Repository navigation
Config set‐ups
require-ownership-of-premium-nickname: unregistered
assume-non-premium-if-auth-failed: false
Note
You can modify the premium-disconnect-invalid-session message in the messages file to show a more meaningful message to your new players, for example:
For this we'll use an importance metric of either: LOW, MEDIUM or HIGH
prevent-first-time-join-during-high-traffic: true
This option is helpful in case of volumetric attacks, by slightly slowing down the attack rate, if anything gets through the primary filters, by exploiting the fact that each IP - name pair connects usually at most once. This is a naive assumption, and works as a slight extra countermeasure against bots that do decide to send their nickname, whilst keeping registered players intact, only once disconnecting new ones.
max-total-accounts: 1
Works best at 3 or below. While this parameter is used for disallowing player alt account register, Alix also uses it as a hint for connection limitations. It is understandable if it needs to be set higher, for example, for servers dealing with NAT/single-ip network congestion userbases.
load-builtin-ips: true
A lot of bad actor ips, free online proxies, compromised servers etc. are part of Open Cyber Threat Intelligence. Loading these in is lightweight (right now about ~0.8MB), and can greatly decrease the load placed on the server in case of an attack.
anti-vpn: true
Whenever an attack comes, it's usually from a proxy. Disallowing all proxy connections is a useful way of dealing with them seamlessly. However, due to certain proxies being widespread, many servers have choosen to disable this option. I'm currently working on solutions that do not rely the setting whether the player has connected from a proxy or not.
validate-name: true
Great for preventing the server from erroring-out on malicious packets.
encrypt-connection: always
Helps prevent Man-In-The-Middle attacks, in case the user is using an unencrypted network. Can be used with safe instead of always in case of any pre-1.20.5 clients disconnecting upon the encryption request packet.
password-hash-type: 6
Uses BCrypt Version 2A for password hashing (prevents password leaks even if the server file/database is seen). Disabled by default due to higher cost.
password-type: anvil
Decent alternative to command. Albeit PIN can also be used, it's not recommended to due much easier cracking options (only 10 000 possible inputs!). That's why PIN is recommended as, at most, a supplementary secondary password of the user.
max-login-attempts: 4
You can sometimes forget your password. Let the user try a bit before they're kicked for too many incorrect password inputs.
auto-login: true
This may be a bit risky in case of single-ip sharing, for example, in residential areas. But, for availability reasons, keeping it as 'true' is fine for the most part.