06.02.2014, 07:50
If someone tries to hack your Rcon password by spamming your server with login attempts and using brute-force, why unban them at all?
They probably have a script running to try to hack your password.
If you ban them upon the third attempt, their script would not be able to login for 30 seconds.
When they get unbanned again 30 seconds later, they'll just get banned again after 3 attempts because they won't stop.
Their script might have some built-in security to catch if they got a connection for every attempt.
If they got banned and then unbanned, they might start over where they left off, and finally, after a few thousand bans/unbans, they'll still hack your rcon password, allowing them to login properly with the hacked password and mess up your server (they could ban all players using rcon).
They could even have such code in their script/program to ban all players which are logged in.
Or send a "rcon exit" command to your server every 5 seconds, to shutdown your server every time you start it up again.
Hackers should get permanent bans. Period.
Unbanning them after 30 seconds is the same as saying: "you can now continue your hacking attempts".
Rcon brute-force hacking is only used to get your rcon password, nothing more.
Once they have it, be ready for some unusual stuff to happen like described above.
Using the 30-second delay between every 3 attempts will only take them longer to find the password, but they'll get it eventually.
Your log will be spammed as before, it only takes longer to fill up as fast.
Any regular player on your server wouldn't do this, so they won't be affected.
They probably have a script running to try to hack your password.
If you ban them upon the third attempt, their script would not be able to login for 30 seconds.
When they get unbanned again 30 seconds later, they'll just get banned again after 3 attempts because they won't stop.
Their script might have some built-in security to catch if they got a connection for every attempt.
If they got banned and then unbanned, they might start over where they left off, and finally, after a few thousand bans/unbans, they'll still hack your rcon password, allowing them to login properly with the hacked password and mess up your server (they could ban all players using rcon).
They could even have such code in their script/program to ban all players which are logged in.
Or send a "rcon exit" command to your server every 5 seconds, to shutdown your server every time you start it up again.
Hackers should get permanent bans. Period.
Unbanning them after 30 seconds is the same as saying: "you can now continue your hacking attempts".
Rcon brute-force hacking is only used to get your rcon password, nothing more.
Once they have it, be ready for some unusual stuff to happen like described above.
Using the 30-second delay between every 3 attempts will only take them longer to find the password, but they'll get it eventually.
Your log will be spammed as before, it only takes longer to fill up as fast.
Any regular player on your server wouldn't do this, so they won't be affected.