What an offline mode server risks
- any player can use the admin's nickname, and the server believes them until the auth plugin asks for a password;
- a bot needs no premium account, so a thousand bots cost the attacker the same as one;
- a new nickname after a ban costs nothing;
- nicknames with spaces or look-alike letters from other alphabets pass for someone else's.
An auth plugin is a must
An auth plugin such as AuthMe or nLogin makes players register and type a password on every login. Without one, a cracked server is open to anyone who knows the admin's nickname. Many of these plugins can let premium account owners in without a password, which players like.
Kordon does not replace the auth plugin: it never sees or checks passwords. How to protect the passwords themselves is covered in the guide on password brute force.
What Kordon closes
Kordon checks the connection on the proxy before the player even reaches the auth plugin.
- VPNs, proxies and hosting networks do not get through, so a banned player has a harder time coming back with a new nickname.
- Kordon notices a wave of bots by itself and switches the server to attack mode.
- Nickname rules cut off template bot nicknames and nicknames with Cyrillic letters or spaces. The "Like nLogin / AuthMe" pattern matches those plugins' own rules, so a player will not get stuck at registration because of an unsuitable nickname. Keep in mind that this pattern keeps out Bedrock players from Floodgate, whose nicknames start with a dot.
- The blacklist takes a nickname, an address or a range. A cracked player's UUID is derived from the nickname with its exact letter case, so a UUID ban is dodged by joining as
steveinstead ofSteve. Kordon compares nicknames without regard to case, so on a cracked server a nickname ban is the safer choice.
Careful with the whitelist
Kordon's whitelist lets a player in without the VPN check. On an online mode server Mojang confirms the nickname. On a cracked one anyone can use it, and a whitelist entry by nickname lets in, unchecked, whoever joins with that name.
So on a cracked server it is better to whitelist staff by IP address. If someone's address changes and they do not use a VPN, you may not need to whitelist them at all: an ordinary home address passes the check anyway.
Nicknames with spaces and look-alike letters
In offline mode Velocity accepts nicknames made of almost any characters, up to 16 long. To the server, Steve and Steve with a trailing space are different accounts, yet in chat and the tab list they look the same. The same goes for Cyrillic "а", "е" and "о" in place of the Latin letters.
The "Like Paper" rule, which is on by default, lets in only Latin letters, digits, _ and the dot, so such nicknames do not pass. Do not turn it off. More in the guide on the nickname filter.
What to do, in order
- Install an auth plugin and set a minimum password length.
- Install Kordon on the proxy and watch it in observe mode for a day or two.
- Keep the "Like Paper" nickname rule, or pick "Like nLogin / AuthMe" if you have no Bedrock players.
- Turn protection on at the "Balanced" level.
- Whitelist staff by IP, not by nickname.
- Ban rule breakers by nickname: with VPNs closed they cannot come back quickly.