From a player security standpoint, there's not much I can deduce. It appears to be dependent on the base service they're using for their service portal, which wouldn't be bad on password security - but I'm ultimately not sure. Owner says they're hashed, and I'd believe that. Note of advise for the owner, update your Ubuntu Apache version (you are currently on version 2.4.29). There are a few

and vulnerabilities. Weird that your Windows Apache server is on version 2.4.35 / PHP 7.2.11 (XAMPP 7.2.11). Why not have one Apache server? It looks like you're not even using it. Did you install it just for MariaDB? Also, you should probably disable showing

. Just knowing that CGI is enabled puts you in a bad place for attacks. Plus, seeing all your environment variables is also pretty bad. Your MariaDB server is also exposed to the internet, which is bad practice. You have a few other services exposed, including remote execution ports for Windows (445). You can probably disable port 8081 as well. Also, your account server is hilarious to send false requests to. It actually responds, unlike your game server. Separate socket implementations?