Playerworld Security Report (Summer '04) *Please Read*

[Spark910]

Well here are some interesting statistics about how secure… or should I say insecure Graal is, due to people not setting IP ranges.

Every time in the past from a server attack I think ‘how the hell’, because I was under the impression people wanted their servers secure, and not deleted. But when you log onto a server and find around 25 level4RCs, and 14 of which with an IP range of: *.*.*.* - you no longer begin to question how, but instead wonder why.

So over the past few weeks I have been server hoping removing any RC with an IP range of *.*.*.* and adding notes about other IPs that could be more secure.

I found a lot of servers had people in the staff= without any rights, which is not a good thing. If they are not staff, then they should not be in the staff = serveroption.

The Stats:
How many servers actually had all IPs set?
28/124 (22% of the online playerworlds were secure)

How many RCs actually had an IP range of *.*.*.*?
339 RCs were found in the staff= server option with an IP range of *.*.*.*

What level RCs were in the staff= server option with an IP of *.*.*.*?
Level4 RCs: 95/339 (28%)
Level3 RCs: 58/339 (17%)
Level2 RCs: 37/339 (11%)
Level1 RCs: 82/339 (24%)
Level0 RCs: 67/339 (20%)

Which playerworlds were 100% secure?
Classic Tab Playerworlds: 3/10 (30%)*
Hosted Tab Playerworlds: 2/6 (30%)*
Hidden Hosted Playerworlds: 23/108 (21%)
*Most Classic/Hosted tab playerworlds had one RC that had *.*.*.*, most of which were level 1/0.

Conclusion:
Graalonline playerworlds are very insecure. I am happy to see however that Classic/Hosted playerworlds are taking it serious with most of them with only 1 or two level1/0 RCs unprotected.

However this needs to change. Not setting an IP range is a security risk. Doing so is also against the playerworld rules. Any playerworld found with staff with an IP range of *.*.*.* that has been picked out this time, and is found next time, will be suspended for a period of time and removed from public if it is a Classic/Hosted playerworld.

What do we need to do now?
Well, as you will have seen if your playerworld was a problem I left a message in your serveroptions saying that you should not add the RCs back until an IP range is set. If you do this then you will be fine, but people need to keep checking these things.

--If you are a manager:
*Check IP ranges every month, to make sure they are all set.
*Never add anyone to the staff= serveroption without an IP range, make them give you them first, this was the common way of playerworlds getting attacked recently.
*Don’t add ‘temp’ or ‘guest’ RCs and if this is needed they shouldn’t be left in the staff= serveroptions, or with rights on their account.
*Do not give high rights to new staff, get to know you can trust them first.

--If you are a staff member with RC:
*Check your IP range on all your RCs, and make sure they are set.
*Frequently check if your IP range can be more secure that it currently is.

A few rule reminders/points:
So that’s all basically, but I would like to remind you of rules which are being broken on almost all playerworlds.

Originally Posted by IPs

ALL RCs need an IP range or lock. This should be no less than two numbers. It should contain 2 numbers in the IP range. e.g:
#.#.*.* =2 numbers

Everyone should get a #.#.*.* IP range, even the AOL users, it may just need updating a lot at first.

Originally Posted by RC Levels

No playerworld should have more than 3 level4 RCs. If you want to use a 3rd then you must keep the level 4 RC on the admin-playerworld## account. Those playerworlds that were not setup by means of payment can give this RC to another account

No playerworld should have more than three other high levelled RCs (level3), as rights are not needed and people can ask for things instead of performing actions their selves.

This is important, as people override each others decisions, and if they get annoyed they may delete the server, just because they can.

Originally Posted by Admin-Playerworld Accounts

If you are not using this log onto it and disable it by saying:
/openacc Admin-Playerworld### and checking [ ] Banned
Then click apply.

Note also: Admin-Playerworld accounts with NO rights, when they connect, automatically get a level4 RC. So to stop this set some rights, such as ‘View Attributes’, then it will not get level4 when it connects.

Don’t Forget: I can update IP ranges and things, so there is no need for a ‘back-door RC’ just incase.

Thankyou for reading, that’s about it. While I would like everyone with IPs set, I realize that is an impossible request, however everyone should set IPs now, and check them all.

Next IP Range check Targets:
*80 % + of playerworlds secure
*ALL Classic and Hosted Playerworlds with ALL staff= RCs secured.

Thank you.

--Playerworld Administration Team