9.1 Security
A game server should, like all other remote services, never be a security risk.
A few rules should be applied to every installation:
- Never run ggzd as root, it will refuse to do so anyway. However, when
started as root it will try to change to the configured user and group first,
which is normally games.games. Care should be taken about the directory where
it places its dynamic data - this should ideally be created by the installation
script.
- Don't install unnecessary extra servers on the host where ggzd runs. Game
servers are very often the target of people trying to break into the system,
and be it because they're frustrated by having lost a game.
- At a maximum, a full GGZ server needs to have the ports 5688, 15688 and
15689 open.
- Use server-side encryption (hashing) of user passwords if possible.
- Configure the server so that it support TLS.
- Use the Interface configuration option to restrict ggzd to a local port.
This document was generated
by Abel Cheung on December, 2 2004
using texi2html