How to protect your MU Online server (anti-hack and security)

A MU Online server is a multi-layer attack surface. Protecting it effectively means addressing every layer — the client, the database, the admin tools, the operating system, and the network.

The attack surface: what can be attacked

WHAT ATTACKERS TARGET:

CLIENT SIDE:
→ Speed hack: clients modify movement/attack speed (processed locally)
→ Fly hack: bypass map collision detection
→ Bot programs: automate farming without player input
→ Memory editing: modify damage numbers, character stats locally
→ Protection: anti-hack running alongside Main.exe

GAME SERVER (MuServer):
→ Item duplication: timing exploits in save/load cycle
→ Character data tampering via memory editing (affects displayed values)
→ Packet injection: crafting raw network packets to send invalid game actions
→ Protection: server-side validation, packet checksums (in modern distributions)

DATABASE (SQL Server):
→ Brute-force sa password: automated scanners probe port 1433
→ SQL injection via web panel: input fields that accept SQL commands
→ Direct database access from internet: port 1433 exposed
→ Protection: strong password, closed port, dedicated low-privilege user

ADMIN TOOLS:
→ Stolen GM account credentials: players log in as GM and abuse commands
→ Web panel admin password: gives control over accounts, bans, items
→ Protection: strong unique passwords, IP restriction for admin panel

OPERATING SYSTEM:
→ Brute-force RDP on default port 3389: very common automated attack
→ Weak Administrator password
→ Protection: strong password, non-default RDP port, IP restriction

Layer 1 — Client anti-hack

HOW ANTI-HACK WORKS:

WHAT ANTI-HACK DOES:
→ Runs as a background process alongside Main.exe
→ Monitors running processes for known cheat tools
→ Checks for memory modifications to game values
→ Validates movement speed, attack speed, and action timing
→ May use driver-level detection (kernel anti-cheat) or user-level detection

WHAT ANTI-HACK DOESN'T DO:
→ Does NOT protect the server's database
→ Does NOT prevent packet injection from technically sophisticated attackers
→ Does NOT prevent all cheats — it's an arms race between detection and bypass

PRACTICAL GUIDELINES:
→ Enable the anti-hack that comes with your S6 distribution
→ Keep it updated when new versions come out
→ Don't rely on it as your only protection — combine with server-side validation

CONFIGURING COMMON ANTI-HACK SETTINGS:
[AntiHack]
Enable = 1                  ← always enable for public server
SpeedHackCheck = 1          ← detects speed modifications
AutoDisconnect = 1          ← disconnects detected cheaters
BanOnDetection = 0          ← 0 = disconnect only, 1 = ban account
LogDetections = 1           ← log detections for review

Layer 2 — Server-side game validation

SERVER-SIDE CHECKS (more reliable than client-side):

SPEED VALIDATION:
→ The GameServer tracks how many attacks/moves a player performs per second
→ A player hitting faster than the maximum weapon speed is flagged
→ Enable in GameServer.ini:
   SpeedHackProtection = 1
   MaxAttacksPerSecond = [value matching the game's max speed]

POSITION VALIDATION:
→ The GameServer checks if position updates are physically possible
   (you can't teleport 10 maps in 0.1 seconds)
→ Players whose position changes impossibly are kicked or flagged

ITEM TRANSACTION LOCKING:
→ After an item action (drop, trade, put in Chaos Machine), lock the item
   until the database confirms the operation
→ Prevents duplication from fast repeated actions
→ Enable: ItemTransactionLock = 1 (if your distribution supports it)

DATABASE-LEVEL DUPE PREVENTION:
→ SQL triggers can detect if the same item appears twice
→ LogServer tracks every item creation/destruction
→ Set up alerts for abnormal item counts (a player who suddenly has 500 wings)

Layer 3 — SQL Server hardening

DATABASE SECURITY:

STEP 1 — STRONG SA PASSWORD (if not done at installation):
→ SSMS → Security → Logins → sa → right-click → Properties
→ General tab: new password (minimum 12 characters, mixed case + numbers + symbols)
→ Status tab: Login = Enabled
→ Click OK

STEP 2 — DEDICATED MU USER WITH LIMITED SCOPE:
→ Already covered in the SQL configuration tutorial
→ mu_server: db_owner on MU databases only, NO server-level permissions
→ sa should only be used by the admin for maintenance — not in any MuServer .ini file

STEP 3 — CLOSE PORT 1433 TO THE INTERNET:
→ Windows Defender Firewall → Inbound Rules
→ If there's a rule allowing TCP 1433 from all IPs: delete it or restrict to localhost
→ SQL Server should only be reachable from 127.0.0.1 (same machine)
→ If the website on a different server needs SQL access:
   → Whitelist only the website server's IP
   → Never "allow all" on 1433

STEP 4 — DISABLE SA IF NOT NEEDED:
→ SSMS → Security → Logins → sa → Properties → Status → Login: Disabled
→ Use only the mu_server user for app connections
→ Re-enable sa only when you need admin access to SQL

STEP 5 — SQL SERVER BROWSER:
→ Disable if not needed: services.msc → SQL Server Browser → Stop → Startup: Disabled
→ This service listens on UDP 1434 (a DDoS amplification vector)

Layer 4 — Web panel security

WEBSITE AND ADMIN PANEL PROTECTION:

COMMON WEB PANEL VULNERABILITIES:
→ SQL injection in login forms, search, and registration fields
→ Weak admin password (especially "admin" or "admin123")
→ Direct URL access to admin panel without authentication
→ Exposed phpMyAdmin accessible from the internet

PROTECT THE ADMIN PANEL:
1. Change the admin username from "admin" to something unique
2. Use a strong password (20+ characters, mixed)
3. Add .htaccess IP restriction to the admin folder:
   Order Deny,Allow
   Deny from all
   Allow from [your.home.ip.address]
4. This makes the admin panel inaccessible from any other IP

PROTECT AGAINST SQL INJECTION:
→ The web system you use should already use parameterized queries
→ Test: try entering ' OR '1'='1 in login fields → if it bypasses login: severe vuln
→ Modern web systems for MU (post-2018) generally handle this correctly
→ Older systems may be vulnerable — check the source or use a tested, maintained version

PHPPMYADMIN ACCESS:
→ phpMyAdmin should NEVER be accessible from the internet in production
→ Add .htaccess to restrict it to your IP only (same as admin panel above)
→ Or disable the /phpmyadmin/ URL alias entirely for production

Layer 5 — Operating system and RDP hardening

WINDOWS SERVER HARDENING:

CHANGE THE DEFAULT RDP PORT (MOST IMPORTANT):
→ Automated bots scan 3389 constantly with credential lists
→ Change the port to reduce exposure:
   regedit → HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
   → PortNumber → change from 3389 to a high port (e.g., 47899)
   → Create a Windows Firewall inbound rule for TCP 47899
   → Delete or block the TCP 3389 rule
   → Reconnect using mstsc.exe with [IP]:[47899] format

RESTRICT RDP TO YOUR IP:
→ Windows Defender Firewall → Inbound Rules → Remote Desktop (TCP-In)
→ Properties → Scope → Remote IP → "These IP addresses"
→ Add your home/office IP
→ Now only your IP can even attempt RDP

STRONG ADMINISTRATOR PASSWORD:
→ Win+R → netplwiz → or: Computer Management → Local Users → Administrator
→ Set a password with: uppercase, lowercase, numbers, special chars, 16+ characters
→ No dictionary words, no obvious sequences

DISABLE UNNECESSARY SERVICES:
→ services.msc → review and disable services you don't use:
   → Remote Registry → Disable
   → Windows Remote Management → Disable (if not using PowerShell remoting)
   → Print Spooler → Disable (if no printer)

Security checklist for production

PRE-LAUNCH SECURITY AUDIT:

DATABASE:
☐ sa password is strong (12+ chars, mixed case/numbers/symbols)
☐ mu_server user exists with limited scope (not sa)
☐ TCP 1433 is NOT open to all IPs in Windows Firewall
☐ UDP 1434 (SQL Server Browser) is closed or service is disabled
☐ MuServer .ini files use mu_server, not sa

OPERATING SYSTEM:
☐ Administrator password is strong (16+ chars)
☐ RDP port changed from 3389 to a non-standard port
☐ RDP access restricted to admin IP(s) only

NETWORK:
☐ Only ports 44405 and 55901 (and 80 if site is on same server) are open to internet
☐ Anti-DDoS hosting in place or Cloudflare proxying the website

WEB PANEL:
☐ Admin username is not "admin" or similar
☐ Admin password is unique and strong
☐ Admin folder is IP-restricted with .htaccess
☐ phpMyAdmin is not publicly accessible

GAME SERVER:
☐ Anti-hack is enabled
☐ Server-side speed/position checks are enabled
☐ Item logging is enabled in LogServer
☐ GM accounts use strong passwords and 2+ characters different from player accounts

Continue with the DDoS protection tutorial (covering network-level protection, which is separate from the application-level security covered here), the GM commands tutorial (for setting up admin accounts securely with appropriate CtlCode levels), and the backup tutorial (the last line of defense when all other security measures fail).

Frequently asked questions