<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://wiki.alliedmods.net/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Devicenull</id>
	<title>AlliedModders Wiki - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://wiki.alliedmods.net/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Devicenull"/>
	<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/Special:Contributions/Devicenull"/>
	<updated>2026-05-08T18:10:49Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.31.6</generator>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7682</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7682"/>
		<updated>2010-04-20T16:56:15Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Special name characters */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data/&lt;br /&gt;
* addons/sourcemod/logs/&lt;br /&gt;
* logs/&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  Some of these commands can cause the ingame physiscs to freeze up.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7681</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7681"/>
		<updated>2010-04-20T16:53:48Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Command spam */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data/&lt;br /&gt;
* addons/sourcemod/logs/&lt;br /&gt;
* logs/&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  Some of these commands can cause the ingame physiscs to freeze up.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7680</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7680"/>
		<updated>2010-04-20T16:53:04Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* File Permissions */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data/&lt;br /&gt;
* addons/sourcemod/logs/&lt;br /&gt;
* logs/&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7679</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7679"/>
		<updated>2010-04-20T16:52:28Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7678</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7678"/>
		<updated>2010-04-20T16:52:07Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Disconnect Crash */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7677</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7677"/>
		<updated>2010-04-20T16:51:55Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* HalfConnected Crash */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7676</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7676"/>
		<updated>2010-04-20T16:51:33Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* &amp;quot;K&amp;quot; packet Crash */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: 4/19/10: Apply the latest steam beta patch.  Run hldsupdatetool with &amp;quot;-beta cs0419&amp;quot; to get this.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7609</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7609"/>
		<updated>2010-04-07T19:43:39Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* = &amp;quot;K&amp;quot; packet Crash */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ===&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: If it is a windows server, running the Steam client on the same machine will patch this.  There is no known fix for Linux.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7608</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7608"/>
		<updated>2010-04-07T19:43:33Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Crashes */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== &amp;quot;K&amp;quot; packet Crash ==&lt;br /&gt;
Using modified clients, it is possible to send a Steam auth packet that contains an invalid header length.  Upon receiving this packet, the server will crash.&lt;br /&gt;
&lt;br /&gt;
*Fix: If it is a windows server, running the Steam client on the same machine will patch this.  There is no known fix for Linux.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7607</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7607"/>
		<updated>2010-04-07T19:41:51Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
=== Disconnect Crash ===&lt;br /&gt;
Using modified clients, it is possible to send disconnect messages with large numbers of special characters.  These have a variety of effects, including crashing the server or crashing all connected clients.&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7549</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7549"/>
		<updated>2010-03-20T05:58:59Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Securing your server */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
== General Tips == &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* [http://www.goodpassword.com/ Use secure passwords.]  This should be obvious, but your clan name is not a good rcon password, nor is &amp;quot;password&amp;quot;.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client.&lt;br /&gt;
&lt;br /&gt;
== Plugins ==&lt;br /&gt;
There are a few plugins that can be installed to prevent exploits.  Some of the recommended ones include [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF].&lt;br /&gt;
&lt;br /&gt;
Many of the Eventscripts plugins that claim to fix exploits are mostly useless at best, or actively harmful to your server at worst.  If you are running the plugins listed in the previous paragraph, you do not need anything else to protect your server.  Installing extra plugins other then those will likely cause issues with your server, and is not recommended.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7548</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7548"/>
		<updated>2010-03-20T05:56:12Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
== File Permissions ==&lt;br /&gt;
If you are running your own server (not renting one from a GSP), there are some things you can do to prevent many of the more malicious exploits.  The basic theory here is to give srcds as little access to the machine as possible.  It only needs write access to the following directories:&lt;br /&gt;
* downloads/&lt;br /&gt;
* cache/&lt;br /&gt;
* addons/sourcemod/gamedata/&lt;br /&gt;
* addons/sourcemod/data&lt;br /&gt;
Note that some plugins rely on being able to write to directories other then these, and permissions may break them.  At the very least, it's a good idea to make sure srcds is running as a user that does not have permission to change anything outside of it's own directory.  That will prevent your machine from being comprised and made into a botnet client. &lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7540</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7540"/>
		<updated>2010-03-12T00:49:01Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
=== Invalid ticket length crash ===&lt;br /&gt;
By manipulating the steam login packets, it's possible to create one with an invalid length field.  The server will crash with a generic memory read error (windows) or segfault (linux).&lt;br /&gt;
&lt;br /&gt;
*Fix: No fix available.&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7537</id>
		<title>Vice keys</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7537"/>
		<updated>2010-02-24T22:14:00Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;VICE keys are used to encrypt the game's weapon config files in an effort to make them more difficult to tamper with.  It's not really a great protection, as usually the key is just hardcoded into the server binaries.  Some games, such as Golden Eye Source, try to make it more difficult to retrieve these, but even then it's trivial.&lt;br /&gt;
&lt;br /&gt;
These keys can be used to decrypt the CTX files that many games provide.&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
!width=&amp;quot;300&amp;quot;| Game&lt;br /&gt;
!width=&amp;quot;100&amp;quot;| Key&lt;br /&gt;
|-&lt;br /&gt;
| Counter-Strike: Source&lt;br /&gt;
| d7NSuLq2&lt;br /&gt;
|- &lt;br /&gt;
| CSPromod&lt;br /&gt;
| H1aRQ0n1&lt;br /&gt;
|-&lt;br /&gt;
| Day of Defeat: Source&lt;br /&gt;
| Wl0u5B3F&lt;br /&gt;
|- &lt;br /&gt;
| Dystopia&lt;br /&gt;
| pH3apO8w&lt;br /&gt;
|-&lt;br /&gt;
| Golden Eye Source&lt;br /&gt;
| Gr3naDes&lt;br /&gt;
|- &lt;br /&gt;
| Half-Life 2: Deathmatch&lt;br /&gt;
| x9Ke0BY7&lt;br /&gt;
|- &lt;br /&gt;
| Insurgency&lt;br /&gt;
| DrA5e3EB&lt;br /&gt;
|-&lt;br /&gt;
| TF2 (items.ctx)&lt;br /&gt;
| A5fSXbf7&lt;br /&gt;
|- &lt;br /&gt;
| TF2 (everything else)&lt;br /&gt;
| E2NcUkG2&lt;br /&gt;
|- &lt;br /&gt;
| ZPS&lt;br /&gt;
| 5R0ni0pZ&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7536</id>
		<title>Vice keys</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7536"/>
		<updated>2010-02-24T22:13:39Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;VICE keys are used to encrypt the game's weapon config files in an effort to make them more difficult to tamper with.  It's not really a great protection, as usually the key is just hardcoded into the server binaries.  Some games, such as Golden Eye Source, try to make it more difficult to retrieve these, but even then it's trivial.&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
!width=&amp;quot;300&amp;quot;| Game&lt;br /&gt;
!width=&amp;quot;100&amp;quot;| Key&lt;br /&gt;
|-&lt;br /&gt;
| Counter-Strike: Source&lt;br /&gt;
| d7NSuLq2&lt;br /&gt;
|- &lt;br /&gt;
| CSPromod&lt;br /&gt;
| H1aRQ0n1&lt;br /&gt;
|-&lt;br /&gt;
| Day of Defeat: Source&lt;br /&gt;
| Wl0u5B3F&lt;br /&gt;
|- &lt;br /&gt;
| Dystopia&lt;br /&gt;
| pH3apO8w&lt;br /&gt;
|-&lt;br /&gt;
| Golden Eye Source&lt;br /&gt;
| Gr3naDes&lt;br /&gt;
|- &lt;br /&gt;
| Half-Life 2: Deathmatch&lt;br /&gt;
| x9Ke0BY7&lt;br /&gt;
|- &lt;br /&gt;
| Insurgency&lt;br /&gt;
| DrA5e3EB&lt;br /&gt;
|-&lt;br /&gt;
| TF2 (items.ctx)&lt;br /&gt;
| A5fSXbf7&lt;br /&gt;
|- &lt;br /&gt;
| TF2 (everything else)&lt;br /&gt;
| E2NcUkG2&lt;br /&gt;
|- &lt;br /&gt;
| ZPS&lt;br /&gt;
| 5R0ni0pZ&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7535</id>
		<title>Vice keys</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7535"/>
		<updated>2010-02-24T20:17:25Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{|&lt;br /&gt;
| Game&lt;br /&gt;
| Key&lt;br /&gt;
|-&lt;br /&gt;
| Counter-Strike: Source&lt;br /&gt;
| d7NSuLq2&lt;br /&gt;
|- &lt;br /&gt;
| CSPromod&lt;br /&gt;
| H1aRQ0n1&lt;br /&gt;
|-&lt;br /&gt;
| Day of Defeat: Source&lt;br /&gt;
| Wl0u5B3F&lt;br /&gt;
|- &lt;br /&gt;
| Dystopia&lt;br /&gt;
| pH3apO8w&lt;br /&gt;
|-&lt;br /&gt;
| Golden Eye Source&lt;br /&gt;
| Gr3naDes&lt;br /&gt;
|- &lt;br /&gt;
| Half-Life 2: Deathmatch&lt;br /&gt;
| x9Ke0BY7&lt;br /&gt;
|- &lt;br /&gt;
| Insurgency&lt;br /&gt;
| DrA5e3EB&lt;br /&gt;
|-&lt;br /&gt;
| TF2 (items.ctx)&lt;br /&gt;
| A5fSXbf7&lt;br /&gt;
|- &lt;br /&gt;
| TF2 (everything else)&lt;br /&gt;
| E2NcUkG2&lt;br /&gt;
|- &lt;br /&gt;
| ZPS&lt;br /&gt;
| 5R0ni0pZ&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7534</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7534"/>
		<updated>2010-02-24T06:40:28Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* A2S_INFO Spam */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (a SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7533</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7533"/>
		<updated>2010-02-24T06:26:04Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Annoyances */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (an SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
=== Special name characters ===&lt;br /&gt;
If certain special characters are added to your name, you can create messages that appear to be sent by the server administrator.&lt;br /&gt;
&lt;br /&gt;
*Fix: None currently known.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7522</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7522"/>
		<updated>2010-02-19T01:34:29Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Takeover */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
=== File upload/download ===&lt;br /&gt;
It's possible to convince the server to let you upload or download random files from it.  Valve has been attempting to fix this, but there still seem to be some workarounds to their fixes.&lt;br /&gt;
&lt;br /&gt;
If you are running your own servers (not rented from a GSP), you can set file permissions on them to fix the upload issue.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?t=109453 dfens] will prevent this.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (an SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7521</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7521"/>
		<updated>2010-02-19T01:31:50Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Securing your server = &lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix], [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck], [https://forums.alliedmods.net/showthread.php?t=109453 D-FENS], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.  &lt;br /&gt;
* [http://www.goodpassword.com/ Use secure rcon passwords.]  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.&lt;br /&gt;
* Don't piss people off.  Many servers get attacked because players get pissed off that admins are abusing them.&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Crashes ==&lt;br /&gt;
&lt;br /&gt;
=== Invalid RCON Crash ===&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's.&lt;br /&gt;
&lt;br /&gt;
=== HalfConnected Crash ===&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix]&lt;br /&gt;
&lt;br /&gt;
== Takeover == &lt;br /&gt;
=== ent_fire server takeover ===&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
=== ES_Tools changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when ES_tools is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will prevent this.  Alternatively, remove es_tools if at all possible.&lt;br /&gt;
&lt;br /&gt;
== Lag/DOS ==&lt;br /&gt;
=== A2C_PRINT Spam ===&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF]&lt;br /&gt;
=== A2S_INFO Spam ===&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 Query Cache] (an SM extension) will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
=== Command spam ===&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 Forlix FloodCheck] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] adds the cheats flag to most of the known commands.  [https://forums.alliedmods.net/showthread.php?p=880328 Scortched Earth] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
=== Bell characters in name ===&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will kick players with these characters in their name.&lt;br /&gt;
=== Force fullupdate ===&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 DAF] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Annoyances ==&lt;br /&gt;
=== Teleport exploit ===&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
=== Clientside plugins ===&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has a partial fix for this.&lt;br /&gt;
=== Empty name / unconnected ===&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] will automatically kick anyone found to have an empty name&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647 File upload exploit fix]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 Rcon locker / exploit fix] has what may be a partial fix. &lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7519</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7519"/>
		<updated>2010-02-17T06:21:12Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Any exploits not here that you would like added can be emailed to dn at devicenull.org and I'll update this page.  Note: There's enough information here for Valve to fix the exploits, but hopefully not enough for people to use these exploits.&lt;br /&gt;
&lt;br /&gt;
Tips for securing your server:&lt;br /&gt;
* Do not enable sv_cheats, do not run any plugins that do so.&lt;br /&gt;
* Between [https://forums.alliedmods.net/showthread.php?p=841590 this plugin], [https://forums.alliedmods.net/showthread.php?p=779851 this plugin], and [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 this plugin] you should be well-protected against most of these exploits.  Please don't just install every &amp;quot;fix exploit&amp;quot; plugin you can find, many have duplicate features and end up conflicting with each other.&lt;br /&gt;
* Use secure rcon passwords.  This should be obvious, but your clan name is not a good rcon password.&lt;br /&gt;
* Don't blindly give admin out.  Depending on what flags you give people, you could allow them to take over the server.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
&lt;br /&gt;
= Current Exploits =&lt;br /&gt;
&lt;br /&gt;
== Invalid RCON Crash ==&lt;br /&gt;
SRCDS will crash on some machines if you attempt to use an incorrect rcon password too many times.  It seems that some machines are affected by this, while others are not.  Valve has been notified a few times, and has been unwilling/unable to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: Firewall off rcon (TCP port 27015) from everyone except for certain whitelisted IP's&lt;br /&gt;
&lt;br /&gt;
== HalfConnected Crash ==&lt;br /&gt;
[http://aluigi.freeforums.org/source-engine-seg-fault-crash-exploit-t993.html Inital thread]&lt;br /&gt;
&lt;br /&gt;
If a command is received as the client is connecting, the server will crash or enter a state where it does not accept new connections, but has not crashed.  This exploit can also happen if you remove the players entity, which shouldn't happen under normal circumstances.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin]&lt;br /&gt;
&lt;br /&gt;
== A2C_PRINT Spam ==&lt;br /&gt;
SRCDS does not do any sort of authentication on A2C_PRINT messages.  This means that anyone can print messages to the servers console, simply by sending UDP packets.  It seems this is a legacy feature, and is not actually used by anything. Valve has been notified, and doesn't see this as a problem.&lt;br /&gt;
&lt;br /&gt;
*Fix: Block any packets beginning with \xFF\xFF\xFF\xFF\x6C or run [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 this plugin]&lt;br /&gt;
&lt;br /&gt;
== A2S_INFO Spam ==&lt;br /&gt;
If large numbers of A2S_INFO packets are sent at the server, the FPS will severely drop, making the server essentially unplayable.  Since these packets can be spoofed, rate limiting one IP is fairly useless&lt;br /&gt;
&lt;br /&gt;
*Fix: You can use sv_max_queries_sec_global to limit this, though that would mean your server would be invisible on the master server list while the attacks are in progress.  [https://forums.alliedmods.net/showthread.php?t=114787 This SM extension] will also work.&lt;br /&gt;
*'''Fixed in:''' TF2 (partial fix) (August 13, 2009)&lt;br /&gt;
&lt;br /&gt;
== Teleport exploit ==&lt;br /&gt;
If you use very large values for your mouse sensitivity, you can overwrite your X and Y coordinates, letting you teleport around.  This has the potential to crash the server as well.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] has a partial fix for this.&lt;br /&gt;
*'''Fixed in:''' TF2 (July 14 2009)&lt;br /&gt;
&lt;br /&gt;
== Clientside plugins ==&lt;br /&gt;
The VSP interface built into the game can be used to load plugins on the game client, allowing them to change cheat-flagged cvars.  This can allow them to have wallhacks, or alter weapon recharge rates.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] has a partial fix for this.&lt;br /&gt;
&lt;br /&gt;
== Command spam ==&lt;br /&gt;
Various commands built into the game can be spammed to lag or crash the server.  The fix for most of these is quite simple, just disable them by adding the cheats flag. Valve has been notified, and fixes commands in the occasional patch.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=779851 this pluin] can be used to kick players who have been caught spamming, [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] adds the cheats flag to most of the known commands.  [http://forums.alliedmods.net/showthread.php?p=880328 my other plugin] will disable all commands except for those on a whitelist, which is the &amp;quot;better&amp;quot; way to fix this, but can break other addons.&lt;br /&gt;
&lt;br /&gt;
== Empty name / unconnected ==&lt;br /&gt;
Players can set their name to an empty string using the setinfo console command.  Some admin plugins will be unable to kick or perform other actions on them.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] will automatically kick anyone found to have an empty name&lt;br /&gt;
&lt;br /&gt;
== Bell characters in name ==&lt;br /&gt;
If your name contains bell characters, this can be used to lag the server on windows.&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] will kick players with these characters in their name.&lt;br /&gt;
&lt;br /&gt;
== ent_fire server takeover ==&lt;br /&gt;
If cheats are enabled on a server, the point_servercommand entity can be created, which can be used by clients to execute rcon commands on the server.  Premade scripts exist for this that will change the rcon password, and add the client as an admin.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] will prevent the rcon password from being changed, as well as disallowing the point_servercommand entity.  The alternative is to not run with sv_cheats 1, and take other measures to ensure it is never enabled.&lt;br /&gt;
&lt;br /&gt;
== Force fullupdate ==&lt;br /&gt;
If you send an empty packet to the server, you can force it to send you the full state of the game, which will lag the server if done enough.  Valve has been notified, and is unwilling to fix this.&lt;br /&gt;
&lt;br /&gt;
*Fix: [http://www.sourceop.com/modules.php?name=Downloads&amp;amp;d_op=viewdownload&amp;amp;cid=9 this plugin] has a partial workaround&lt;br /&gt;
&lt;br /&gt;
== Plugin Exploits ==&lt;br /&gt;
=== Mani nextmap/timeleft spam ===&lt;br /&gt;
The &amp;quot;nextmap&amp;quot; and &amp;quot;timeleft&amp;quot; commands in Mani can be spammed to lag/crash the server.&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] will disable these commands.&lt;br /&gt;
&lt;br /&gt;
=== Eventscripts changelevel exploit ===&lt;br /&gt;
The &amp;quot;changelevel&amp;quot; command can be abused when Eventscripts is running to execute commands on the server&lt;br /&gt;
&lt;br /&gt;
*Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] will prevent this.&lt;br /&gt;
&lt;br /&gt;
= Fixed Exploits = &lt;br /&gt;
== Memory corruption crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefraghof-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: none&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Arbitrary file upload ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourceupfile-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=905647#post905647 this plugin]&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== &amp;quot;ProcessClientInfo: SourceTV can not connect to game directly&amp;quot; crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcenotvnull-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: Add &amp;quot;tv_enable 1&amp;quot; to cfg/autoexec.cfg, and (optionally) &amp;quot;tv_enable 0&amp;quot; to server.cfg (You only need tv_enable 0 if you don't want sourcetv)&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;br /&gt;
&lt;br /&gt;
== Player disconnect crash ==&lt;br /&gt;
See [http://aluigi.altervista.org/adv/sourcefs-adv.txt this link]&lt;br /&gt;
&lt;br /&gt;
Fix: [https://forums.alliedmods.net/showthread.php?p=841590 my plugin] has what may be a partial fix.  I can't really make any promises though.&lt;br /&gt;
*'''Fixed in:''' Orangebox, L4D (August 21 2009) CSS (August 25 2009)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7518</id>
		<title>SRCDS Hardening</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=SRCDS_Hardening&amp;diff=7518"/>
		<updated>2010-02-17T06:19:09Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: Created page with 'SRCDS by itself is vulnerable to a number of exploits. This page will eventually host a list of all known exploits and solutions.'&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;SRCDS by itself is vulnerable to a number of exploits. This page will eventually host a list of all known exploits and solutions.&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7485</id>
		<title>Vice keys</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Vice_keys&amp;diff=7485"/>
		<updated>2010-01-09T19:45:02Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: Created page with '{| | Game | Key |- | Dystopia | pH3apO8w |-  | Insurgency | DrA5e3EB |- | TF2 (items.ctx) | A5fSXbf7 |-  | TF2 (everything else) | E2NcUkG2 |}'&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{|&lt;br /&gt;
| Game&lt;br /&gt;
| Key&lt;br /&gt;
|-&lt;br /&gt;
| Dystopia&lt;br /&gt;
| pH3apO8w&lt;br /&gt;
|- &lt;br /&gt;
| Insurgency&lt;br /&gt;
| DrA5e3EB&lt;br /&gt;
|-&lt;br /&gt;
| TF2 (items.ctx)&lt;br /&gt;
| A5fSXbf7&lt;br /&gt;
|- &lt;br /&gt;
| TF2 (everything else)&lt;br /&gt;
| E2NcUkG2&lt;br /&gt;
|}&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Category:SourceMod_Scripting&amp;diff=7484</id>
		<title>Category:SourceMod Scripting</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Category:SourceMod_Scripting&amp;diff=7484"/>
		<updated>2010-01-09T19:40:40Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Resources */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This category contains articles about scripting for SourceMod with SourcePawn.&lt;br /&gt;
&lt;br /&gt;
===Introductions===&lt;br /&gt;
*[[Introduction to SourcePawn]] - Learning language syntax.&lt;br /&gt;
*[[Introduction to SourceMod Plugins]] - Writing your &amp;quot;first plugin.&amp;quot;&lt;br /&gt;
*[http://docs.sourcemod.net/api API Reference] - Searchable scripting API reference.&lt;br /&gt;
&lt;br /&gt;
===Basic API===&lt;br /&gt;
*[[AutoConfigs (SourceMod Scripting)|AutoConfigs]] - Automatic .cfg creation for cvars.&lt;br /&gt;
*[[Commands (SourceMod Scripting)|Commands]] - Console commands/input.&lt;br /&gt;
*[[ConVars (SourceMod Scripting)|ConVars]] - Console variables (cvars).&lt;br /&gt;
*[[Events (SourceMod Scripting)|Events]] - Half-Life 2 Game Events.&lt;br /&gt;
*[[KeyValues (SourceMod Scripting)|KeyValues]] - KeyValues file parsing/writing.&lt;br /&gt;
*[[Menu API (SourceMod)|Menus]] - Building and drawing menus.&lt;br /&gt;
*[[SQL (SourceMod Scripting)|SQL]] - Using databases (MySQL, SQLite).&lt;br /&gt;
*[[Timers (SourceMod Scripting)|Timers]] - Timed callbacks.&lt;br /&gt;
*[[Translations (SourceMod Scripting)|Translations]] - Internationalization.&lt;br /&gt;
*[[Entity References (SourceMod)|Entity References]] - A safe way of storing entities.&lt;br /&gt;
&lt;br /&gt;
===Advanced API===&lt;br /&gt;
*[[Admin API (SourceMod)|Administration API]] - Using the Admin Cache.&lt;br /&gt;
*[[Admin Menu (SourceMod Scripting)|Admin Menu API]] - Attaching to the Admin Menu.&lt;br /&gt;
*[[Creating Natives (SourceMod Scripting)|Creating Natives]] - Exposing API to other plugins.&lt;br /&gt;
*[[Function Calling API (SourceMod Scripting)|Function Calling API]] - Calling external functions.&lt;br /&gt;
*[[Optional Requirements (SourceMod Scripting)|Optional Requirements]] - Managing dependencies.&lt;br /&gt;
*[[SDKTools (SourceMod Scripting)|SDKTools]] - Using the powerful SDK abstraction layer.&lt;br /&gt;
*[[TempEnts (SourceMod SDKTools)|Temporary Entities]] - Using temporary entities.&lt;br /&gt;
&lt;br /&gt;
===Information===&lt;br /&gt;
*[[Format Class Functions (SourceMod Scripting)|Format Class Functions]] - All about text formatting.&lt;br /&gt;
*[[Handles (SourceMod Scripting)|Handles]] - Overview of Handles and some common types.&lt;br /&gt;
*[[Optimizing Plugins (SourceMod Scripting)|Optimizing Plugins]] - Optimization hints.&lt;br /&gt;
*[[Tags (Scripting)|Tags]] - All about tags.&lt;br /&gt;
*[[Vectors Explained (Scripting)|Vectors Explained]] - Explanation of Vector types.&lt;br /&gt;
&lt;br /&gt;
===Resources===&lt;br /&gt;
*[http://docs.sourcemod.net/api API Reference] - Searchable scripting API reference.&lt;br /&gt;
*[[Entity Properties]] - Explanation of Source entity properties.&lt;br /&gt;
*[[Game Events (Source)|Game Events]] - Game events listings for popular mods.&lt;br /&gt;
*[[Mod TempEnt List (Source)|Temp Entity Lists]] - Temporary entities for popular mods.&lt;br /&gt;
*[[SourceMod Profiler]] - Performance tracking and optimizing.&lt;br /&gt;
*[[Vice_keys]] - Decryption keys for ctx files&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod]]&lt;br /&gt;
[[Category:SourceMod Development]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7443</id>
		<title>Format Class Functions (SourceMod Scripting)</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7443"/>
		<updated>2009-11-18T04:58:38Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Making your function Format-Class */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Introduction=&lt;br /&gt;
Format-class functions are variable argument functions in [[SourceMod]] which allow you to format a string.  A simple example of this is the &amp;lt;tt&amp;gt;Format()&amp;lt;/tt&amp;gt; function, which looks like:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;decl String:buffer[512];&lt;br /&gt;
Format(buffer, sizeof(buffer), &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
If userName contains &amp;quot;&amp;lt;tt&amp;gt;Mark&amp;lt;/tt&amp;gt;,&amp;quot; the contents of &amp;lt;tt&amp;gt;buffer&amp;lt;/tt&amp;gt; will then be: &amp;quot;&amp;lt;tt&amp;gt;Your name is: Mark&amp;lt;/tt&amp;gt;.&amp;quot;  The prototype of these functions almost always contains the following parameters:&lt;br /&gt;
&amp;lt;pawn&amp;gt;const String:fmt[], {Handle,Float,_}:...&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
For example, observe the following two natives:&lt;br /&gt;
&amp;lt;pawn&amp;gt;native Format(String:buffer[], maxlength, const String:fmt[], {Handle,Float,_}:...);&lt;br /&gt;
native PrintToClient(client, String:fmt[], {Handle,Float,_}:...);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Thus, &amp;lt;tt&amp;gt;PrintToClient&amp;lt;/tt&amp;gt; is a format-class function.  It can be used exactly as shown earlier:&lt;br /&gt;
&amp;lt;pawn&amp;gt;PrintToClient(client, &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Format Specifiers=&lt;br /&gt;
A format specifier is a code that allows you to specify what data-type to print.  The most common specifiers are:&lt;br /&gt;
*'''Numerical'''&lt;br /&gt;
**'''d''' or '''i''': Integer number as decimal&lt;br /&gt;
**'''b''': Binary digits in the value&lt;br /&gt;
**'''f''': Floating-point number&lt;br /&gt;
**'''x''' or '''X''': Hexadecimal representation of the binary value (capitalization affects hex letter casing)&lt;br /&gt;
*'''Character(s)'''&lt;br /&gt;
**'''s''': String&lt;br /&gt;
**'''t''' or '''T''': Translates a phrase (explained in [[Translations (SourceMod_Scripting)#Usage_in_a_Plugin|Translations]])&lt;br /&gt;
**'''c''': Prints one character (UTF-8 compliant)&lt;br /&gt;
*'''Special'''&lt;br /&gt;
**'''L''': Requires a client index; expands to 1&amp;lt;2&amp;gt;&amp;lt;3&amp;gt;&amp;lt;&amp;gt; where 1 is the player's name, 2 is the player's userid, and 3 is the player's Steam ID.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;&amp;lt;nowiki&amp;gt;Console&amp;lt;0&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;/nowiki&amp;gt;&amp;lt;/tt&amp;gt;&lt;br /&gt;
**'''N''': Requires a client index; expands to a string containing the player's name.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;Console&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Usage=&lt;br /&gt;
Format specifiers are denoted with a &amp;lt;tt&amp;gt;'%s'&amp;lt;/tt&amp;gt; symbol.  For example, to print a float, a number, and a string, you might use this code:&lt;br /&gt;
&amp;lt;pawn&amp;gt;new Float:fNum = 5.0;&lt;br /&gt;
new iNum = 5&lt;br /&gt;
new String:str[] = &amp;quot;5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
PrintToClient(client, &amp;quot;Number: %d Float: %f String: %s&amp;quot;, iNum, fNum, str);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Note''': Using the wrong data type with a specifier can be very dangerous.  Always make sure you are printing as the right type.  For example, specifying a string and passing a number can crash the server.&lt;br /&gt;
&lt;br /&gt;
=Advanced Formatting=&lt;br /&gt;
Format specifiers have an extended syntax for controlling various aspects of how data is printed.  The full syntax is:&lt;br /&gt;
&amp;lt;tt&amp;gt;%[flags][width][.precision]specifier&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Each bracketed section is an optional extension.  Explanations of supported SourceMod format extensions:&lt;br /&gt;
*'''%''': Obviously, this is always required.&lt;br /&gt;
*'''flags''':&lt;br /&gt;
**'''-''': Left-justify (right-justify is set by default)&lt;br /&gt;
**'''0''': Pads with 0s instead of spaces when needed (see '''width''' below).&lt;br /&gt;
*'''width''': Minimum number of characters to be printed. If the value to be printed is shorter than this number, the result is padded with blank spaces. The value is not truncated even if the result is larger.&lt;br /&gt;
*'''precision''': &lt;br /&gt;
**'''For integers''': specifies the minimum number of digits to print (or pad with spaces/zeroes if below the minimum).  &lt;br /&gt;
**'''For strings''': specifies the maximum number of characters to print.&lt;br /&gt;
**'''For floats''': specifies the number of digits to be printed ''after the decimal point''.&lt;br /&gt;
**'''For all other types''': no effect.&lt;br /&gt;
*'''specifier''': character specifying the data type (always required).&lt;br /&gt;
&lt;br /&gt;
todo: examples&lt;br /&gt;
&lt;br /&gt;
For more information, see [http://www.cplusplus.com/reference/clibrary/cstdio/printf.html printf] from the C Standard Library, although not all modes are supported from C.&lt;br /&gt;
&lt;br /&gt;
=Making your function Format-Class=&lt;br /&gt;
&lt;br /&gt;
Sourcemod allows you to make your function Format-class, ie. pass parameters to format string variables.&lt;br /&gt;
Here's an example :&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;public formatExample(const String:myString[] , any:...)&lt;br /&gt;
{&lt;br /&gt;
	new String:myFormattedString[strlen(myString)+255];&lt;br /&gt;
	VFormat(myFormattedString, sizeof(myFormattedString), myString, 2);&lt;br /&gt;
	&lt;br /&gt;
	PrintToServer(myFormattedString);&lt;br /&gt;
}&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Using the parameter &amp;quot;any: ...&amp;quot;, we can pass data(s) to format our string.&lt;br /&gt;
Now, in order to replace the Format Specifiers by our data(s), we use the API &amp;quot;VFormat&amp;quot;, which documentation can be found here : [http://docs.sourcemod.net/api/].&lt;br /&gt;
&lt;br /&gt;
The three first parameters passed in VFormat are pretty obvious since they are the as in the Format(..) API.&lt;br /&gt;
&lt;br /&gt;
The 4th parameter indicate the &amp;quot;any: ...&amp;quot; parameter position in your function prototype.&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod Scripting]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7442</id>
		<title>Format Class Functions (SourceMod Scripting)</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7442"/>
		<updated>2009-11-18T04:58:23Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Making your function Format-Class */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Introduction=&lt;br /&gt;
Format-class functions are variable argument functions in [[SourceMod]] which allow you to format a string.  A simple example of this is the &amp;lt;tt&amp;gt;Format()&amp;lt;/tt&amp;gt; function, which looks like:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;decl String:buffer[512];&lt;br /&gt;
Format(buffer, sizeof(buffer), &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
If userName contains &amp;quot;&amp;lt;tt&amp;gt;Mark&amp;lt;/tt&amp;gt;,&amp;quot; the contents of &amp;lt;tt&amp;gt;buffer&amp;lt;/tt&amp;gt; will then be: &amp;quot;&amp;lt;tt&amp;gt;Your name is: Mark&amp;lt;/tt&amp;gt;.&amp;quot;  The prototype of these functions almost always contains the following parameters:&lt;br /&gt;
&amp;lt;pawn&amp;gt;const String:fmt[], {Handle,Float,_}:...&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
For example, observe the following two natives:&lt;br /&gt;
&amp;lt;pawn&amp;gt;native Format(String:buffer[], maxlength, const String:fmt[], {Handle,Float,_}:...);&lt;br /&gt;
native PrintToClient(client, String:fmt[], {Handle,Float,_}:...);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Thus, &amp;lt;tt&amp;gt;PrintToClient&amp;lt;/tt&amp;gt; is a format-class function.  It can be used exactly as shown earlier:&lt;br /&gt;
&amp;lt;pawn&amp;gt;PrintToClient(client, &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Format Specifiers=&lt;br /&gt;
A format specifier is a code that allows you to specify what data-type to print.  The most common specifiers are:&lt;br /&gt;
*'''Numerical'''&lt;br /&gt;
**'''d''' or '''i''': Integer number as decimal&lt;br /&gt;
**'''b''': Binary digits in the value&lt;br /&gt;
**'''f''': Floating-point number&lt;br /&gt;
**'''x''' or '''X''': Hexadecimal representation of the binary value (capitalization affects hex letter casing)&lt;br /&gt;
*'''Character(s)'''&lt;br /&gt;
**'''s''': String&lt;br /&gt;
**'''t''' or '''T''': Translates a phrase (explained in [[Translations (SourceMod_Scripting)#Usage_in_a_Plugin|Translations]])&lt;br /&gt;
**'''c''': Prints one character (UTF-8 compliant)&lt;br /&gt;
*'''Special'''&lt;br /&gt;
**'''L''': Requires a client index; expands to 1&amp;lt;2&amp;gt;&amp;lt;3&amp;gt;&amp;lt;&amp;gt; where 1 is the player's name, 2 is the player's userid, and 3 is the player's Steam ID.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;&amp;lt;nowiki&amp;gt;Console&amp;lt;0&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;/nowiki&amp;gt;&amp;lt;/tt&amp;gt;&lt;br /&gt;
**'''N''': Requires a client index; expands to a string containing the player's name.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;Console&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Usage=&lt;br /&gt;
Format specifiers are denoted with a &amp;lt;tt&amp;gt;'%s'&amp;lt;/tt&amp;gt; symbol.  For example, to print a float, a number, and a string, you might use this code:&lt;br /&gt;
&amp;lt;pawn&amp;gt;new Float:fNum = 5.0;&lt;br /&gt;
new iNum = 5&lt;br /&gt;
new String:str[] = &amp;quot;5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
PrintToClient(client, &amp;quot;Number: %d Float: %f String: %s&amp;quot;, iNum, fNum, str);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Note''': Using the wrong data type with a specifier can be very dangerous.  Always make sure you are printing as the right type.  For example, specifying a string and passing a number can crash the server.&lt;br /&gt;
&lt;br /&gt;
=Advanced Formatting=&lt;br /&gt;
Format specifiers have an extended syntax for controlling various aspects of how data is printed.  The full syntax is:&lt;br /&gt;
&amp;lt;tt&amp;gt;%[flags][width][.precision]specifier&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Each bracketed section is an optional extension.  Explanations of supported SourceMod format extensions:&lt;br /&gt;
*'''%''': Obviously, this is always required.&lt;br /&gt;
*'''flags''':&lt;br /&gt;
**'''-''': Left-justify (right-justify is set by default)&lt;br /&gt;
**'''0''': Pads with 0s instead of spaces when needed (see '''width''' below).&lt;br /&gt;
*'''width''': Minimum number of characters to be printed. If the value to be printed is shorter than this number, the result is padded with blank spaces. The value is not truncated even if the result is larger.&lt;br /&gt;
*'''precision''': &lt;br /&gt;
**'''For integers''': specifies the minimum number of digits to print (or pad with spaces/zeroes if below the minimum).  &lt;br /&gt;
**'''For strings''': specifies the maximum number of characters to print.&lt;br /&gt;
**'''For floats''': specifies the number of digits to be printed ''after the decimal point''.&lt;br /&gt;
**'''For all other types''': no effect.&lt;br /&gt;
*'''specifier''': character specifying the data type (always required).&lt;br /&gt;
&lt;br /&gt;
todo: examples&lt;br /&gt;
&lt;br /&gt;
For more information, see [http://www.cplusplus.com/reference/clibrary/cstdio/printf.html printf] from the C Standard Library, although not all modes are supported from C.&lt;br /&gt;
&lt;br /&gt;
=Making your function Format-Class=&lt;br /&gt;
&lt;br /&gt;
Sourcemod allows you to make your function Format-class, ie. pass parameters to format string variables.&lt;br /&gt;
Here's an exemple :&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;public formatExample(const String:myString[] , any:...)&lt;br /&gt;
{&lt;br /&gt;
	new String:myFormattedString[strlen(myString)+255];&lt;br /&gt;
	VFormat(myFormattedString, sizeof(myFormattedString), myString, 2);&lt;br /&gt;
	&lt;br /&gt;
	PrintToServer(myFormattedString);&lt;br /&gt;
}&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Using the parameter &amp;quot;any: ...&amp;quot;, we can pass data(s) to format our string.&lt;br /&gt;
Now, in order to replace the Format Specifiers by our data(s), we use the API &amp;quot;VFormat&amp;quot;, which documentation can be found here : [http://docs.sourcemod.net/api/].&lt;br /&gt;
&lt;br /&gt;
The three first parameters passed in VFormat are pretty obvious since they are the as in the Format(..) API.&lt;br /&gt;
&lt;br /&gt;
The 4th parameter indicate the &amp;quot;any: ...&amp;quot; parameter position in your function prototype.&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod Scripting]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7441</id>
		<title>Format Class Functions (SourceMod Scripting)</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Format_Class_Functions_(SourceMod_Scripting)&amp;diff=7441"/>
		<updated>2009-11-18T04:57:53Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Introduction=&lt;br /&gt;
Format-class functions are variable argument functions in [[SourceMod]] which allow you to format a string.  A simple example of this is the &amp;lt;tt&amp;gt;Format()&amp;lt;/tt&amp;gt; function, which looks like:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;decl String:buffer[512];&lt;br /&gt;
Format(buffer, sizeof(buffer), &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
If userName contains &amp;quot;&amp;lt;tt&amp;gt;Mark&amp;lt;/tt&amp;gt;,&amp;quot; the contents of &amp;lt;tt&amp;gt;buffer&amp;lt;/tt&amp;gt; will then be: &amp;quot;&amp;lt;tt&amp;gt;Your name is: Mark&amp;lt;/tt&amp;gt;.&amp;quot;  The prototype of these functions almost always contains the following parameters:&lt;br /&gt;
&amp;lt;pawn&amp;gt;const String:fmt[], {Handle,Float,_}:...&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
For example, observe the following two natives:&lt;br /&gt;
&amp;lt;pawn&amp;gt;native Format(String:buffer[], maxlength, const String:fmt[], {Handle,Float,_}:...);&lt;br /&gt;
native PrintToClient(client, String:fmt[], {Handle,Float,_}:...);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Thus, &amp;lt;tt&amp;gt;PrintToClient&amp;lt;/tt&amp;gt; is a format-class function.  It can be used exactly as shown earlier:&lt;br /&gt;
&amp;lt;pawn&amp;gt;PrintToClient(client, &amp;quot;Your name is: %s&amp;quot;, userName);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Format Specifiers=&lt;br /&gt;
A format specifier is a code that allows you to specify what data-type to print.  The most common specifiers are:&lt;br /&gt;
*'''Numerical'''&lt;br /&gt;
**'''d''' or '''i''': Integer number as decimal&lt;br /&gt;
**'''b''': Binary digits in the value&lt;br /&gt;
**'''f''': Floating-point number&lt;br /&gt;
**'''x''' or '''X''': Hexadecimal representation of the binary value (capitalization affects hex letter casing)&lt;br /&gt;
*'''Character(s)'''&lt;br /&gt;
**'''s''': String&lt;br /&gt;
**'''t''' or '''T''': Translates a phrase (explained in [[Translations (SourceMod_Scripting)#Usage_in_a_Plugin|Translations]])&lt;br /&gt;
**'''c''': Prints one character (UTF-8 compliant)&lt;br /&gt;
*'''Special'''&lt;br /&gt;
**'''L''': Requires a client index; expands to 1&amp;lt;2&amp;gt;&amp;lt;3&amp;gt;&amp;lt;&amp;gt; where 1 is the player's name, 2 is the player's userid, and 3 is the player's Steam ID.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;&amp;lt;nowiki&amp;gt;Console&amp;lt;0&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;Console&amp;gt;&amp;lt;/nowiki&amp;gt;&amp;lt;/tt&amp;gt;&lt;br /&gt;
**'''N''': Requires a client index; expands to a string containing the player's name.  If the client index is 0, the string will be: &amp;lt;tt&amp;gt;Console&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Usage=&lt;br /&gt;
Format specifiers are denoted with a &amp;lt;tt&amp;gt;'%s'&amp;lt;/tt&amp;gt; symbol.  For example, to print a float, a number, and a string, you might use this code:&lt;br /&gt;
&amp;lt;pawn&amp;gt;new Float:fNum = 5.0;&lt;br /&gt;
new iNum = 5&lt;br /&gt;
new String:str[] = &amp;quot;5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
PrintToClient(client, &amp;quot;Number: %d Float: %f String: %s&amp;quot;, iNum, fNum, str);&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Note''': Using the wrong data type with a specifier can be very dangerous.  Always make sure you are printing as the right type.  For example, specifying a string and passing a number can crash the server.&lt;br /&gt;
&lt;br /&gt;
=Advanced Formatting=&lt;br /&gt;
Format specifiers have an extended syntax for controlling various aspects of how data is printed.  The full syntax is:&lt;br /&gt;
&amp;lt;tt&amp;gt;%[flags][width][.precision]specifier&amp;lt;/tt&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Each bracketed section is an optional extension.  Explanations of supported SourceMod format extensions:&lt;br /&gt;
*'''%''': Obviously, this is always required.&lt;br /&gt;
*'''flags''':&lt;br /&gt;
**'''-''': Left-justify (right-justify is set by default)&lt;br /&gt;
**'''0''': Pads with 0s instead of spaces when needed (see '''width''' below).&lt;br /&gt;
*'''width''': Minimum number of characters to be printed. If the value to be printed is shorter than this number, the result is padded with blank spaces. The value is not truncated even if the result is larger.&lt;br /&gt;
*'''precision''': &lt;br /&gt;
**'''For integers''': specifies the minimum number of digits to print (or pad with spaces/zeroes if below the minimum).  &lt;br /&gt;
**'''For strings''': specifies the maximum number of characters to print.&lt;br /&gt;
**'''For floats''': specifies the number of digits to be printed ''after the decimal point''.&lt;br /&gt;
**'''For all other types''': no effect.&lt;br /&gt;
*'''specifier''': character specifying the data type (always required).&lt;br /&gt;
&lt;br /&gt;
todo: examples&lt;br /&gt;
&lt;br /&gt;
For more information, see [http://www.cplusplus.com/reference/clibrary/cstdio/printf.html printf] from the C Standard Library, although not all modes are supported from C.&lt;br /&gt;
&lt;br /&gt;
=Making your function Format-Class=&lt;br /&gt;
&lt;br /&gt;
Sourcemod allows you to make your function Format-class, ie. pass parameters to format string variables.&lt;br /&gt;
Here's an exemple :&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pawn&amp;gt;public formatExemple(const String:myString[] , any:...)&lt;br /&gt;
{&lt;br /&gt;
	new String:myFormatedString[strlen(myString)+255];&lt;br /&gt;
	VFormat(myFormatedString, sizeof(myFormatedString), myString, 2);&lt;br /&gt;
	&lt;br /&gt;
	PrintToServer(myFormatedString);&lt;br /&gt;
}&amp;lt;/pawn&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Using the parameter &amp;quot;any: ...&amp;quot;, we can pass data(s) to format our string.&lt;br /&gt;
Now, in order to replace the Format Specifiers by our data(s), we use the API &amp;quot;VFormat&amp;quot;, which documentation can be found here : [http://docs.sourcemod.net/api/].&lt;br /&gt;
&lt;br /&gt;
The three first parameters passed in VFormat are pretty obvious since they are the as in the Format(..) API.&lt;br /&gt;
&lt;br /&gt;
The 4th parameter indicate the &amp;quot;any: ...&amp;quot; parameter position in your function prototype.&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod Scripting]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Packaging_Plugins_(SourceMod)&amp;diff=6938</id>
		<title>Packaging Plugins (SourceMod)</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Packaging_Plugins_(SourceMod)&amp;diff=6938"/>
		<updated>2009-02-24T21:29:00Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Any plugins requiring supporting files would need to include a zip (NOT rar, tar.gz, etc) file containing these.  This zip file should be based on the mods root directory, so that if you were to extract it to the &amp;quot;cstrike&amp;quot; directory on a server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
The sp file of your plugin should still be attached directly to the post.  It should not go in this zip file.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cfg/sourcemod/myconfig.cfg&lt;br /&gt;
addons/sourcemod/configs/admin_myadmin.cfg&lt;br /&gt;
addons/sourcemod/gamedata/obscuregame.gamedata.txt&lt;br /&gt;
addons/sourcemod/translations/myplugin.phrases.txt&lt;br /&gt;
models/player/someplayer.vdf&lt;br /&gt;
maps/somemap.bsp&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An example of what NOT to do (DON'T DO THIS):&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cstrike/cfg/sourcemod/myconfig.cfg&lt;br /&gt;
cstrike/maps/mymap.bsp&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod Development]]&lt;br /&gt;
[[Category:SourceMod Scripting]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Packaging_Plugins_(SourceMod)&amp;diff=6937</id>
		<title>Packaging Plugins (SourceMod)</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Packaging_Plugins_(SourceMod)&amp;diff=6937"/>
		<updated>2009-02-24T20:48:14Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: New page: Any plugins requiring supporting files would need to include a zip (NOT rar, tar.gz, etc) file containing these.  This zip file should be based on the mods root directory, so that if you w...&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Any plugins requiring supporting files would need to include a zip (NOT rar, tar.gz, etc) file containing these.  This zip file should be based on the mods root directory, so that if you were to extract it to the &amp;quot;cstrike&amp;quot; directory on a server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cfg/sourcemod/myconfig.cfg&lt;br /&gt;
addons/sourcemod/configs/admin_myadmin.cfg&lt;br /&gt;
addons/sourcemod/gamedata/obscuregame.gamedata.txt&lt;br /&gt;
addons/sourcemod/translations/myplugin.phrases.txt&lt;br /&gt;
models/player/someplayer.vdf&lt;br /&gt;
maps/somemap.bsp&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An example of what NOT to do (DON'T DO THIS):&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cstrike/cfg/sourcemod/myconfig.cfg&lt;br /&gt;
cstrike/maps/mymap.bsp&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[[Category:SourceMod Development]]&lt;br /&gt;
[[Category:SourceMod Scripting]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6936</id>
		<title>User talk:Devicenull</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6936"/>
		<updated>2009-02-24T20:41:05Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Standard Zip format ==&lt;br /&gt;
Any plugins requiring supporting files would need to upload a zip file containing them.  This zip file should be based on the mods root directory, so that if you were to extract it to the &amp;quot;cstrike&amp;quot; on a server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cfg/sourcemod/myconfig.cfg&lt;br /&gt;
addons/sourcemod/configs/admin_myadmin.cfg&lt;br /&gt;
addons/sourcemod/gamedata/obscuregame.gamedata.txt&lt;br /&gt;
addons/sourcemod/translations/myplugin.phrases.txt&lt;br /&gt;
models/player/someplayer.vdf&lt;br /&gt;
maps/somemap.bsp&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6935</id>
		<title>User talk:Devicenull</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6935"/>
		<updated>2009-02-24T20:09:35Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Standard Zip format ==&lt;br /&gt;
Any plugins requiring supporting files would need to upload a zip file containing them.  This zip file should be based on the sourcemod directory, so that if you were to extract it to the sourcemod directory on the server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
configs/admin_myadmin.cfg&lt;br /&gt;
gamedata/obscuregame.gamedata.txt&lt;br /&gt;
translations/myplugin.phrases.txt&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6934</id>
		<title>User talk:Devicenull</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6934"/>
		<updated>2009-02-24T20:09:19Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Standard Zip format ==&lt;br /&gt;
Any plugins requiring supporting files would need to upload a zip file containing them.  This zip file should be based on the sourcemod directory, so that if you were to extract it to the sourcemod directory on the server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
configs/admin_myadmin.cfg&lt;br /&gt;
gamedata/obscuregame.gamedata.txt&lt;br /&gt;
translations/myplugin/phrases.txt&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6933</id>
		<title>User talk:Devicenull</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=User_talk:Devicenull&amp;diff=6933"/>
		<updated>2009-02-24T20:08:59Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: New page: == Standard Zip format == Any plugins requiring supporting files would need to upload a zip file containing them.  This zip file should be based on the sourcemod directory, so that if you ...&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Standard Zip format ==&lt;br /&gt;
Any plugins requiring supporting files would need to upload a zip file containing them.  This zip file should be based on the sourcemod directory, so that if you were to extract it to the sourcemod directory on the server, everything would go to the correct place.&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&amp;lt;blockquote&amp;gt;&lt;br /&gt;
configs/admin_myadmin.cfg&lt;br /&gt;
gamedata/obscuregame.gamedata.txt&lt;br /&gt;
translations/myplugin/phrases.txt&lt;br /&gt;
&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This zip file should be named the same as your plugins name (IE, if your compiled plugin is &amp;quot;adminfly.smx&amp;quot;, this file should be &amp;quot;adminfly.zip&amp;quot;)&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6500</id>
		<title>Left 4 Voting</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6500"/>
		<updated>2008-11-27T05:47:02Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Example voting plugin */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Left 4 Dead has a new VGUI voting system, it's controlled by a bunch of events.  You can use either a string from the resource file, or L4D_TargetID_Player which will let you create any vote you want.&lt;br /&gt;
&lt;br /&gt;
== How voting works ==&lt;br /&gt;
Server begins by sending a vote_started event, followed by a vote_changed event.  Client's use the &amp;quot;Vote&amp;quot; command to register their votes, after which the server sends a vote_cast_yes or vote_case_no event, along with a vote_changed event.&lt;br /&gt;
&lt;br /&gt;
When the vote is complete, the server sends vote_ended, followed by either vote_passed or vote_failed.  &lt;br /&gt;
&lt;br /&gt;
== Example voting plugin ==&lt;br /&gt;
This is a basic plugin that starts a vote, &amp;quot;Is gaben fat?&amp;quot;.  It does not ensure the same client does not vote multiple times, nor does it actually kick the user.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#include &amp;lt;sourcemod&amp;gt;&lt;br /&gt;
new yesvotes;&lt;br /&gt;
new novotes;&lt;br /&gt;
#define MAX_VOTES 4&lt;br /&gt;
&lt;br /&gt;
public OnPluginStart()&lt;br /&gt;
{&lt;br /&gt;
	RegConsoleCmd(&amp;quot;testvote&amp;quot;,Callvote_Handler);&lt;br /&gt;
	RegConsoleCmd(&amp;quot;Vote&amp;quot;,vote);&lt;br /&gt;
}&lt;br /&gt;
public Action:Callvote_Handler(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_started&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;issue&amp;quot;,&amp;quot;#L4D_TargetID_Player&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;Is gaben fat?&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;initiator&amp;quot;,0);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	yesvotes = 0;&lt;br /&gt;
	novotes = 0;&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	&lt;br /&gt;
	return Plugin_Handled;&lt;br /&gt;
}&lt;br /&gt;
public UpdateVotes()&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_changed&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;yesVotes&amp;quot;,yesvotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;noVotes&amp;quot;,novotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;potentialVotes&amp;quot;,MAX_VOTES);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	if (yesvotes+novotes == MAX_VOTES)&lt;br /&gt;
	{&lt;br /&gt;
		PrintToServer(&amp;quot;voting complete!&amp;quot;);&lt;br /&gt;
		msg = CreateEvent(&amp;quot;vote_ended&amp;quot;);&lt;br /&gt;
		FireEvent(msg);&lt;br /&gt;
		if (yesvotes &amp;gt; novotes)&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_passed&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;details&amp;quot;,&amp;quot;#L4D_TargetID_Player&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;Gaben is fat&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
		else&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_failed&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
public Action:vote(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new String:arg[8];&lt;br /&gt;
	GetCmdArg(1,arg,8);&lt;br /&gt;
	PrintToServer(&amp;quot;Got vote %s from %i&amp;quot;,arg,client);&lt;br /&gt;
	if (strcmp(arg,&amp;quot;Yes&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		yesvotes++;&lt;br /&gt;
	}&lt;br /&gt;
	else if (strcmp(arg,&amp;quot;No&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		novotes++;&lt;br /&gt;
	}&lt;br /&gt;
	&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	return Plugin_Continue;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
See the following images for examples what this looks like:&lt;br /&gt;
&lt;br /&gt;
http://devicenull.org/temp/l4d_question.jpg &lt;br /&gt;
&lt;br /&gt;
http://devicenull.org/temp/l4d_result.jpg&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6499</id>
		<title>Left 4 Voting</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6499"/>
		<updated>2008-11-27T05:40:21Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Left 4 Dead has a new VGUI voting system, it's controlled by a bunch of events.  You can use either a string from the resource file, or L4D_TargetID_Player which will let you create any vote you want.&lt;br /&gt;
&lt;br /&gt;
== How voting works ==&lt;br /&gt;
Server begins by sending a vote_started event, followed by a vote_changed event.  Client's use the &amp;quot;Vote&amp;quot; command to register their votes, after which the server sends a vote_cast_yes or vote_case_no event, along with a vote_changed event.&lt;br /&gt;
&lt;br /&gt;
When the vote is complete, the server sends vote_ended, followed by either vote_passed or vote_failed.  &lt;br /&gt;
&lt;br /&gt;
== Example voting plugin ==&lt;br /&gt;
This is a basic plugin that starts a vote, &amp;quot;Is gaben fat?&amp;quot;.  It does not ensure the same client does not vote multiple times, nor does it actually kick the user.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#include &amp;lt;sourcemod&amp;gt;&lt;br /&gt;
new yesvotes;&lt;br /&gt;
new novotes;&lt;br /&gt;
#define MAX_VOTES 4&lt;br /&gt;
&lt;br /&gt;
public OnPluginStart()&lt;br /&gt;
{&lt;br /&gt;
	RegConsoleCmd(&amp;quot;testvote&amp;quot;,Callvote_Handler);&lt;br /&gt;
	RegConsoleCmd(&amp;quot;Vote&amp;quot;,vote);&lt;br /&gt;
}&lt;br /&gt;
public Action:Callvote_Handler(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_started&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;issue&amp;quot;,&amp;quot;#L4D_TargetID_Player&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;Is gaben fat?&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;initiator&amp;quot;,0);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	yesvotes = 0;&lt;br /&gt;
	novotes = 0;&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	&lt;br /&gt;
	return Plugin_Handled;&lt;br /&gt;
}&lt;br /&gt;
public UpdateVotes()&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_changed&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;yesVotes&amp;quot;,yesvotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;noVotes&amp;quot;,novotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;potentialVotes&amp;quot;,MAX_VOTES);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	if (yesvotes+novotes == MAX_VOTES)&lt;br /&gt;
	{&lt;br /&gt;
		PrintToServer(&amp;quot;voting complete!&amp;quot;);&lt;br /&gt;
		msg = CreateEvent(&amp;quot;vote_ended&amp;quot;);&lt;br /&gt;
		FireEvent(msg);&lt;br /&gt;
		if (yesvotes &amp;gt; novotes)&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_passed&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;details&amp;quot;,&amp;quot;#L4D_TargetID_Player&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;Gaben is fat&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
		else&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_failed&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
public Action:vote(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new String:arg[8];&lt;br /&gt;
	GetCmdArg(1,arg,8);&lt;br /&gt;
	PrintToServer(&amp;quot;Got vote %s from %i&amp;quot;,arg,client);&lt;br /&gt;
	if (strcmp(arg,&amp;quot;Yes&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		yesvotes++;&lt;br /&gt;
	}&lt;br /&gt;
	else if (strcmp(arg,&amp;quot;No&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		novotes++;&lt;br /&gt;
	}&lt;br /&gt;
	&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	return Plugin_Continue;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6498</id>
		<title>Left 4 Voting</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6498"/>
		<updated>2008-11-27T05:31:05Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: /* Example voting plugin */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Left 4 Dead has a new VGUI voting system, it's controlled by a bunch of events.  If you want to use this, you are fairly limited as there's no way of adding your own issues, you are stuck with what's there.  Still, some of the issues allowed in the resource file are not implemented in game.&lt;br /&gt;
&lt;br /&gt;
You can use a question from the left4dead_english.txt file. &lt;br /&gt;
&lt;br /&gt;
== How voting works ==&lt;br /&gt;
Server begins by sending a vote_started event, followed by a vote_changed event.  Client's use the &amp;quot;Vote&amp;quot; command to register their votes, after which the server sends a vote_cast_yes or vote_case_no event, along with a vote_changed event.&lt;br /&gt;
&lt;br /&gt;
When the vote is complete, the server sends vote_ended, followed by either vote_passed or vote_failed.  &lt;br /&gt;
&lt;br /&gt;
== Example voting plugin ==&lt;br /&gt;
This is a basic plugin that handles voting to kick a user named &amp;quot;gaben&amp;quot; from the server.  It does not ensure the same client does not vote multiple times, nor does it actually kick the user.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#include &amp;lt;sourcemod&amp;gt;&lt;br /&gt;
new yesvotes;&lt;br /&gt;
new novotes;&lt;br /&gt;
#define MAX_VOTES 4&lt;br /&gt;
&lt;br /&gt;
public OnPluginStart()&lt;br /&gt;
{&lt;br /&gt;
	RegConsoleCmd(&amp;quot;testvote&amp;quot;,Callvote_Handler);&lt;br /&gt;
	RegConsoleCmd(&amp;quot;Vote&amp;quot;,vote);&lt;br /&gt;
}&lt;br /&gt;
public Action:Callvote_Handler(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_started&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;issue&amp;quot;,&amp;quot;#L4D_vote_kick_player&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;gaben&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;initiator&amp;quot;,0);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	yesvotes = 0;&lt;br /&gt;
	novotes = 0;&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	&lt;br /&gt;
	return Plugin_Handled;&lt;br /&gt;
}&lt;br /&gt;
public UpdateVotes()&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_changed&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;yesVotes&amp;quot;,yesvotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;noVotes&amp;quot;,novotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;potentialVotes&amp;quot;,MAX_VOTES);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	if (yesvotes+novotes == MAX_VOTES)&lt;br /&gt;
	{&lt;br /&gt;
		PrintToServer(&amp;quot;voting complete!&amp;quot;);&lt;br /&gt;
		msg = CreateEvent(&amp;quot;vote_ended&amp;quot;);&lt;br /&gt;
		FireEvent(msg);&lt;br /&gt;
		if (yesvotes &amp;gt; novotes)&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_passed&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;details&amp;quot;,&amp;quot;#L4D_vote_kick_player&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;gaben&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
		else&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_failed&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
public Action:vote(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new String:arg[8];&lt;br /&gt;
	GetCmdArg(1,arg,8);&lt;br /&gt;
	PrintToServer(&amp;quot;Got vote %s from %i&amp;quot;,arg,client);&lt;br /&gt;
	if (strcmp(arg,&amp;quot;Yes&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		yesvotes++;&lt;br /&gt;
	}&lt;br /&gt;
	else if (strcmp(arg,&amp;quot;No&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		novotes++;&lt;br /&gt;
	}&lt;br /&gt;
	&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	return Plugin_Continue;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6497</id>
		<title>Left 4 Voting</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Left_4_Voting&amp;diff=6497"/>
		<updated>2008-11-27T05:30:00Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: New page: Left 4 Dead has a new VGUI voting system, it's controlled by a bunch of events.  If you want to use this, you are fairly limited as there's no way of adding your own issues, you are stuck ...&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Left 4 Dead has a new VGUI voting system, it's controlled by a bunch of events.  If you want to use this, you are fairly limited as there's no way of adding your own issues, you are stuck with what's there.  Still, some of the issues allowed in the resource file are not implemented in game.&lt;br /&gt;
&lt;br /&gt;
You can use a question from the left4dead_english.txt file. &lt;br /&gt;
&lt;br /&gt;
== How voting works ==&lt;br /&gt;
Server begins by sending a vote_started event, followed by a vote_changed event.  Client's use the &amp;quot;Vote&amp;quot; command to register their votes, after which the server sends a vote_cast_yes or vote_case_no event, along with a vote_changed event.&lt;br /&gt;
&lt;br /&gt;
When the vote is complete, the server sends vote_ended, followed by either vote_passed or vote_failed.  &lt;br /&gt;
&lt;br /&gt;
== Example voting plugin ==&lt;br /&gt;
&amp;lt;pre&amp;gt;#include &amp;lt;sourcemod&amp;gt;&lt;br /&gt;
new yesvotes;&lt;br /&gt;
new novotes;&lt;br /&gt;
#define MAX_VOTES 4&lt;br /&gt;
&lt;br /&gt;
public OnPluginStart()&lt;br /&gt;
{&lt;br /&gt;
	RegConsoleCmd(&amp;quot;testvote&amp;quot;,Callvote_Handler);&lt;br /&gt;
	RegConsoleCmd(&amp;quot;Vote&amp;quot;,vote);&lt;br /&gt;
}&lt;br /&gt;
public Action:Callvote_Handler(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_started&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;issue&amp;quot;,&amp;quot;#L4D_vote_kick_player&amp;quot;);&lt;br /&gt;
	SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;gaben&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;initiator&amp;quot;,0);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	yesvotes = 0;&lt;br /&gt;
	novotes = 0;&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	&lt;br /&gt;
	return Plugin_Handled;&lt;br /&gt;
}&lt;br /&gt;
public UpdateVotes()&lt;br /&gt;
{&lt;br /&gt;
	new Handle:msg = CreateEvent(&amp;quot;vote_changed&amp;quot;);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;yesVotes&amp;quot;,yesvotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;noVotes&amp;quot;,novotes);&lt;br /&gt;
	SetEventInt(msg,&amp;quot;potentialVotes&amp;quot;,MAX_VOTES);&lt;br /&gt;
	FireEvent(msg);&lt;br /&gt;
	&lt;br /&gt;
	if (yesvotes+novotes == MAX_VOTES)&lt;br /&gt;
	{&lt;br /&gt;
		PrintToServer(&amp;quot;voting complete!&amp;quot;);&lt;br /&gt;
		msg = CreateEvent(&amp;quot;vote_ended&amp;quot;);&lt;br /&gt;
		FireEvent(msg);&lt;br /&gt;
		if (yesvotes &amp;gt; novotes)&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_passed&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;details&amp;quot;,&amp;quot;#L4D_vote_kick_player&amp;quot;);&lt;br /&gt;
			SetEventString(msg,&amp;quot;param1&amp;quot;,&amp;quot;gaben&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
		else&lt;br /&gt;
		{&lt;br /&gt;
			msg = CreateEvent(&amp;quot;vote_failed&amp;quot;);&lt;br /&gt;
			SetEventInt(msg,&amp;quot;team&amp;quot;,0);&lt;br /&gt;
			FireEvent(msg);&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
public Action:vote(client, args)&lt;br /&gt;
{&lt;br /&gt;
	new String:arg[8];&lt;br /&gt;
	GetCmdArg(1,arg,8);&lt;br /&gt;
	PrintToServer(&amp;quot;Got vote %s from %i&amp;quot;,arg,client);&lt;br /&gt;
	if (strcmp(arg,&amp;quot;Yes&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		yesvotes++;&lt;br /&gt;
	}&lt;br /&gt;
	else if (strcmp(arg,&amp;quot;No&amp;quot;,true) == 0)&lt;br /&gt;
	{&lt;br /&gt;
		novotes++;&lt;br /&gt;
	}&lt;br /&gt;
	&lt;br /&gt;
	UpdateVotes();&lt;br /&gt;
	return Plugin_Continue;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
	<entry>
		<id>https://wiki.alliedmods.net/index.php?title=Open_Source_Plugins_for_Metamod:Source&amp;diff=3049</id>
		<title>Open Source Plugins for Metamod:Source</title>
		<link rel="alternate" type="text/html" href="https://wiki.alliedmods.net/index.php?title=Open_Source_Plugins_for_Metamod:Source&amp;diff=3049"/>
		<updated>2006-06-04T23:04:45Z</updated>

		<summary type="html">&lt;p&gt;Devicenull: Added global banlist&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Open Source Plugins for SourceMM =&lt;br /&gt;
This page lists known plugins with available source code. Please check the licenses for each one as they may not truly be &amp;quot;open source.&amp;quot;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Basic Templates ==&lt;br /&gt;
=== stub_mm ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:BAILOPAN|BAILOPAN]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; minmum implentation of a valid SourceMM plugin&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; starting template&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; Included in the SourceMM source code package: [http://prdownloads.sourceforge.net/sourcemm/sourcemm-1.2.2-source.tar.gz?download prdownloads.sourceforge.net/sourcemm/sourcemm-1.2.2-source.tar.gz?download]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== sample_mm ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:BAILOPAN|BAILOPAN]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; implements the features of the standard Valve server plugin from the SDK&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; starting template with similar functionality to the Valve sample_plugin&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; Included in the SourceMM source code package: [http://prdownloads.sourceforge.net/sourcemm/sourcemm-1.2.2-source.tar.gz?download prdownloads.sourceforge.net/sourcemm/sourcemm-1.2.2-source.tar.gz?download]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== sample2_mm ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:BAILOPAN|BAILOPAN]], edited by [[User:L._Duke|L. Duke]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; fixes (by inheriting from IGameEventListener2 instead of hooking FireGameEvent) the problem in sample_mm plugin where some events are not received&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; starting template with similar functionality to the Valve sample_plugin&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download: &amp;lt;/b&amp;gt;[http://www.sourcemod.net/forums/viewtopic.php?p=34891 www.sourcemod.net/forums/viewtopic.php?p=34891] (you must be logged in to view the download link) &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Functional Plugins ==&lt;br /&gt;
=== Basic Admin Tool (BAT) ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:EKS|EKS]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; Provides basic admin functions&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; Kick, ban, menus, reserved slots, timeleft/nextmap say commands, etc.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?t=2923 www.sourcemod.net/forums/viewtopic.php?t=2923]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== CS:S Weapon Restrictions 2 ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:L._Duke|L. Duke]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; Prevents players from picking up restricted weapons (if bought, they fall to the ground). Also includes an option to remove restricted weapons from the game.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; Hook &amp;lt;i&amp;gt;CCSPlayer::Weapon_CanUse(CBaseCombatWeapon *pWeapon)&amp;lt;/i&amp;gt; and returns false for restricted weapons. Also shows how to use virtual functions on weapons such as Delete()and GetName() and on players for Weapon_GetSlot(int) and Drop(CBaseCombatWeapon*).&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?p=34892 www.sourcemod.net/forums/viewtopic.php?p=34892]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Last Users Connected ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:devicenull|devicenull]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; With this plugin, every player who comes onto your server has their steamid logged, along with any name they used on the server. You can then either view the names/steamid's of the last people to disconnect, or you can search for a name/steamid and see everyone who has used that name. &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; shows how to embed sqlite3, send basic messages/basic hooks. &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?t=3339 http://www.sourcemod.net/forums/viewtopic.php?t=3339]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Stripper:Source ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:BAILOPAN|BAILOPAN]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt;  You can add any type of entity - hostage, spawn point, physics prop, permanently to the map. You can also filter out entities for deletion, either by specific entries or regular expressions. Stripper:Source lets you define global rules and per-map rules. It also lets other plugins (both SourceMM plugins and Server Plugins) use its API. &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; shows how to edit the map entity lump in memory to change map entities&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?t=3008 www.sourcemod.net/forums/viewtopic.php?t=3008]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Global Banlist===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:devicenull|devicenull]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; This plugin allows srcds to reguarly connect to an external PHP page, and download updates about it's banlist.  Srcds then stores these in a SQLite database. &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; Embedding sqlite, using pthreads, using libcurl.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?t=3539]http://www.sourcemod.net/forums/viewtopic.php?t=3539]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Anti-Griefer ===&lt;br /&gt;
&amp;lt;b&amp;gt;Author:&amp;lt;/b&amp;gt; [[User:devicenull|devicenull]]&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Description:&amp;lt;/b&amp;gt; This plugin is for the mod SourceForts.  In keeps track of what player unfreezes or freezes a block, and allows any other player to retrieve this information by aiming at a block.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Features:&amp;lt;/b&amp;gt; Basic VFuncs, listening for events, partial traceline (The method used for traceline might not be effective for any other mod)&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;b&amp;gt;Download:&amp;lt;/b&amp;gt; [http://www.sourcemod.net/forums/viewtopic.php?t=3652]http://www.sourcemod.net/forums/viewtopic.php?t=3652]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Category:Documentation (SourceMM)]]&lt;/div&gt;</summary>
		<author><name>Devicenull</name></author>
		
	</entry>
</feed>