Безопасность6 мин чтения
Keeping a modded server clean
Mods are code you did not write, running with your server's permissions. Where to get them, what to check, and the warning signs worth acting on.
Эта статья пока на английском. Мы её переводим.
Every mod is a program running inside your server with the same access your server has. That is not a reason to avoid mods; it is a reason to be deliberate about where they come from, because a repackaged jar from a forum post is a genuine risk rather than a theoretical one.
Where to get them
- The author's own page, or the platform they publish on. Nowhere else.
- Not a reupload, however convenient the bundle looks.
- Not a pack from a link in a chat message, which is how this goes wrong most often.
Warning signs
Outbound connections from a game server that should only be answering them. A mod that asks for permissions unrelated to what it does. A jar that is far larger than its description suggests. Any of these is worth stopping to investigate rather than noting for later.
The threat model for a modded server is not hackers. It is a convenient download from somebody you have never met.