Secure the server

The calm security plan#

Security is mostly a short list of repeatable habits: verify player identities, expose only the game connection, give fewer people administrative power, update deliberately and keep restorable backups.

Safe identity defaults#

Keep these values in server.properties:

online-mode=true
white-list=true
enforce-whitelist=true
enable-rcon=false

online-mode=true asks Minecraft’s authentication services to verify player identities. Offline/cracked mode weakens identity protection: someone may impersonate a whitelisted or operator name. RCON is a remote command interface; leave it off unless you have a documented need and understand how to protect it.

Manage trusted players#

Run these in Crafty’s server console—without a leading slash:

whitelist on
whitelist add PlayerName
whitelist remove PlayerName
whitelist list
op YourMinecraftName
deop PlayerName

Give operator status only to people who need administrative commands. A whitelist limits who joins; it does not make unknown mods safe or replace backups.

Protect the control plane#

• Use unique long passwords for ZimaOS, Crafty, Playit and the router.
• Keep ZimaOS and Crafty dashboards on the private LAN.
• Install mods only from trusted project pages and update deliberately.
• Back up before changes and keep one copy off the server drive.
• Review operators and whitelist names when group membership changes.
• Apply security updates after checking release notes and backups.

Never expose these directly#

• ZimaOS dashboard
• Crafty dashboard
• Docker socket or remote API
• Database ports
• SSH unless you intentionally secure it with keys, firewall rules and updates
• File shares such as SMB to the public internet

These services can control files, containers or the whole machine. A Minecraft game port accepts a narrow game protocol; a management panel is the control plane.

Use a private access product such as Tailscale for remote administration, or administer from the home LAN. A web reverse proxy and HTTPS do not make a weak password or outdated dashboard safe by themselves.

Accounts and permissions#

• Give ZimaOS, Crafty, router, tunnel and Discord accounts different long passwords.
• Turn on multi-factor authentication where offered.
• Do not create extra Crafty superusers; use roles with only the required servers and actions.
• Keep operators rare. Use LuckPerms groups for normal gameplay permissions instead of giving op.
• Remove access when someone no longer helps administer the server.

Downloads and updates#

Use Minecraft’s official site, PaperMC, Fabric/NeoForge/Forge project pages, Modrinth, Hangar and known developer sites. Avoid plugin/mod mirrors and “all-in-one” installers that hide their source.

Before an update, record versions and back up. Update the OS/panel, server software and plugins/mods as separate layers. Read the console after each layer.

Secrets#

Discord bot tokens, Playit secrets, API keys, Floodgate keys, database passwords and private share links do not belong in screenshots, public logs, starter packs or support posts. If a token appears publicly, revoke/reset it instead of merely deleting the message.

Firewall checklist#

1. 1
   List the game ports and protocols you truly need.
2. 2
   Confirm dashboards listen only on the LAN/private network where practical.
3. 3
   Remove old port forwards and tunnel entries.
4. 4
   Keep a note of every intentional public path.
5. 5
   Test the game from outside and administration from the private path.
6. 6
   Review again after adding Geyser, a map or a proxy.