Looking for assistance with R1Q2 anticheat on server

[NullNotZero]

A couple of weeks ago I decided to start up a new Q2 server using r1q2. I compiled the source into a new 64bit binary on my Ubuntu 18.04 server, set up everything and started up the server. It's been working fine but I wanted to move it off of my test server onto my production server, so I copied the directory structure to the production box (identical hardware and OS) set up permissions etc. and started up the server, but I noticed a new console message when starting the server relating to anticheat:

ANTICHEAT WARNING: Missing anticheat-hashes.txt, not using any file checks.
ANTICHEAT WARNING: Missing anticheat-cvars.txt, not using any cvar checks.

I don't recall seeing this when I started it up last week on my original server so I started up the old one and it is also getting the same message.
I'm pretty sure I wasn't seeing this when I first built the server so I don't know why all of a sudden it's happening. Honestly I've never really configured anticheat since it just seemed to work in the past and I have never seen messages like this before. Kind of out of ideas, anybody have any suggestions?

[QwazyWabbit]

When setting anticheat there are different modes it can be in.
You, as server admin are responsible for setting the AC policy.

set sv_anticheat_required "1"
// Require use of the r1ch.net anticheat module by players. Default 0.
// 0: Don't require any anticheat module.
// 1: Optionally use the anticheat module. Other clients can still play.
// 2: Enforce the anticheat module. Only valid R1Q2, EGL, Q2PRO or AprQ2 users can play.

If setting AC, mode 1 is recommended for the widest number of users. If there is a question whether a player is cheating, you can force anticheat on players individually.

The files
anticheat-hashes.txt
anticheat-cvars.txt
anticheat-tokens.txt
are required when anticheat is enabled.

The hashes file contains the hashes and filenames of permitted or disallowed models and players and weapons. It's the server admins job of creating them.
The purpose is to prevent players from using spiked models or weapon models. You can specify both allowed and disallowed models.

The cvar file specifies limits on client cvars like cl_maxfps, cl_nodelta, rate, timescale, and whether to enforce download options.

I'm not sure what the tokens file was for.

Access to the admins forum where these files were maintained was restricted. R1ch has since abandoned the r1q2 project and the r1ch.net forums.
I don't know where you can find more documentation on the files and their formats or where a valid hash file can be obtained.

QW

[NullNotZero]

Appreciate the info. I did some digging and finally did find R1ch's original documentation on the Wayback machine, so I at least have a much better understanding of configuring anticheat. Looks like I will have to create my own hash files however if I want to use them as I am not able to locate a source for those.

Just seems funny to me that I do not recall seeing those messages on my server before. It could be that I was just braindead and didn't notice them. Anyway problem understood, if not solved.

[QwazyWabbit]

Good. I'm glad you found some documentation. When you get done configuring AC for your server you can explain it to me. I've never fully configured one myself. I believe the hashes are md5 hashes. That by itself might be a problem for AC these days since MD5 is vulnerable to hash collisions (non-identical files generating the same hash). I don't know if it's possible to design a spiked skin that would pass AC validation and still be usable in the game as a valid skin. SHA256 is preferred for code signing and SSL certificates now. The key to AC is the anticheat.dll and that source has never been public. The server requests a hash of a file on the client and the client computes the hash and reports it, they must match your whitelist or it's a bad skin. I do believe anticheat.dll has references to SHA256 so you might look into that.

[NullNotZero]

After poring over the documentation I found I have decided not use hash files for now. It's going to take some time for me to properly set that up, unless some admin has good hash files they are willing to share. Unfortunately time is something I have little of these days and I don't want setting up anticheat to delay getting my server online since it's only really for fun anyway. I will probably still work on getting it set up on my test box if I have spare time just to get familiar with it. If you are curious about how to set up anticheat I have attached the docs I found on it to this post. It's really just everything I could scrape from the old r1ch.net forums. I hope R1ch won't mind me posting it here.

If you do decide to work on anticheat I would love to hear your thoughts.