Security Breach at Tasty?

[IrOn448]

Hi Console, I have been seeing a lot of this in the logs?

[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:60704[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:60954[WallFly[BZZZ]]: kick 3
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:49722[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:52491[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:46169[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:53570[WallFly[BZZZ]]: status

Why kick 3, does somebody have my rcon password? just wanted to pass this along.
Do  I need to change my rcon password. Please let me know what to do?

[X7]

Hi Console, I have been seeing a lot of this in the logs?

[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:60704[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:60954[WallFly[BZZZ]]: kick 3
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:49722[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:52491[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:46169[WallFly[BZZZ]]: status
[2010-01-09 18:33] Rcon from 74.52.xxx.xxx:53570[WallFly[BZZZ]]: status

Why kick 3, does somebody have my rcon password? just wanted to pass this along.
Do  I need to change my rcon password. Please let me know what to do?

one of the TS admins, did a status
then kick player 3



X7

[console]

one of the TS admins, did a status
then kick player 3

Not quite.  It was an auto-kick by wallfly, based on the active banlist.

  20:14:33 CONNECT:     [3]  "Buckwheat"
  20:14:33 wallfly: enforce_bans: name(Buckwheat) clnum(3) ip(24.21.xxx.xxx)
  20:14:33 wallfly: rcon kick 3
  Dropping Buckwheat, console kick issued.

Buckwheat contacted me yesterday, and I've already added an exception for him so he can bypass the subnet ban.


Note: Assuming the server IrOn448 is referring to is KILLERPINGS, the ts admins don't have access to that rcon password at all.

But wallfly does use the global banlist by default.


Regards,

quadz

[yahoo]

I was wondering , (global banlist) does it mean that the ban applies on all servers seen at goto?

[console]

I was wondering , (global banlist) does it mean that the ban applies on all servers seen at goto?

Sort of.

The AIR* and TG* servers in UK and Italy are each on their own WallFly network, and have their own separate ban lists for their networks.

Most of the INDEPENDENT ZONE servers do share tastyspleen's ban list.  A few don't.  It's not mandatory for independent servers to share the ts ban list, BUT if a server participates in the invite! system, the only way I currently have to prevent someone from abusing invite! is to ban or mute them.

Some jerk from socal.res.rr.com was abusing invite! on KILLERPINGS and WHALE last week.  They were spoofing DonKeyballs-CRU's name and using both WHALE and KILLERPINGS to spam obnoxious invite messages.  So I added a mute for this player on all servers which participate in the invite! system.


Regards,

quadz

[yahoo]

The AIR* and TG* servers in UK and Italy are each on their own WallFly network, and have their own separate ban lists for their networks.

Most of the INDEPENDENT ZONE servers do share tastyspleen's ban list.  A few don't.  It's not mandatory for independent servers to share the ts ban list, BUT if a server participates in the invite! system, the only way I currently have to prevent someone from abusing invite! is to ban or mute them.

Ahh.. so maybe thats why when i was on an AIR server, i used goto and there were some servers that showed empty even if there were players

Some jerk from socal.res.rr.com was abusing invite! on KILLERPINGS and WHALE last week.  They were spoofing DonKeyballs-CRU's name and using both WHALE and KILLERPINGS to spam obnoxious invite messages.  So I added a mute for this player on all servers which participate in the invite! system.


Regards,

quadz

I think I saw that.. Thanks.