secure your server
A checklist for Minecraft Java server owners who want a private world to stay private. If someone you did not recognise turned up and told you the server was open, this is the page they pointed you at, and it may well have been us.
[fast path]
For a normal private Java server: use paid Minecraft accounts, keep authentication on, enable the whitelist, and add only the players who should be able to join. Two commands, nothing to install, and it locks us out along with everyone else.
- editset the protection keys in server.properties.
- restartreload the server so the properties take effect.
- verifytry joining with an account that is not on the whitelist. It should fail before reaching spawn.
online-mode=true
white-list=true
enforce-whitelist=true
hide-online-players=true
enable-rcon=false# server console
whitelist on
whitelist add YourName
whitelist add FriendName
whitelist list
# in-game as an operator
/whitelist on
/whitelist add YourName[what the visit was]
We scan the public internet for Minecraft Java servers, and when one turns out to let in anyone who knows the address, we try to tell whoever runs it. We were not looking for you in particular: nothing about your server, who runs it or who plays there is why we came to it.
A line in chat only reaches whoever happens to be online at that second, which is often nobody, so there is more than one attempt and it goes further the more there looks to be to lose.
- a botjoins, says the server is open, and leaves. That part is automatic and it is most of what happens.
- a signmay go up where people are active, carrying the same warning, for anyone who was not online to read the chat.
- a messagemay go to whoever runs the server, if it looks like it matters and we can find a way to reach them. We do not set out here how we go about that.
Griefers scan for open servers too, and they reach them the same way we do. We never guess a password or use an exploit, and we never publish the address of any individual server.
[was it us]
The bot joins as LuckySystems, on a server that checks accounts and on one that does not. A member doing this by hand turns up under their own Minecraft name and will say they are from lucky.systems.
On an offline server a name settles nothing anyway: anyone can appear under any name, ours included. The message is the test. If it said the server was open, told you to turn on the whitelist, and pointed you at lucky.systems, it was very likely us.
If whoever turned up said nothing, or said something else, it was probably not us. Someone else found your server and came to look at it. You should worry about that more than about us, and the fix above is the same either way.
We will never ask you for a password, a payment, an account, or operator status, and we will never ask you to install anything. Anyone who does is not us, whatever they call themselves. The only thing we will ever ask you to do is the two vanilla commands above.
To check whether a message came from us, or report one that did not, write to [email protected].
[or tell us to stop]
You do not have to secure anything to be left alone. If you would rather we did not scan your server or contact it again, you can tell us so, and you do not need an account with us to do it. It stops all of the above. It will not protect the server from anyone else.
[what each setting does]
- online-mode=true
- The server checks connecting players against Minecraft account authentication. This is what stops an offline-mode client joining as your username.
- white-list=true
- Only players in whitelist.json can join. Manage it with console commands instead of hand-editing JSON.
- enforce-whitelist=true
- Players who are not on the list are removed when the whitelist is enforced. Use it with white-list=true.
- enable-rcon=false
- RCON is remote control of the server console, protected by one password sat in plain text in server.properties. If you do not use it, turning it off removes a way in entirely.
- hide-online-players=true
- Status pings no longer expose the online player sample. Not access control, but it avoids leaking names to scanners.
[risk checks]
[premium servers]
If every player owns Minecraft Java Edition, leave online-mode=true. Do not turn it off to work around a temporary authentication error.
Keep the operator list small. A whitelist limits who can join, but /op decides who can run dangerous commands.
[offline mode]
A public cracked server is not protected by Minecraft account authentication. A name-based whitelist is not enough: an attacker can try the name of someone already allowed.
If you choose online-mode=false, use a maintained login plugin and restrict access at the network layer where you can.
[proxy checklist]
- proxypublic port open, online mode on.
- backendoffline only because the proxy authenticates.
- firewallbackend ports accept only proxy traffic.
- same hostbind backends to 127.0.0.1.