Forum


Notice to all users

We are migrating towards a new forum system located at community.teamspeak.com, as such this forum will become read-only on January 29, 2020

Results 1 to 12 of 12
  1. #1
    Join Date
    January 2011
    Posts
    17

    Urgent Help Requested..

    Greetings,

    I run a TS3 Server that has an obvious security flaw and someone has been exploiting it by joining our TS3, jumping into channels, kicking players and then leaving before anyone even knows wtf is going on.

    Does anyone know how I can protect my users from this person who is harassing us or ID who is doing it, or both??

    Any help would be much appreciated,

    Thank you,

    Rocky

  2. #2
    Join Date
    May 2010
    Posts
    6,310
    Hello

    What is your server version ?
    Are you sure that the kick permissions are correctly set ?

  3. #3
    Join Date
    January 2011
    Posts
    17
    ........................................

  4. #4
    Join Date
    May 2007
    Location
    Eastern NC
    Posts
    1,801
    Quote Originally Posted by rockyonurmomma View Post
    ........................................
    Not much of an answer...........................

  5. #5
    Join Date
    May 2010
    Posts
    6,310
    Quote Originally Posted by rockyonurmomma View Post
    ........................................
    With words please

  6. #6
    Join Date
    January 2011
    Posts
    17
    I cant get the server info my cpanel wont load.

  7. #7
    Join Date
    May 2010
    Posts
    6,310
    Quote Originally Posted by rockyonurmomma View Post
    I cant get the server info my cpanel wont load.
    When you are connected on your server, just click on the server name, you have the version information in the right part of your client.
    To check your permissions, just open the permission window (Permissions > Server Group)

  8. #8
    Join Date
    January 2011
    Posts
    17
    3.0.0-beta30 [Build: 12998] on Windows

    Yes I see everything fine I just don't know what to do with it. Some of the info like setting kick permissions is grayed out, ban is 25

  9. #9
    Join Date
    May 2010
    Posts
    6,310
    Can you post the permission overview of a guest user.
    (right click on guest > Permissions > Permissions Overview > Click on "Export as PDF" button

  10. #10
    Join Date
    January 2011
    Posts
    17
    File.

    Thank u.
    Attached Images Attached Images

  11. #11
    Join Date
    October 2003
    Location
    Germany
    Posts
    2,527

    Solved

    Thank you for that export file. The issue is clear now. I'll try to explain so buckle up...

    Your guest group does not have any needed kick power permissions set so it's no wonder that everyone is able to kick them. Let's assume that your servers permission system was always updated properly and is up-to-date (I doubt that). In this case the following could have happened...

    You have an up-to-date Server Admin group with the i_client_kick_power and i_group_auto_update_type permissions set. When the server was updated, the i_client_kick_power permission was automatically deleted and replaced by the two new kick permissions called i_client_kick_from_server_power and i_client_kick_from_channel_power (the same should have happened for the needed power permission)... but when you created a ***CUSTOM*** server group for other clients (i.e. Server Sub-Admins) and did NOT assign the i_group_auto_update_type correctly, the old permissions were removed but the new ones were not added. If this is the case, your should be able to assign the missing permissions to your custom groups on your own.

    If your permission system is outdated (and I think it is), here's an explanation of how things worked in the past... If you were using a version of the TeamSpeak 3 Server prior to 3.0.0-beta22, you had to update your database manually in order to apply updates to the permission system.

    Depending on the number of virtual servers running you're running, this can be a time consuming task. We've prepared a simple PHP script which is intended to help you upgrading the permission system of your existing TeamSpeak 3 Server instances to 3.0.0-beta22 or newer and to make sure you can use the auto updating feature with future releases of the TeamSpeak 3 Server. There's an updated version of this script available which is also capable of restoring the recommended template group settings (check the included README file for tetails):

    http://teamspeak.netfire.com/literat...rms_update.zip

    On start, the script will connect to the configured TeamSpeak 3 Server instance and update all ServerQuery and template groups based on the defaults.sql file located in the /sql subfolder. With this version of the script, we included an updated version of the defaults.sql file with recommended settings for ATHPs. Also, I've uploaded an updated version of the defaults.sql file to our forums (check my posting for a list of customizations):

    http://forum.teamspeak.com/showthrea...384#post263384

    As you're probably not an ATHP, you can also replace that defaults.sql file with the standard version delivered with each TeamSpeak 3 Server release.

    Known Issues:
    Depending on your current permission system settings it's possible that the script will return an "insufficient permission modify power" error while trying to update your database. In a previous release, a permission called b_permission_modify_power_ignore was added to the server. This permission allows you to modify everything in the permission system even if you don't have the required permission modify power.

    You will need to use an SQL editor to add the permission manually before you can start using this script. Here's an example of a simple editor for the native SQLite3 database:

    http://sourceforge.net/projects/sqli...1.zip/download

    Execute these on the database commands to add the permission manually:

    Code:
    insert into perm_server_group (server_id, id1, id2, perm_id, perm_value,  perm_negated, perm_skip) values (0, 2, 0,  "b_permission_modify_power_ignore", 1, 0, 0);
    insert into perm_server_group (server_id, id1, id2, perm_id, perm_value,  perm_negated, perm_skip) values (0, 2, 0,  "i_needed_modify_power_permission_modify_power_ignore", 100, 0, 0);
    Note that in this case 2 is the internal database ID of your ServerQuery admin group. If you made any changes to your ServerQuery or template groups, it's possible that this ID is different on your end.

    Please note that the script will reset your permission system to the status of the defaults.sql file you've used which means that new permissions added with recent versions will be removed. To re-assign these permissions automatically, please stop your server instance and execute the following SQL command on the database:

    Code:
    DELETE FROM instance_properties WHERE ident = "serverinstance_permissions_version";
    Good luck!


  12. #12
    Join Date
    January 2011
    Posts
    17
    One more time in English please. ( Anyone willing to do this for me for a hooker and a six pack? )

    But seriously, thank you for taking all the time out to help me, you're very gracious indeed. Unfortunately I'm as dumb as a box of rocks so this might take me some time to figure out. Let me read it another 50-60 times and if I'm still confused I'll hang myself.

    Thank you.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Ip Needs to be Requested
    By disconett in forum Windows
    Replies: 9
    Last Post: December 7th, 2011, 09:30 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •