RCon enabled by default with default password

[so7ow]

Is it a great idea to have RCon enabled by default with the default password of 'minecraft'? Someone used that default configuration to join my server and grant themselves server op. Not a huge deal and I've dealt with it now but perhaps a more secure config by default would be a good idea?

[itzg]

Did you have the rcon port bound outside the container?

[so7ow]

I did, and that was my fault. The guy who did this did so in a friendly way and he said he finds similarly configured servers very frequently.

[itzg]

Thanks for the followup.

I should probably add a note advising about that on the README.

I was also thinking I can generate a random value by default that the internal tools can still use. It might break other people, so I'll give that some more thought.

[hockeyduck3]

Is there a way to disable RCON and leave it off? My friends and I had a scare today where someone joined and took away our server op. It really scared us when I banned him and then he unbanned himself. Luckily I figured out what was going on and shut it down.

Which part of that is on me cause I didn't know I didn't need to forward port 25575. But it does seem like when I go and change the server.properties file the RCON settings get reset when I restart the server.

I'm also running my server in a docker container if that helps.

[itzg]

@hockeyduck3 yes, take a look at the README and use those variables instead of the properties file.

[itzg]

I was also thinking I can generate a random value by default that the internal tools can still use. It might break other people, so I'll give that some more thought.

Just reconfirmed this won't work at all since the environment variable needs to be available at the container level and not just the startup process.

Would leaving out the EXPOSE of 25575 help prevent the inclination to bind that port?

@so7ow @hockeyduck3 what documentation, tutorial, etc led you to believe 25575 should be bound and port forwarded?

[so7ow]

@so7ow @hockeyduck3 what documentation, tutorial, etc led you to believe 25575 should be bound and port forwarded?

Sorry, I don't recall--it was too long ago. I wasn't aware of RCon as a concept and I was just trying to make the server accessible to kids' friends. Clearly I should have read a little more.

[hockeyduck3]

@so7ow @hockeyduck3 what documentation, tutorial, etc led you to believe 25575 should be bound and port forwarded?

Here's a link to the tutorial I followed. https://drfrankenstein.co.uk/2021/05/03/minecraft-java-server-in-docker-on-a-synology-nas/

In the tutorial the guy didn't say anything about the ports other than: "You will now see the Port Settings screen, you will need to type in the Local Ports to match the Container Ports shown on the right hand side, this will stop the container from being assigned random ports when it is started and make accessing your server easy."

Since the tutorial didn't say anything about what either ports were for, my dumb brain thought I had to forward both in order for my friends to connect.

I honestly feel so dumb that I didn't notice that only one port needed to be forwarded. But just like @so7ow until yesterday I didn't know RCON was a thing.

[itzg]

Thanks, both, for the follow-up info. I think the removal of the pre-exposed port declaration will help quite a bit for future scenarios like this. That updated image is building now.

[shinysocks]

I'm having trouble with rcon as well.
Firstly, I agree that it should be disabled by default.
Secondly, when I attempt to disable it in the server.properties file, it keeps re-enabling. All other settings seem to persistent a container restart except for that one???

[itzg]

@shinysocks disable it with the environment variable as described in https://github.com/itzg/docker-minecraft-server#rcon

[shinysocks]

Thank you! I should have looked harder before asking... I really appreciate your work on this project.

[camalot]

Just reconfirmed this won't work at all since the environment variable needs to be available at the container level and not just the startup process.

@itzg couldn't you generate a random password when building the container? maybe in the build action, or pass as a BUILD-ARG and set the env to the build-arg?

Yeah, it will absolutely mess with people that are using the default password, but the fix for them would be to set that variable back to the default. so they would have to make the decision to set it to that value, or set to something else, if they want to use it. and really, SHOULD they be using RCON with default password?

Document that the password is RANDOM, and that it MUST be set in order to successfully use RCON.