How passwords get guessed
A bot joins under someone else's nickname and types /login with passwords from a list: the most popular passwords, variations of the nickname, passwords from leaked databases of other servers. Many players use one password everywhere, so a password leaked from one server often works on another.
The auth plugin bans an address after a few failures. To get around that, the attacker sends each attempt from a new address on a proxy list.
Configure your auth plugin
The auth plugin does most of the work. In AuthMe, nLogin and similar plugins, look for these settings:
- a limit on failed attempts and a kick after a wrong password;
- a temporary address ban after several failures in a row;
- a login time limit: whoever has not typed the password within a minute is kicked;
- a minimum password length and a ban on the simplest passwords;
- auto-login for premium account owners, so they need no password at all;
- two-factor login through an authenticator app, if the plugin supports it.
Protect your staff
An admin account is worth the most, so it is the first target. Staff passwords should be long and not used anywhere else. If the plugin supports two-factor login, turn it on at least for staff.
Now and then, check where staff accounts join from. A login from a new country or an unfamiliar provider is worth a closer look.
Close the proxies
A per-address attempt limit only works while the attacker has few addresses. Kordon checks the connection on the proxy, before the auth plugin. VPNs, open proxies and hosting networks do not get through, and on "Strict" protection (from the Premium plan) neither do residential proxies. The attacker is left with fewer addresses, and guessing gets much slower.
Kordon does not see which password a player types and does not count failed logins. That is the auth plugin's job; Kordon only leaves the attacker fewer addresses to use.
Signs of brute force
The auth plugin's logs show many wrong passwords for one nickname. The Kordon login log (from the Basic plan) shows many short logins under that nickname from different addresses and countries.
If an account has already been taken over
- Change the account's password with the auth plugin's admin command and kick the account from the server.
- Check the action logs (CoreProtect, for example) to see what was done in the player's name.
- Blacklist the addresses the intruder joined from, with a duration (from the Pro plan).
- Ask the player to change this password everywhere they used it.