[GUIDE] Securing a multiple machine server

[Davincibg]

So recently I was looking for a proper guide on how to secure a server from the exploint that had been recently found and released and I've found pretty much nothing. Since I managed to fix it I will release a guide on how to secure a server that can be running not only on 1 but even on n machines.

The exploit:

The exploit is a basic missunderstanding of any of the server exes that can be connected to the DB - including the Certification manager and w/e you created or added to your network. By simple connection to any of them you can manage to get DB access and do whatever you want.
So the problem is the connection that can be created to any of the exes from outside programs.

The fix:

1. Enabling the Firewall.
Any of the machines that has access to the DB should have their Firewall enabled. - This purely blocks any unwanted program from connecting to any of your programs/exes.

2. Blocking the default settings of the executables.
Blockout any of the server exes from accepting outside connection on all of the machines you are using. This will stop ANY connection to them. This way no one even you (for now) will be able to launch anything that connects to them successfuly. (Gatеway Server on hw2,hw3,hwn will not be able to connect to Global Manager on hw1).

This is done from

Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules

There just Delete all of the rules that are for any part of the server executables.

3. Allowing the computers we want to connect.
Now since we blocked all of the connections we should add the computers we want to allow to connect to us.

Again go to

Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules

There you should add a specific rule for each of the exes.

How to:
1. Chose New Rule
2. Chose Program
3. Enter the path to the exe - Global Manager in example -

D:\uberleetsrserver\bin\GlobalManager.exe

4. Chose Allow the connection
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.

Now you have created a rule for one of your exes. This should be done for each and every specific exe that you want to run. Now it's time to add the computers we want to allow to connect to this exe.

How to:
Again go to

Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules

There you should find the rule you have created.
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.

This is a must to to any of the exes running if you want to be able to use them after Step 2.
This should be done on all of the running machines to make sure you have secured any probable hole in the security.

4. Allowing the machines we want to connect to our DB.
You should now allow your other machines to connect to your DB. This is due to that the Game Server for example must have a DB connection.

How to:
1. Chose New Rule
2. Chose Port
3. Enter the port that you want to open - check what's your MSSQL port.
4. Chose Allow the connection
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.

So at the current momment you are allowing any computer to be able to connect to your DB. To create a Scope of computers that should be allowed to do that you should enter them to the Scope tab of the rule.

How to:
Again go to

Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules

There you should find the rule you have created.
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.

Now you should be able to run properly all of your machines with all of their executables, but at that point no one will be able to connect to your server since you have blocked the login and game server ports.

5. Allowing players to connect.
This is done on the same principle as in Step 4, but this time you should enter the ports of your Login and Game Servers and you should not create a scope of computers but just leave the rule allowing any connection to these ports.

If you have done this right your server should be secure enought. At this point no one will be able to connect to anything but the Login and Game Servers.
This guide is a must to for anyone that wants to start a server and haven't done it by himself.

I've posted it here since the Private SRO Exploits/Hacks/Bots/Guides approval takes years -_-

[!x_~!]

thx

[-net--]

What

[Getzabelz]

The is the minimun security system any server should have, but sadly, barely none of them does. Good job tho Davinci .

[PortalDark]

Originally Posted by Getzabelz

The is the minimun security system any server should have, but sadly, barely none of them does. Good job tho Davinci .

at least changing login to other than sa,1234
some got that, even no pws setted

[Davincibg]

If you have understood this guide you won't even need to add a pw to your SQL.

[LastThief]

Originally Posted by PortalDark

at least changing login to other than sa,1234
some got that, even no pws setted

they should get something new like username : sa password a.s



OT:My server is just crashing without reason some gay is logging on the game and he says SERVER WILL CEHCK AFTER 10 SECS and after that 1st gameserver crashes what would be the reason ?

[PortalDark]

Originally Posted by LastThief

they should get something new like username : sa password a.s



OT:My server is just crashing without reason some gay is logging on the game and he says SERVER WILL CEHCK AFTER 10 SECS and after that 1st gameserver crashes what would be the reason ?

one of 2
1. You got a security hole somewhere(SMC, Ports)
2. Someone found a new exploit

[LastThief]

Originally Posted by PortalDark

one of 2
1. You got a security hole somewhere(SMC, Ports)
2. Someone found a new exploit

For the first no
for the second maybe

[Davincibg]

IMO - one of million. While playing with the files I've found so many security holes that you might think someone was programming for free for Joymax.
You can check the log of the exe that's crashing and it will give you the answer.

[PortalDark]

Originally Posted by LastThief

For the first no
for the second maybe

some MMORPGS can get its client hexed to work as a gm(still dont have the methods, but i know 2 mmorpgs right now) and if im not wrong, there is command to shutdown gameserver
if this is possible here, then thats a problem
If ity is a common problem, post this too on RZ
here are lots of ppl that can help, but RZ got also, aside, the more the merrier

[Ehab almsry]

i got problem
when i open SR_ShardManager
it cant read Datebase