If I run a server with offline-mode=false, hide-online-players=true and white-list=true, how easy would it be for an attacker to find out which names are whitelisted to join with a whitelisted name? Is it brute-force hard or does the server leak that info somewhere? How to secure an offline mode server against this?
3 Comments
narc0tic_bird@lemm.ee · 13 pts · 1y
I’d recommend a separate authentication plugin independent of Mojang accounts. For example this one (didn’t test it myself).
Interstellar_1@lemmy.blahaj.zone · 2 pts · 1y
Yes this is necessary for offline mode security. Most attacks come from the attacker joining as the operator and doing whatever, and a auth plugin can stop that. Additionally, make sure that you have a backup system set up, and confirm that the backups work.
lena@gregtech.eu · 2 pts · 333d
I used to have the same setup, then someone joined the server using my brother's username and proceeded to grief spawn. Definitely use a separate auth plugin