Re-doing server what do I need?

So had a server running 7 months or so, players have come and gone, its quite disappointing but ignore that for now.

The server has 50 plugins but we want to re-do it all from scratch and remove what isn't needed.

Do you recommend Essentials? it will cut down on many plugins.

Must have
worldguard/world edit
World border
Nocheatplus for nodus users
HeroChat
PEX
Scheduled Announcer

Admin Tools
VanishNopacket
Hawkeye for Grief

Player tools
BoseEconomy
ChestShop
Lockette
AlphaChest
ExtraFlight
CraftBook ?

Player based protection?
TownyAdvanced or Factions or Precious Stones?

 

Do this plugins:
Factions
Nocheatplus
Essentials
world guard
world edit
Announcer
And instead of hawkeye use coreprotect also if your server lags due to chunks get
World Boarder

 

Factions is very easy to use, however if you want a more advanced server, use TownyAdvanced. Those plugins you are using look spectacular! A recommendation I have to add to your list is MobArena. It adds a little more fun to the game.

I hope this helped,

Symbiosis

 

Factions is for more PvP Server while Towny is for Survival based towns servers

 

asofold doesn't like Essentials but I use it on every server I make ;P So I would recommend you using Essentials because you can be sure that it always will get updated on time.

Essentials - AdminCommands, motd, help, Home, rules, Economy and all that basic stuff everyone needs
EssentialsSpawn - for /setspawn and /spawn
WorldBorder - To limit your world
HeroChat or EssentialsChat - If you need more advanced chat system (channels and such) then use HeroChat. If not EssentialsChat should be fine
NoCheatPlus - Not only for Nodus
PermissionsEx - Also recommend to use that (it has some nice things like Low-level caching and such)
Scheduled Announcer - Doesn't matter which one you use, they are all quite simple made and easy to change.
LogBlock (MySQL) - I would recommend that more then HawkEye because it gets at least some updates
VanishNoPacket - Not needed if you use Essentials (or if you want more advanced vanishing)
BOSEconomy - Essentials replaces that
ChestShop - Ok to use. Why not?

 

I would recommend CoreProtect over LogBlock

 

yeah i like coreportect also more since it also has worldedit logging

 

Use swatchdog, it's a lot lighter protect plugin. Also use anticheat instead of nocheatplus, because you can still bypass nocheatplus if you know how.

 

And AntiCheat you cant "bypass"? The checks of NC+, AntiCheat or any other anticheat plugin will never be 100% water proof, hackers always find a way to fake packets and make illegal movements without NC+/AC/... noticing.

I see looks quite interesting I will have a look at it soon.

 

The reason I like Hawkeye is that it hasn't broke down on me.... yet,
but we use the Web interface that it has, if that didn't work then I would use what you guys suggested.

1 last question, what warp plugin do you recommend me? I would like to have [Sign] warps also if possible but not 100% needed

 

Yes, that is true, but anticheat does a better job at it atm.

 

Anticheat has many false predictions but you are right it is currently much harder to bypass, I have seen people using smart move to bypass NCP

 

What does AntiCheat have that we are missing?

I actually didn't want to respond to this but if you guys really think that AntiCheat is more secure then NoCheat+ then you are thinking completely wrong
Nodus just shows a small part of whats possible with hacking/griefing in Minecraft.
There are client out there that use really mean ways of confusing AC and NC+.

Here some examples why those checks exist in NC+:
Passable - Some guys found a exploit in Minecraft which allows to go thought blocks (noClip). After asofold saw this issue he imminently started coding a check to prevent this and Passable was born. Of course we had some problems with this check at the beginning but it was worth it, noClip is a critical hack if you ask me. (AntiCheat is missing this)

BedLeave - Hackers found a way to exploit BedLeave packets and confuse NC+/AC with those, so they can fly around on the server (slow speed). After that we added a check in SurvivalFly to block this exploit from happening. With the current NC+ we expanded this check to protect the server even better. (AntiCheat is missing this)

NoFall - We also used to check NoFall on a similar way that AntiCheat does now but this way can be completely bypassed so we needed something better then this method. Now the NoFall check from NC+ will make sure that the players get the damage they are supposed to get. (idea from xDrapor)

FastClick - Its such a small check but yet extremely powerful, it prevents players from moving items too fast around in there inventory. There are much hacks around in the internet that get detected by this (Auto crafting, chest sealer, auto stacking, ...). (AntiCheat has this also in the latest dev build now:
https://github.com/h31ix/AntiCheat/commit/418615160940ff84ef403f66ca5cea1bddfa0810
But what happens if the player fails the check once? If I read this correctly: Only the first hack try will be canceled but the other ones followed by this attempt wont be blocked/canceled anymore. Correct me if I'm wrong.)


MorePackets - This is one of the more simple checks that NC+ has, it prevents players from sending too much moving packets to the server. This prevents faster movement but also protects the server from getting overloaded with moving packets. (AntiCheat is missing this)

Yawrate - This is one of the best ideas that asofold had. This check prevents the clients from turning around too fast (killaura), at the beginning it was a forcefield/killaura killer but now the hackers adjusted their clients to simulate a "default player" so they don't get detected (Nodus did this also).

Accumulated Checks - In NoCheat+ we use accumulation to make some checks more effective and less effected by lag. Fastbreak is one of those checks that is completely accumulated, means its less lag affected (false positives) but also stronger against fastbreak hacks.

Nuker checks:
WrongBlock - Frequency - Fastbreak. Just try out the Nodus survival nuker with NC+ and AntiCheat and watch the difference.

There is still more...

We and @H31IX aren't in a "fight" or whatever you are thinking now. I just compared AC and NC+ (current state) here to show some differences on how they are.
We also sniff around the internet (some dark places...) to find new exploits that could be possible with NC+ so we can fix them .

Of course h31ix could add/fix/improve those checks anytime but at the current state its like this I explained up here.
tanveergt5 those "smart movements" will also work on AC . I can tell you that.

I still try to figure out how @asofolds and @NeatMonsters code work So feel free to correct me if I said something wrong.

 

If you want to build a client that can find and take advantage of loopholes in AntiCheat, you will do so. If you want to do the same for NoCheatPlus, you will code it in a different way to accomplish the same task. All we can do is play catch up and try and patch what people have discovered. There's zero sense in trying to argue anything but that, including listing features or talking about the pros/cons of either plugin. Choose the one you like the best and use it.

 

Sorry to say, but you really do need to visit a exploit forum, such as the Hackforums. AntiCheat is way behind interms of bypasses and the "catchup game". Hopefully this will change soon.

 

My question: Why has Mojang not put in a better built-in anti-cheat yet?

 

NoCheat was created August 11th, 2011
AntiCheat was created April 15th, 2012

Things get ironed out with time, but I don't spend my life on the internet because I won't. If there's a problem, you can report it but most people don't, so I just do what I can do because I enjoy doing so. I don't believe I've ever spoken to you before, so unless you've just been sitting on HF gloating about how much better NCP is than AC instead of trying to solve a problem, I can't expect you to do anything more than that now.

Not in Mojangs interest, I would say. I don't blame them, I probably wouldn't bother either, in their situation.

 

Actually, we have spoken, and I did report a bug along time ago, so you're argument of "instead of trying to solve a problem" is invalid:


In addition, you cannot assume that I've been "gloating" about anything. I've been working with the actual client source in order to make an anticheat plugin of my own. Also, I did mention at one point that AntiCheat was better than NoCheatPlus, until which asofold picked up the project, and the team took the initiative to track down exploits from the HackForums, and find testers. The hackforums community actually was enthusiastic about helping the team, I for one was, and helped patch and better the plugin. A good example of this is the fact that, once I found a nofall bypass, I helped patch it, and once I found a crash exploit, I helped patch it.

 

Well what are you doing then, man? I mean, you know that AntiCheat is new to the game, you know I've got much more to do around here than just AntiCheat, you as a developer should know the kind of struggles that come with this stuff and not act like AntiCheat is bad because I don't look at HF in my spare time. I'm one guy, and I'm one year late. I'm not trying to excuse myself on that, because your comments ARE valid to a certain extent, but it's odd to see that sort of comment out of a developer like yourself.

 

I never said AntiCheat was bad, it can protect a server against casual hackers. However, all I was pointing out is that abit more research into how the actual hacks work / getting more testers will make your development phase alot more efficient, and easier. I know exactly how hard it is to make an anticheat plugin, I haven't released anything yet because I scrapped my alpha code and started a rewrite. I understand how false positives are a pain, and they can hamper normal gameplay. But pinpointing the exact workings of an exploit gives greater accuracy to the check

 

Fair enough, actually. TnT has gone above and beyond what is necessary to assist with testing and the documentation of their outcomes. I'm trying to use the results of all that to help with development, but sometimes it just doesn't work out because of time, family, or other factors. That's my fault alone.

 

Depends. Some hacks work on AC and on NC+, some other only work on AC and again other only work on NC+ but most of them should work/worked on both I guess (xDrapors water thingy x.X). Playing cat and mouse is the only way to find new "hacks" and patch them before they get distributed to everyone else on the internet.
Those points there aren't just arguments. I just wanted to show @tanveergt5 and @nhadobas that AntiCheat is missing some important checks/improvements (Passable, NoFall, MorePackets, Frequency and BedLeave?). You cant just expect that your users will report everything to you, most of them juts want to drop the *.jar file in the plugins folder and that should be it (sad I know...).

Testers are always good to have but they cant tell you everything you need to know. TnT would have to record every packet on his server (or a lot of debug messages) to tell you everything you maybe need to know for patching. We have Tobseb for this task but we mostly use his server to get some performance statistics with experimental NC+ builds.

The time issue is excuse (since you also work in the BukkitDev team), everyone on this world is leaking on time.

 

When i use nocheatplus, people can bypass more things. When i use anticheat, people cant bypass as much. this is just what i experienced and have tested with.

 

First of I never said that NC+ or any other plugin is perfect and there is also no fight between the NC+ development team and AntiCheat. Simple because I'm not a part of the NC+ development team (asofold and neatmonster). If you really want to mark this as fight then its between me and AC. Nothing against you, nothing against h31ix and nothing against the BukkitDev team.

I never blamed the BukkitDEV staff for being useless/shit or anything like that. I can image how much time it takes to approve a plugin after every update it makes but that's not the point here.

With that post up there I just wanted to mention that AntiCheat is missing some important checks which should be good enough described on.
What do you mean with "constructive criticism"? I just posted up there what AntiCheat is missing and that's about it. What do you want me more to say/do?
Here the most critical ones summarized (on my opinion):
Passable: AC has no check for NoClip hacks
NoFall: The method you use (with OnGround) is completely "workarounded"
MorePackets: You 2 sound already know what this is. Just deny the clients to send more packets then allowed in vanilla (a pain to test but its a really powerful check)

If you need more information then just browse around the NC+ code, if you don't trust me then just say so and I try to make a video that shows it.
Nonconstructive criticism is for me something like this: "AntiCheat sucks" or "NoCheat+ is useless". They don't help at all for both of us don't they?

Since when means opensource that you're not owning the code? You own everything you make even if it can be completely copied or whatever the public does with it.
After all the BukkitAPI uses Minecraft which Java, what a try to say is that its not bad having requirements/dependency for your program. Why should we code a new API if Bukkit already has one that we can use?

There was already out something like this before: http://forums.bukkit.org/threads/anticheat-versus-nocheatplus.99014/ So should I also take that post from h31ix there as "basing/attack"? I don't think I will because on some points he was right there which helped us a bit with improving NC+. So if my points up here don't help you then feel free to ignore them.
I'm sorry h31ix if you feel attacked by this. It was never my intention to attack you or something like that. If my listed points up there are not helpful for you then feel free to ignore them completely.

Overall I just posted my opinion and only because my it wasn't positive to AC means directly attacking for you guys? Compared to nhadobas opinion I had at least some points that explain why exactly I prefer using NoCheatPlus.
We all check with events SSPX, of course that's not the most efficient way of blocking cheats but we cant just switch to the package method because we would have to override the NetServerHandler (or use ProtoclLib) which will cause big incompatibility with other plugins/mods (Orebfuscator, Spout, CraftBukkit mods). Also its very likely that the packets change when a new Minecraft update comes out so event method i more handy to use for now. Means that AC/NC+ don't suck at all, at least its better then no protection.

Bypassing:
NC+ and AC will never be 100% bypass proof (focusing on moving checks) because you can never know what exactly the client is doing on the server. SurvivalFly or Fly will never be 100% waterproof on both sites, there is always something which still allows the client to fly.
Now you may think: Well if the SurvivalFly/Fly check can be bypassed why should I use AC/NC+ on my server?
Answer: Yea but you should also know what exactly a bypass means. Nearly every fly bypass is slower then normal vanilla walking speed (experience with NC+) just because the hackers use some really heavy methods to fly around. If they try making it faster then AC/NC+ will imminently show up and alert.

So decide: Do you want players to fly around at unlimited speed or do you want them only to be able flying at snail speed? (Im for 2.)

Some checks are "easy" and some other are "hard".

Examples for easy:
- SurvivalFly/Fly
- NoFall

Examples for hard (used NC+ ones because I have no idea how the AC ones work):
- FightSpeed: How do you want to bypass that? NC+ forces you to stay under the 15 hits/second limit, a bypass would mean that you hit over 15 which should be impossible to do.
- WrongBlock: This check forces you to interact with the block first before you can break it. A bypass would mean that you can break blocks without having to interact with them.
- FightAngle: NC+ does not allow to hit 2 or more entities at the same time. A bypass would mean that you manage to hit 2 or more entities which should be impossible to do.

Just to say again: NoCheat+/AntiCheat are not completely useless and why do you even contribute code to something that you don't like SSPX?

The only point I agree on is the "helping each other point" but with what exactly do you need help on? Bug/Hack reports?

Then just keep using it?

 

One question. Where was anyone fighting here? I was justing pointing out how I feel. In addition, I have no reason to "support" or argue against either plugin. Also, the reason why I may be acting "hard" only towards h31ix is for the following reasons:

• AntiCheat is currently the most popular cheat plugin, download wise. It will probably be the first search term for "anti cheat" due to its name. Hence, more servers probably depend on it.
• I understand real life issues, but perhaps get some helpers to lessen the load?
• I've already been hard on the NoCheatPlus team, and this led to tons of changes and improvements.
• It's not like I'm just ordering stuff, I'm making suggestions, being an anticheat dev myself, I know how difficult it is to get things working, right.

 

Only an idiot would say NCP+ or AC "suck" they do not suck not you MyPictures, I meant the other guy.
If your server was invaded by a group of hackers you would screwed immediately.

Both plugins work great and need constant improvement, I can understand this takes alot of time of course I was just stating my personal opinion, NCP+ feels "more like home" for me but AC was updated faster at one point and did cover alot of things, I understand for 1.4.5 NCP is now the better option, but I have seen both AC and NCP getting bypassed, but I wasn't sure how to report it at the time.

I know this is not easy but if both teams worked together on 1 project rather than 2 I think we would get a better experience overall and a more robust protection.

Also I'm not sure if this is possible or not, but if the leading plugin was to be integrated into Bukkit dev and have a simple API for other plugins to make use of or integrate with to tighten security would be a nice feature if you ask me. This is just a thought of mine.

 

Won't happen. Too much bloat.

 

Hey, i don't give a frak about that. MyPictures could have tried to put more experience into his text there, but basically he stated differences that are pretty much valid at the moment, without really doing anything bad or wrong or even "bashing". How can MyPictures be (much) more constructive than stating what he stated? You are clearly on the bold side of this planet with this.

It might happen partly, even quite likely, but in a different sense, and i am not sure if it will be a great win on all aspects, though i am inclined to hoping for it being a great win for server owners and anti cheat plugin developers.

As some rumors are going, Minecraft itself might more or less soon add some things that will take stuff off our shoulders, putting some kind of checks to the server side. It will certainly be the more simple things like block breaking, further one might or might not dare to think about if they will also do a proper collision / on-ground checking fully server side. But nothing is certain as of now, and also if they screw it up, the plugins will need to do the calculations once more while server is already taxed with the extended native calculations, still i am hoping for the best here.

When ? Present versions might show a clear difference to that, of course those things are not static. Yet i assume that Minecraft will update a lot of internals comparably soon, so on that account it will be rolling dice again.

 

Im just saying, i just use the anti cheating plugin that i feel works much better. I switch between both, but i think since 1.4 anticheat has been better.

 

I don't have a problem with your statement. I simply state that i seriously doubt that what you say is true. Certainly there are differences like AntiCheat kicking earlier which leads to less hackers per server tick for some exploit types, but given some recent exploits and some uncovered things of already existent checks, AntiCheat just seems a bit behind at the moment. I am not stating belief but testing results.

Yet we can go on for hours discussing having different versions in mind which will lead to nothing. With thorough analysis you will find that given both plugins latest development builds AntiCheat will need a good bit of recovery/updating. NCP too, but really i judge that to be a different percentage if i might be so bold as to state that.

And not to be mistaken: I trust the AntiCheat developer(s) to be competent enough to catch up on shortcomings at least, and also i am not stating about the "better plugin" or "your personal fraking choice", just on hacks it appears they are behind right now.


And to abuse this discussion further:

Some things are probably due to design, because they can't be covered by "simplicity simply", given the current Minecraft implementation. But i also have to state, that i just hopped in to NCP-dev from the side, finding a mixed/half-abondoned/half-continued state, having NeatMonster return for a while then disappear again - initially (as can be found in statements of the past) i clearly did not intend to continue NoCheat neither NoCheatPlus, but when i found NeatMonster deciding to continue for a bit at least i decided to support it somehow, and NeatMonster did a lot of good work necessary to make this continuable. Of course i am way too much into this now, at least more than i initially wanted, but as i also stated earlier on, anti cheat plugin dev needs constant care and means continuous cat and mice play. As soon as NCP appeared to be back on stage, client devs were discussing a lot about how to bypass, using code review of NCP etc. So one can't just update an anti cheat plugin and be done.

If it was for me, if NeatMonster returns and/or AntiCheat and hopefully SafeGuard are in such a state that i would trust them to have both enough stuff covered as well as the basic configurability necessary for a wide variety of differing server types, i would be "almost happy" to turn down dev on this and leave the field to them, retiring to an advisory role or even none. Just now NCP clearly is needed, no way around it (don't mistake this statement for what it is not).

Concerning design for a continuation of NoCheat or a new plugin i at first had in mind something that AntiCheat does (simple one-class back-end, or at least all individual player data concentrated in one player object for faster access, though allowing hierarchy, still just one look-up to allow better cross-domain checking), but given the set-up of NCP i am complying with the current design, trying to go with some small-changes paradigm in most places (slowly transforming/refactoring it where i find it necessary, or where i am motivated to do it/something).

Of course my true aim is to reach top five in mcstats.org, but i could not seriously state that here.

So which one is now off topic... me or the whole discussion? If you want to block only certain hacks, test them with the plugins in question or ask which clients hacks are blocked at the moment by what plugin and which not. If you want to have a certain way of configuration or paradigm then check the plugins docs about those and decide for the one that matches your intents most. At the moment NCP might be a good choice to really cover stuff, but it may well change in a couple of days or weeks, as always.