SITH}. Count yourself very lucky if it really was the first time you are victim of this exploit.

(note: I shall move this topic to the JKA section)

[Rexonius]

I believe and hope it's the old {SITH} you're thinking of, if so then you are correct. We've existed for many years, since JK2 I believe, I've only served in it for over 4-5 years now I think. Maybe less. Can't remember. Lol.

I guess I could consider myself lucky. Thanks yet again.

And oh, interesting phrase you got there. Actually taught me something.

[Rexonius]

Hello there, I'm back yet again with another request regarding the server.

The owner and I are a bit childish and have only decided to patch the server against q3infoboom once the culprit shows up on the server and wants to make his move and we can sit there and shout out a minor "lol"
at him.

What I'm still having a tough time figuring out, is how the culprit continuously always get back on the server even if we choose to ban him from it, how can this be?

Once again, I appreciate the time you're willing to spend to answer my questions, so a lot of thanks in advance and thanks for your services thus far.

[Gamall]

Hello again,

Banning is not effective at all in JKA. Banning someone supposes you can identify them, and trouble is, you can't. Player name is meaningless of course.

When you ban someone, you are really blacklisting their IP (Internet Protocol) address. Something tricky about those addresses is that:

• most people now have dynamic IP addresses. That is to say, each time they connect, their Internet Provider uses a different IP address for them. This does not seem to be the case for you, though, you have today the same IP address than you had the first time you posted here, so this means that either you have a static IP or you have never rebooted your router. Or you are connected from a fixed network, at work for instance. Which brings to the second point.
• By the first point, a person can have several IP addresses. The converse is true: one IP can designate several person.
  • Internet Providers reuse the dynamic addresses of course: the address you banned yesterday may well belong to someone else now. Let's hope they don't play JKA and won't try to connect, else they will wonder why they are banned...
  • You can be part of a network with one single entry point: for instance all computers in university share the same address: that of the router. In fact, if you have a broadband connection you are behind a modem-router, and your IP is that of that router, not of your computer. Say you have a brother who plays JKA and connects through this same connection, he will have the same IP: if he is banned, so are you.

So banning through IP addresses is

• Inefficient because IP addresses are easily changed by the culprit; they just have to reconnect.
• Inappropriate because you end up banning random people.

In JKA you can ban whole subnets by using wildcards, which may help you keep the bad guys out of your hair, but is sure to ban hundreds or thousands of innocent people (probably the ones who use the same Internet Provider). So I strongly advise against attempting to use that, even if it looks efficient.

Since there is no such thing as a licence key in JKA, or anything else uniquely identifying a player, and IPs are next to useless in that matter, there is no way to efficiently ban anyone.

To dissuade them, I recommend kicking them repeatedly and otherwise ignoring them. It takes them 10 times as much time to reconnect as it takes you to kick them. Binds may help if they have distinctive names --- which is rare.

When I was playing, I had also made a small script to lessen timeout cvar for one second: running it while unwanted guests were connecting would prevent them from entering the server at all... and they would think it a bug. The problem with that trick is that if anyone else is connecting at the same time, they will be flushed out too.

[Rexonius]

I apologize for responding slowly, sometimes I forget my manners, I'm just late at posting to say; thanks. Yet again you respond within a brief period of time and come with useful solutions and constructive suggestions.

I already knew about my static IP address, but I didn't know the true meaning of static or the differences between dynamic and static IP addresses. So big thanks on handing that information to me.
Secondly, helpful tips as always and I appreciate your efforts in how you choose to list up things and organize your information, pedagogical indeed and easy to understand.