starred/LinuxGSM

Fork 0

mirror of https://github.com/GameServerManagers/LinuxGSM.git synced 2026-04-25 14:15:59 +03:00

[GH-ISSUE #469] Rcon password safety #389

New issue

Closed

opened 2026-02-27 02:01:12 +03:00 by kerem · 6 comments

kerem commented

2026-02-27 02:01:12 +03:00

Owner

Originally created by @andreblue on GitHub (Aug 7, 2015).
Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/469

So i know on garrys mod there is a way to be able to download server files such as the cfg files, which is where you have the current rcon password saved at. If you can, please change it to be set on the command line to help protect it a bit more.
For most source servers it is
"+rcon_password "

Originally created by @andreblue on GitHub (Aug 7, 2015). Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/469 So i know on garrys mod there is a way to be able to download server files such as the cfg files, which is where you have the current rcon password saved at. If you can, please change it to be set on the command line to help protect it a bit more. For most source servers it is "+rcon_password <password>"

kerem

2026-02-27 02:01:12 +03:00

closed this issue
added the
type: feature
label

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Aug 7, 2015):

I would be interested in havig an article regarding this or anything related to source server security as I always find it hard to get good info on source servers. There is already a security 'feature' in place that was requested. That the configuration is not located in in server.cfg bur a different file.

It is up to the admin to decide how to secure there server but I woudl very much like to see good articles on this.

@dgibbs64 commented on GitHub (Aug 7, 2015): I would be interested in havig an article regarding this or anything related to source server security as I always find it hard to get good info on source servers. There is already a security 'feature' in place that was requested. That the configuration is not located in in server.cfg bur a different file. It is up to the admin to decide how to secure there server but I woudl very much like to see good articles on this.

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@andreblue commented on GitHub (Aug 7, 2015):

http://andreblue.com/sharex/uploaded/2015-08-07_18:32:30.png
That is a picture of a forum post that distrubites a DLL that you can inject into gmod for exemple. It then allows you to request files from the server so long you know the name. Things such as the cfgs, the logs from ulx and much more. If you want i can send you a copy of the dll if you wish.
https://www.youtube.com/watch?v=TbC_tHaHHZA is a youtube video of it happening.

@andreblue commented on GitHub (Aug 7, 2015): http://andreblue.com/sharex/uploaded/2015-08-07_18:32:30.png That is a picture of a forum post that distrubites a DLL that you can inject into gmod for exemple. It then allows you to request files from the server so long you know the name. Things such as the cfgs, the logs from ulx and much more. If you want i can send you a copy of the dll if you wish. https://www.youtube.com/watch?v=TbC_tHaHHZA is a youtube video of it happening.

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@Scarsz commented on GitHub (Aug 8, 2015):

This was en exploit that was patched months ago, iirc. I don't see the point of implementing any changes for this.

@Scarsz commented on GitHub (Aug 8, 2015): This was en exploit that was patched months ago, iirc. I don't see the point of implementing any changes for this.

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@andreblue commented on GitHub (Aug 8, 2015):

Some servers can still be affected by it.

@andreblue commented on GitHub (Aug 8, 2015): Some servers can still be affected by it.

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@Scarsz commented on GitHub (Aug 8, 2015):

I don't see how some servers would be affected by this. All servers set up with LGSM are the latest versions of the server, as required by the Garry's Mod client, where this exploit isn't possible. The only thing I can see being a vulnerability is if the server admin themselves when setting up FastDL add the garrysmod/cfg folder for some reason, which is a fault on them for not knowing how to properly set up FastDL; not a flaw with how the script configures the server.

@Scarsz commented on GitHub (Aug 8, 2015): I don't see how some servers would be affected by this. All servers set up with LGSM are the latest versions of the server, as required by the Garry's Mod client, where this exploit isn't possible. The only thing I can see being a vulnerability is if the server admin themselves when setting up FastDL add the garrysmod/cfg folder for some reason, which is a fault on them for not knowing how to properly set up FastDL; not a flaw with how the script configures the server.

kerem commented

2026-02-27 02:01:13 +03:00

Author

Owner

@lock[bot] commented on GitHub (Jul 19, 2018):

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@lock[bot] commented on GitHub (Jul 19, 2018): This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.