NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Oct 25, 2014I have a lot of fly hackers since I updated to 1.7.10 and updated ncp. Any idea what could cause this?
-
View User Profile
-
Send Message
Posted Oct 21, 2014@asofold
Spigot: git-Spigot-1.7.9-R0.2-207-g03373bb (latest spigot patch as of now)
NoCheatPlus: 3.11.2-SNAPSHOT-sMD5NET-b745
I also looked into the issue more and it is the SurvivalFly move check.
-
View User Profile
-
Send Message
Posted Oct 20, 2014Sorry for the late replies...
@kristijan260393
NCP itself only allows to confine commands to the console by configuration (consoleonly feature), if you want to be able to use commands that other ops can't use, i'm afraid it might not be possible easily.
A way around it could be a permissions plugin that can change the op-default permissions, such that ops don't have those, and configure it accordingly (not sure that exists at all, could be PEX). Though, if you use a permissions plugin, why op players in the first place (double book-keeping, though admittedly it's more simple). I suggest using a permissions plugin, ~ also in the first place, instead of opping people.
I'm afraid the command protection feature of NCP can't solve the issue, because commands might default to "op".
@Theepwner
No idea (yet). What's server + plugin version ("ncp version" command for convenience)?
@iVultra
Do you happen to know what the highest placed-block-y-coordinate is/was?
-
View User Profile
-
Send Message
Posted Oct 18, 2014Any idea what would cause this to happen? http:youtu.be/YBcaD5hpLZc
-
View User Profile
-
Send Message
Posted Oct 17, 2014Getting lots of lag-backs from running around cactus. Also launching yourself with punch 2 and 3 bows will sometimes lag you back, especially when near cactus. Any ideas?
-
View User Profile
-
Send Message
Posted Oct 16, 2014@bartico6
That AHK script acts just like an autoclicker; while you have your mouse held down, it clicks for you (at the rate of 20+ clicks per second).
If a player were to get a combination of hits at that speed, they would end up flagging fight_speed and possibly fight_angle (depending on # of people hitting).
-
View User Profile
-
Send Message
Posted Oct 16, 2014@devanmist
Thanks, that's most readable now! Unfortunately i have no idea at present. Is there anything else in the server log with the player getting connected/disconnected?
@dNiym
Noswing usually would be with things like block breaking or fight. You can get a more precise information with "ncp info playername", though one would have to monitor changes to before causing a violation, because it accumulates.
-
View User Profile
-
Send Message
Posted Oct 16, 2014I work on a server with bending which is throwing a lot of NCP warnings since installation. However most of these seem to be appearing when players are using bending moves.
Spigot 1.8
I am looking at how to integrate the NCP exceptions into the plugin now. My question is There was a player just standing still in spawn and occasionally would throw a "player failed noswing" while he standing still/idling.
Any idea what would cause this one? There shouldn't be anything going on that would affect blocks while hes just standing still in spawn.
-
View User Profile
-
Send Message
Posted Oct 15, 2014@asofold
http://dev.bukkit.org/paste/10749/
-
View User Profile
-
Send Message
Posted Oct 15, 2014@devanmist
Could you put that into a paste with type/language set to "text only" (http://dev.bukkit.org/paste/)? Would help reading it and the conversation :)...
-
View User Profile
-
Send Message
Posted Oct 14, 2014@ProdigyOG
The mod was working perfectly on my server before I installed NoCheatPlus and I'd never been kicked from my server in this manner before, so I strongly believe it has to do with the plugin.
-
View User Profile
-
Send Message
Posted Oct 14, 2014@devanmist
If you're leaving the server due to a client crash, either your server is sending information that is causing you to crash or your liteloader mod isn't written correctly. I'd assume the latter. Can you post your gui code and the crash log?
-
View User Profile
-
Send Message
Posted Oct 13, 2014Is there a way for me, the admin/owner of my server, to be able to use modded clients without allowing anyone else to do so? I try to log in with LiteLoader for the WorldEdit client side CUI but it just kicks me from the server and my game goes to an error/crash screen. I've tried to use the bypass permissions but it's not working. Am I doing something wrong?
-
View User Profile
-
Send Message
Posted Oct 13, 2014Ah, it's hard to say. You would have to jump with me on a PvP server to see it in action, pretty hard to describe ;( http://i.imgur.com/ZF86wi7.png This is the AHK Script I'm talking about. Using it somewhat gives you an advantage (bigger knockback it was, I think). I've seen servers detecting it so it must be possible. I also found some ForgeModLoader scripts that 'bypass' checks and are a form of FastBreak hacks. I can send you all these at a moments notice, PM? :}
-
View User Profile
-
Send Message
Posted Oct 11, 2014@DaGLiMiOuX
You seem to be using a hub/bungee thing, which might complicate things, in addition we don't have control over the part before the kick message ("You have been kicked ...:"), at least not via the Bukkit API.
So do i understand right that there are two problems:
-
View User Profile
-
Send Message
Posted Oct 11, 2014@asofold
So, how can it be possible that HubKick ignores prefix and that message before kicking and your plugin can't do it? =/ Im not trying to be rude, but seriously... It must be possible somehow. If you are right and it is not possible, translations in our server for kicks with NCP can't be made and we will have to disable them somehow.
Regards, DaGLiMiOuX
-
View User Profile
-
Send Message
Posted Oct 11, 2014@DaGLiMiOuX
We only use a command to kick players, if i don't overlook something, we can only alter the message we pass to that command.
@BartekS
Bots are hard/impossible to catch in theory, unless they do something players can't do (pro players). That 1 ms clicking does what? We do have rate-limiting here and there, but we can't look onto the desks of the players.
-
View User Profile
-
Send Message
Posted Oct 10, 2014@sexyrussian
Doesn't echest.others give you access to someone's ender including modification? :)
-
View User Profile
-
Send Message
Posted Oct 10, 2014NCP could use anti-macro-clicker protection. Speaking of AutoHotkey's 1ms clicking bots, since they actually do have huge impact on PvP (protected with NCP, it passes the checks) servers, especially hardcore ones, where you beat each other till one's armor breaks/gapples run out. Just a suggestion though :P (also gaming "mice" (?) with doubleclicks or firebuttons ruin the fun ;-;)
-
View User Profile
-
Send Message
Posted Oct 10, 2014@asofold
No. We have set our custom prefix for plugin messages that are sent to players. In HubKick, we customized the prefix option into his config and that prefix is shown when you are kicked. It's oka... we want that! but what we don't want is to show an english message when you are kicked as I showed to you on last comment.
I don't know if you are getting that message from any other way, like CraftBukkit or Spigot, instead of getting it from Bungee.
I hope that I was clear enough =P
Regards, DaGLiMiOuX