NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Mar 22, 2013@LordKainzo
So what Craftbukkit and NoCheatPlus version do you use now? Does it still happen with the latest development build of NC+? There is no way to disable the new velocity handling and we also don't plan to add anything to disable or replace it with the old method because the old one was way too buggy at some parts. I guess that Heroes skill is private only? So its hard to test/fix it for us without having the needed debug information's. You could also simple use the NC+ API and exempt the player from Moving_SurvivalFly while he is using the skill.
I'm sorry if it causes issues with your plugins but the new velocity handling had to be implemented because of SurvivalFly having strange bugs with the old velocity handling. We plan to extend it but as I said: We need a lot of debug info and reports from our user base to be sure that the new velocity handling is working as it should. We already made some changes to it since you last reported us that issue you were experiencing with it but we cant really test it since we don't have access to you plugin.
-
View User Profile
-
Send Message
Posted Mar 22, 2013@asofold
I'm still trying to get the functions for velocity based skills to work. My players are quite angry that we have a plugin conflicting so harshly with the majority of our skills.
Is there anyway to disable the new built-in move checker that pushes the player back when using SkillJump / Velocity skills?
I'm willing to show you the source in how we handle it - I just want it to function the way it has for 6+ months.
-
View User Profile
-
Send Message
Posted Mar 21, 2013Thank you I will give those a try :D
-
View User Profile
-
Send Message
Posted Mar 21, 2013@finamenon
I made you a little config with all checks disabled. Just rename it to WorldName_config.yml and drop it in the NoCheatPlus folder:
http://dev.bukkit.org/paste/7380/
http://dev.bukkit.org/paste/7380.yaml
We don't have a ticket about better multiworld yet but we planned to make it better somehow. Our documentation is also leaking on information for it so its kinda bad ;P. When I get enough time I will try to at least update the documentation for NoCheatPlus.
@CoolStudio
Nodus doesn't indicate itself in any way to the server, as long as no hacks are used (except for client sided stuff such as tracers, radars, xray, ....) its not really possible to detect it. All what we could do is wait for it to hack and then catch it that way but we kinda already do that now (since NoCheat) ;P just without the banning part because of false positives.
Some servers used a little plugin that compared the name of the joined player with all the names on the "Nodus IRC channel" and if they match then ban that player (Since Nodus auto joined that IRC channel) but that's stupid because everyone could fake the name on the IRC (simple fake owners name to get him banned).
@asofold
We could possibly detect simple patters such as the KeepAlive spam one but again that would be affected by lag and what not... I'm also not sure how far you can go with NMS to grab packets but I guess its just a pain to maintain for new Minecraft updates.
-
View User Profile
-
Send Message
Posted Mar 21, 2013@CoolStudio
It might be possible to detect certain clients or rather certain versions of a client by some patterns of packet sending, but for the general case it is not possible. Should be easy to update the client such that they won't catch anything with certainty.
The other question is if they also ban other clients now and then (optifine, ....).
-
View User Profile
-
Send Message
Posted Mar 21, 2013@asofold
On CookieSlap though if someone joins with nodus it automaticaly bans them and announces it.
-
View User Profile
-
Send Message
Posted Mar 21, 2013@finamenon
Of course we read and process the tickets.
You can disable all checks for a world. Just don't copy all entries, let ncp generate the config.
Later you can strip the config off all values that you are not changing and set set savebackconfig to false, which then will keep it as minimal as it is.
A complete disabling of this plugin in a world is not a typical scenario, but i agree that it could be made easier...
The entries mentioned in the log are not needed to disable anything.
-
View User Profile
-
Send Message
Posted Mar 21, 2013Yeah I copied them over like that. Do you guys view tickets? You really need to make disabling this plugin for certain worlds easier xD
So does this mean I can't disable the plugin entirely for certain worlds?
-
View User Profile
-
Send Message
Posted Mar 21, 2013@finamenon
Did you use copy and paste with the full config?
You could just generate the empty worldX_config.yml and do "ncp reload" to let the entries generate automatically. The "global only" entries would not get generated for those from the start, the active flags can be set to false for the whole "player" and "global" sections for chat.text.
-
View User Profile
-
Send Message
Posted Mar 21, 2013Here you go asofold: http://dev.bukkit.org/paste/7379/
-
View User Profile
-
Send Message
Posted Mar 21, 2013@arthozius
Should be worked around in the dev-builds, release on Bukkitdev is waiting for approval.
-
View User Profile
-
Send Message
Posted Mar 21, 2013Got a problem with SurvivalFly activating when jumping out of minecarts, porting players back to startpoint, anyone else with same or how to fix?
-
View User Profile
-
Send Message
Posted Mar 21, 2013@finamenon
Can you paste all "60" here: http://dev.bukkit.org/paste/ ?
For all checks?
I forgot to mention this: few checks have data that is global, not per-world. The documentation is lacking on that and i am not 100% sure myself which of those can actually be disabled on a per world basis, because it might actually work.
The extended chat engines are deactivated by default anyway in the config.yml (global, player sections override the individual methods flags), so you need not set those individually unless you want to use them somewhere.
I have to do a quick research into the active flags question. Important is not to change the configuration for those "global only" parts, because that would not take effect or cause other trouble. It should be possible to set the "active" flags, though. You copied those entries by hand?
-
View User Profile
-
Send Message
Posted Mar 21, 2013[WARNING] [NoCheatPlus] Config path 'checks.chat.text.player.words.active' (finamenon_nether) should only be set in the global configuration.
Theres about 60 other messages just like this for each world and check.
-
View User Profile
-
Send Message
Posted Mar 21, 2013@finamenon
All the "active" flags for sub-sections of the "checks" section have to be changed.
-
View User Profile
-
Send Message
Posted Mar 21, 2013Okay so if I set the global config to default settings, and specifically name configs for each world where I want it disabled, I would set all their settings to false and they would override the global config?
-
View User Profile
-
Send Message
Posted Mar 21, 2013@DMac650
There is not one-switch-toggle yet.
But you can remove the kick-command entries from the actions of individual checks.
Any problems with a certain kick? Usually kicks prevent a little bit of load on the server due to extreme violations (logging + many events to be processed due to spam by a hack-client), so it might pay to distinguish a little bit. For instance you could set the violation added for survivalfly/hover to something lower, or the violation level for kicking higher.
More simple toggle switches are planned, however other issues are more pressing, so this gets postponed naturally.
-
View User Profile
-
Send Message
Posted Mar 20, 2013I run a server and I would like to not kick the players for hacking, but just restrict their ability to hack. How can I toggle whether npc kicks the player or not?
-
View User Profile
-
Send Message
Posted Mar 20, 2013@LordKainzo
More details? What server version are you using and plugins? What else happened at that moment? Does that happen always, once, one in a while, always once happened once... ?
-
View User Profile
-
Send Message
Posted Mar 20, 2013@finamenon
Its this order:
- First NoCheatPlus loads the global configuration (config.yml)
- After that it loads the settings from WorldBlaSomething_config.yml and those will override the settings of the global config.yml for the world WorldBlaSomething.
with "savebackconfig" you can simple control if NC+ is allowed to generate the settings automatically or not.
So if you for example have SurvivalFly active: true in global but SurvivalFly active: false in WorldBlaSomething then SurvivalFly will be checked on the main world but not on the WorldBlaSomething.
So no empty config doesn't disable any checks.