Security5 min read
RCON, safely
Remote console is a password-protected shell for your game server, and it was designed in a more trusting era. How to use it without leaving it open.
RCON sends administrative commands to a running game server. In most implementations the password crosses the network with very little protection, and anybody who has it can do anything the console can - which includes stopping the server and, with some games, rather more than that.
Rules worth following
- Do not expose the RCON port to the internet. Restrict it to addresses you control.
- Use a long random password that is not used anywhere else, including your panel account.
- Turn it off if nothing uses it. Most servers have it enabled and unused.
- Rotate it after anybody who had it stops being involved.
The safer alternative
If your host gives you a console in the panel, use that instead. It is the same capability behind an account you already protect properly, rather than a second credential on an open port.