PermissionsEx: Anti-griefing methods for Minecraft

More Grief

If you've already installed and configured Grey Lists using PermissionsEx (as described in my earlier post) then you are well aware of the protection this provides against those pesky griefers. Yeah I know you can white-list your server but this helps you want to showcase your work without risk.

My son can be a little too trusting, and far too keen to attract new builders, and it always seems to be when we have friends of friends connected that trouble starts brewing. A few days ago the inevitable happened, a school pal and his friend paired up for an orgy of TNT abuse, dropping as many buildings as they could in full view of the regular builders. The server was downed soon as he figured out what was happening and the permissions.yml file altered to remove the offenders building rights, but ultimately damage had been done. One of the longest standing buildings was hit so hard that it was reduced to a crater, all in about a minutes chaos!

PermissionsEx Revisited

All the griefing we've experienced so far has been the result of fire or TNT, with the latter obliterating buildings well beyond repair. It made sense after this attack to limit their use, removing them from the standard 'builder' groups rights, but after well over an hour of altering permissions and testing we had only managed to remove the rights to place TNT. It's really a case of trying different modifyworld  restriction in the permissions.yml file until you get a result.

The first thing to be aware of is the order of the permission lines is important. The file is scanned top to bottom and as soon as a match is found it stops. This means restrictions must go before grants using wildcards or they'll never be reached.

Builder:

      prefix: '&0(&8Builder&0)&7 '
      permissions:
      - -modifyworld.blocks.place.46
      - -modifyworld.bucket.empty.10
      - -modifyworld.bucket.fill.10
      - -modifyworld.items.pickup.259
      - -modifyworld.items.craft.259
      - -modifyworld.items.use.259.on.block.*
      - -modifyworld.items.use.259
      - modifyworld.*
      options:
          rank: '900'

nb. Our restrictions go before modifyworld.* and use the '-' minus symbol to differentiate them from grants. The objects are listed by item/block id (46 = tnt, 10 = lava, 259 = flint and steel)

Now when TNT (46) is placed by a builder the block gets picked straight back up again, similarly the restrictions on flint and steel (259) don't allow you to pick it up or use it. The lava bucket (327) lines need to restrict filling and emptying of a liquid, in this case lava.

You will also need to enable some options in the modifyworld.yml before this works.

item-restrictions: true
use-material-names: false
drop-restricted-item: true
item-use-check: true

I set use-material-names to false so that I could use item and block numbers, but you can leave this set to 'true' and use proper names. Then your restriction would read as per the example below:-

   - -modifyworld.blocks.place.TNT

Don't mix the two up or your permissions won't work. Also be aware that the plugins are very sensitive to formatting errors, so check your server log after changing and if necessary run your config through a YAML file validator.

In the mean time I'll work on the fire problem & if anyone has any suggestions then please comment.

Minecraft Grey Lists

Anti-Griefing

A few weeks ago my son's Minecraft world became trashed (buildings completely obliterated) by friends of a friend who visited our server. Thankfully we had a backup to restore from and then to ensure it didn't happen again we turned on white lists in the server.properties file.

But the story doesn't end here... a few days ago number one son asked me if I knew anything about grey lists, informing me roughly what they're supposed to do. Apparently if you set up a grey list then it enables anyone to join the server but they're restricted from building. This was new to me and seems ideal, meaning he'd be able to pass about the server connection details freely without worrying about being griefed again.

Grey Lists

The vanilla server only supports black lists (to ban people) or white lists (to only allow access to those listed). There's no setting in the properties file to enable grey lists, so I googled until I found that a plugin called PermissionsEx. This enables you to define access groups with appropriate rights, and assign users to them.

But you can't add plugins to the vanilla version of Minecraft server,.. there's no plugin directory, instead you have to use the CraftBukkit server instead. (Click here for download page)

While I'm at it, here's the link for the PermissionsEx plugin. (Click here for download page)

Installing Bukkit & PermissionsEx

Here's the steps we went through:

1. Edit your server.properties file and disable white-lists if you where using them.
2. Download the craftbukkit jar file and copy it into your minecraft server directory.
3. Run the craftbukkit server program to create the extra files and folders (it also converts your world files).
4. Download the PermissionEx jar files and copy these into the newly created plugin directory.
5. Restart the server again and a PermissionEx sub-directory will be created.
6. Change to this directory but leave config.yml alone.
7. Edit the permissions.yml file and replace the contents with the following lines, then add your users into the end section (in line with the examples).

groups:
    default:
        default: true
        options:
            rank: '1000'
        permissions:
        - modifyworld.chat
    Builder:
        prefix: '&0(&8Builder&0)&7 '
        permissions:
        - modifyworld.*
        options:
            rank: '900'
    Moderator:
        prefix: '&0(&1Moderator&0)&7 '
        permissions:
        - -modifyworld.mobtarget.*
        - modifyworld.*
        options:
            rank: '100'
    Admin:
        prefix: '&0(&4Admins&0)&7 '
        permissions:
        - -modifyworld.mobtarget.*
        - modifyworld.*
        - permissions.*
        options:
            rank: '1'
users:
    SomePlayerName:
        group:
        - Builder
    YourPlayerName:
        group:
        - Admin

NB. Ensure you don't add any spaces before 'groups' or 'users' or the file will be ignored.

We found that if your name is in the ops.txt file then you automatically get admin level.

Follow this link for further details on configuration and how to type /pex commands when in the game.

Finally I updated the /etc/init.d/minecraft startup script to use the CraftBukkit jar file.