Extreme range digging/killing ability 3,000 meters+

[843jdc]

This might be premature but I wanted to give a heads up.

Problems:

• I have a player that claims she can dig from at least 3,000 meters away and can kill from at least 1,000 meters away. While I can't do that to verify the claim, I have no reason to not believe. She is a mature adult for one thing.
  
  She can do this on at least two other servers. I asked her to try. One server was a 0.4.14 server. My server is a couple of days away from being an official 0.4.16 server.
  
  She killed me while being high in the air above me. She has at least a 20 meter range at spawn on JT2 server. Nemo was present and witnessed it.
  
  Adding 'range = 4.0,' to the diamond sword definition did nothing to prevent this.
  
  Bonus: She is doing this using a cellphone! No special changes done to her MT client. Just a recent update.
  
  Possibly related:
  viewtopic.php?f=6&t=17789&start=25#p275040
• Ability to dig the outer nodes of protected areas.

Server versions affected: 0.4.15-git & 0.4.16 release. Running on Fedora 25

SOLVED !

These two problems have apparently been solved with a very simple conf file setting:
disable_anticheat = false

PurpleOne told me that she can no longer dig at long range and that she can not dig into protected areas anymore.

I *love* simple fixes. Though I wish I had thought to try it before I created this forum. Eh, maybe it will help someone else.

I am now seeing lots of: Player *** tried to access node (blah blah) from too far. ignoring.

[maikerumine]

Whoah... that is crazy.

[GreenXenith]

It's the mobile clients. MrHandsompig and muhdnurhidyat have both experienced the same problem with the 0.4.16 mobile client.

[PurpleOne]

I also have been experiencing players able to dig into protected areas with this range. I have been able to duplicate this same incident several times on many different protected areas. The strange thing I noticed about this is that you have to be a good distance away from the area to pass the protection (I want to say 200-300 but it's kinda hard to tell). From what I experiemented with, it can only occur with blocks on the very outside of the protection boarders. It wont work with items closer inside. I've only done this on one other server (jt2) and I believe I got it to work there too. I'm not 100% sure because it's a server I'm not used to.

I believe this ranged problem is causing players to pass the protection.

[lag01]

I also have been experiencing players able to dig into protected areas with this range. I have been able to duplicate this same incident several times on many different protected areas. The strange thing I noticed about this is that you have to be a good distance away from the area to pass the protection (I want to say 200-300 but it's kinda hard to tell). From what I experiemented with, it can only occur with blocks on the very outside of the protection boarders. It wont work with items closer inside. I've only done this on one other server (jt2) and I believe I got it to work there too. I'm not 100% sure because it's a server I'm not used to.

I believe this ranged problem is causing players to pass the protection.

Yes, it may be true. Some protection mods may not be checking for undefined nodes.

[red-001]

is anti-cheat enabled? range check got added at some point near the start of 0.4.16 development.

[Fixer]

And you forgot main part, anticheat was disabled... You have to enable it to prevent those kind of problems.

[sfan5]

range check got added at some point near the start of 0.4.16 development.

That's incorrect, the range check was added in 2012 for 0.4.dev-20120318.

[maikerumine]

I firmly believe that a certain setting in minetest.conf can make the range longer for hackers.

[sorcerykid]

And you forgot main part, anticheat was disabled... You have to enable it to prevent those kind of problems.

I personally confirmed the bug with bypassing protection (as PurpleOne described) while on the "just test" server which does have anticheat enabled. So I don't think anticheat is the foolproof solution to these exploits.

[PurpleOne]

I firmly believe that a certain setting in minetest.conf can make the range longer for hackers.

But this is happening to normal mobile minetest users (not affecting PC players at all strangely). It only surfaced after the last update.

[843jdc]

These two problems have apparently been solved with a very simple conf file setting:
disable_anticheat = false

PurpleOne told me that she can no longer dig at long range and that she can not dig into protected areas anymore.

I *love* simple fixes. Though I wish I had thought to try it before I created this forum. Eh, maybe it will help someone else.

I am now seeing lots of: Player *** tried to access (blah blah) from too far. ignoring.

New problem:
The swarm of new players or bots are back again. Reportedly hitting JT2 server also. New players are not allowed for now. No sweat.

[sorcerykid]

Last I tried, I found a way to partially override protection on the just test server. Afaik lag has anticheat enabled (perhaps not the builtin anticheat tho, but a mod?)

And yes, the bot-like players continue to be a hassle. I'm going to implement a challenge-response test to determine whether new players are human and to automatically kick them otherwise.

[lag01]

Last I tried, I found a way to partially override protection on the just test server. Afaik lag has anticheat enabled (perhaps not the builtin anticheat tho, but a mod?)

And yes, the bot-like players continue to be a hassle. I'm going to implement a challenge-response test to determine whether new players are human and to automatically kick them otherwise.

I have setting
disable_anticheat = false
Also i handle anticheat events from engine
https://github.com/AndrejIT/minimal_anticheat
I do not use "return true", so i expect engine to prevent all detected cheats...

As long as server is not short on resources, i don't mind those bot-like players. If you try really hard to catch their interest, you cam make some of them build cobble house, or even do some mining.

[Fixer]

I personally confirmed the bug with bypassing protection (as PurpleOne described) while on the "just test" server which does have anticheat enabled. So I don't think anticheat is the foolproof solution to these exploits.

sorcerykid:
There was additional fix of that somewhere in 0.4.15-dev (iirc https://github.com/minetest/minetest/co ... c37ad377cb). Try reproducing it on 0.4.16.

Anticheat is enabled by default on servers, do not disable it! And if there are problems - report them to github issue page. It should work better in 0.4.16.

[843jdc]

lag01 - My main concern about the huge number of players is the huge number of player files created. Though I am using a ext4 filesystem, I am sure there is a limit to how many files can be contained in a directory. Players get upset when I delete their player files and they were carrying anything 'expensive to them' even if it is only a few pieces of wood :)

When I switch to using SQLite3 or Redis to contain the player files, I need a way to save some player files. Mainly those players that own protection blocks or locked chests and doors.

I would like to switch over to using SQLite3 or Redis for player files ASAP. I moved the server back from my fast but rapidly wearing solid drive drive to a slower hard disk drive. Creating new players seems to be causing a lot of lag. Studying redis-py docs, lag's scripts and the changes I made to them so I can do this takes forever. Lag is the python expert not me :)

I never have time to just hover over spawn watching what those 'bots' do. Too many players wanting something from me :/

Fixerol - I heard of so many problems with anti-cheat enabled. That I turned it off and forgot about it. I am now seeing a lot of messages about long-range digging, ignoring. and notices of players moving too fast. I don't know if players were cheating or not. I tried walking around myself but did not trigger anything. Maybe if I try descending some stairs.

[lag01]

lag01 - My main concern about the huge number of players is the huge number of player files created.
...

At old times i had ~162000 player files, now it is 40000. Many unix commands, like cp, gzip actually was unable to handle this amount.
I am more worried about auth.txt, it is 18MB already...

By the way, is it really possible to check if SSD is wearing.

[mnh48]

Copy paste from my comment in related Github issue:

"Other problems" ... you're refering to the "extreme highlight" instead now? :P

while extreme range digging/killing could be solved server side with anticheat (you dig it and server restores that block, repeat), is there any way to actually limit the select/highlight range from client? some lines in minetest.conf??

It would be weird that you could highlight/select nodes very far but not dig it (anticheat is on) and it's also weird if you could stand in one place and destroys everything on sight (anticheat is off) -- yes, it's "on sight" and not limited to 3000. Nodes very far away should not be highlightable in the first place.

I remember that 0.4.15 don't have this kind of problem so I'm wondering why it's there in 0.4.16... and it's official Minetest app for Android, not custom/community build nor forks.

[843jdc]

lag01 - Current number of player files = 133,762
auth.txt size = 61.8 MB
SSD heath = 39% This is after 18 months. Warranty is for 3 years. Hmm. the app says it is no longer under warranty. I need to check into that. Doubt if I can do anything about it regardless. I don't know how the app determines the health. Maybe be a ratio of number of writes to the drive over what the manufacturer figures is max life.

The method I used to delete them was to copy the files that I wanted to save (~3000-4,000) to another directory. Save passwords for those players. Then delete the player directory and auth.txt file. It was a long involved process to select the files to be saved. That was not possible without your scripts. Though I had to modify one of them to read the contents of chests. Or was that to be able to read the metadata? I forget which.

Be prepared for an increase in players in about 3 months. I am fairly certain that once school restarts after summer that I will shut down Cash's World.

muhdnurhidayat - The player that told me about the extreme-range digging also told me that she can now highlight and dig nodes and everything seems normal except that she doesn't get what she dug in inventory. I'll guess that the highlighting is a client issue.

[BBmine]

lag01 - Current number of player files = 133,762
auth.txt size = 61.8 MB
SSD heath = 39% This is after 18 months. Warranty is for 3 years. Hmm. the app says it is no longer under warranty. I need to check into that. Doubt if I can do anything about it regardless. I don't know how the app determines the health. Maybe be a ratio of number of writes to the drive over what the manufacturer figures is max life.

The method I used to delete them was to copy the files that I wanted to save (~3000-4,000) to another directory. Save passwords for those players. Then delete the player directory and auth.txt file. It was a long involved process to select the files to be saved. That was not possible without your scripts. Though I had to modify one of them to read the contents of chests. Or was that to be able to read the metadata? I forget which.

Be prepared for an increase in players in about 3 months. I am fairly certain that once school restarts after summer that I will shut down Cash's World.

muhdnurhidayat - The player that told me about the extreme-range digging also told me that she can now highlight and dig nodes and everything seems normal except that she doesn't get what she dug in inventory. I'll guess that the highlighting is a client issue.

39%? You mean the # of writes?

You're shutting down Cash's World forever in the Fall?

[rnd]

lag01 - Current number of player files = 133,762
auth.txt size = 61.8 MB

Thats a known problem in minetest and sorcerykid already wrote about it https://github.com/minetest/minetest/issues/5334 "ages" ago (even opened issue on march 2017). As you can see
from https://github.com/minetest/minetest/bl ... e/auth.lua nothing has been done about it, just a lot of yada yada

If you go look code you see what happens when player joins server:
core.register_on_joinplayer(function(player) record_login(player:get_player_name()) end)

and
record_login = function(name) ... save_auth_file() end

and guess what :) save_auth_file happily rewrites your COMPLETE file from scratch.
You can easily disable that yourself by just removing save_auth when not needed - only do it on shutdown for example.

And you dont really need 99999 player accounts - in reality there are max 500 active players - everything else is just "random_name_5462" - you can delete those automatically (with simple mod) when they leave. There are mods out there that do that - no more unneeded player files - i made one for self use oldplayer. This mod will even remove all traces from non active player from auth.txt.

[Fixer]

Player files can be moved into database now since 0.4.16. Auth may probably go into database too (but later).

1XX 000 of players seems like a lot, are there "N players per IP" mod is installed? Probably mobile clients with NameXXX causing toooons of clones. But I guess it is price you pay. Trying moving playerfiles to database.

[843jdc]

I allow 7 names per IP addr to allow for families with more than one player or for friends of players that come for sleepovers, etc.

I will move playerfiles to a Redis database when/if I get off my butt and write code that can edit the database file. lag01 has a script that can be used for SQLite3. I mostly just need to study the redis-py docs to learn how to access the data.

auth.txt in a database would be nice. From what I can understand, 4 (or is it 10?) databases can be contained in a single Redis database file. I need to figure out how to do that. I think redis_hash has something to do with it but I don't know what it means or what to set redis_hash to. Is it a number, name, or what?

Does a person with a PhD in Computer Science even know everything there is to know about computers? Dumb question. Of course not. Always something new to learn :)

[ExeterDad]

Our auth.txt had over 120k lines (roughly 44 megabytes). So implying we had that many players. But player files were nearly half that amount. So I'm assuming players that join and quickly crash or leave never have a player file generated.
So I call this bash script every so often with my restart scripts to read the auth.txt line by line and check if a player file exists for it. If so, it copies that auth.txt line to a new_auth.txt that can replace the original auth.txt with all the redundant players removed. At first run it was pretty slow, but now it's completed in about half the time. And as expected the size of the auth.txt was cut in half. There's no harm done as these removed "players" have no inventory since there aren't player files for them.

Code: Select all

#!/bin/bash

# Path to your world dir contianing all files. No trailing slash
world_dir="/path/to/world/dir"

if [ -e "${world_dir}/new_auth.txt" ]; then
	rm ${world_dir}/new_auth.txt
fi

cd ${world_dir}/players

for i in $(cat ${world_dir}/auth.txt); do
	player=$(echo $i|cut -f 1 -d ":")
	if [ -f "$player" ]; then
	
		#comment out next line if using in script
		echo "${player} is a valid player."
		
		echo $i >> ${world_dir}/new_auth.txt
	fi
done

Currently we don't delete old players as we aren't really that old yet. But that's soon to change as the auth.txt size is still alarming.

[sorcerykid]

My primary concern with anticheat is the frequency of false positives. I can't tell you how many times I've been killed on the just test server while doing routine mining because of "suspected cheating". Every day I see a barrage of cheat detection warnings in chat by players that I know do not have hacked clients. And I'm pretty sure that lag runs the latest stable build of Minetest.

Perhaps if someone addresses these shortcomings, then I might consider enabling it on my server. But as it currently stands, I regard Minetest's builtin anticheat as more of a burden than a solution. More than likely I will try to roll my own anticheat system in Lua, as it's not very difficult to detect certain suspicious behavior (noclip, too fast, too far, etc).