A release is configured for a server on your own machine. Four things change when it becomes reachable from the internet.
Change These
| What | Why |
|---|---|
| The seeded admin password | Every release ships the same one. It is the first thing anybody tries. |
settings.cfg file permissions | It holds database credentials in plain text. chmod 600. |
| The database password | The default is in a file thousands of people have downloaded. |
| The bind address | Bind the web server to the internet; keep the database on localhost. |
The seeded admin is [email protected]. Sign in, change the password, then make your own account and remove it.
Do Not Expose the Database
MySQL on 0.0.0.0 is the single most common way one of these servers is taken over. Keep it on 127.0.0.1 and let the game server reach it locally. Nothing else needs to.
Ports
| Port | Open to |
|---|---|
| Game port | The internet. Players connect here. |
| Web server | The internet, if you run one. |
| Database | Nothing. Localhost only. |
| Loopback stats port | Nothing. Localhost only. |
What Not to Bother With
Hiding the server version. It tells an attacker nothing they cannot get by connecting, and it stops your players telling you what they are running when something breaks.
Blocking the client's own traffic patterns. The protocol is public. Effort spent here is effort not spent on the two rows above.
Updates
Watch the game's page or subscribe to its release feed at /changelog/<family>/<game>/feed.xml. Security fixes are noted in the changelog for the version that carries them.