NoCheatPlus
Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
Comments
-
_ForgeUser9668734 Owner
-
_ForgeUser15078623 Ticket Manager
-
_ForgeUser16101223 Contributor
-
_ForgeUser7091862 Former Author
-
_ForgeUser7459264 Former Author
-
Forge_User_61842651 Author
-
MyPicturesCP Artist
-
View User Profile
-
Send Message
Posted Dec 29, 2012@FourDowning
Can you get me any data? Would be good to start with CB version and NCP version.
The data expiration does not put your server at risk, it just removes data of logged out players after some duration. People might have more exploits with relogging later, because if they log out in air, their set-back location (last position on ground) will be deleted with expiration and then reset to the air position if they relog, allowing for some moderate moving/flying exploit (Gain 1.5 to 3 blocks height within that duration by relogging + exploit). In principle the same problem goes for restarting in general, so if you use 30 minutes or 60 minutes it should be ok, unless you have parcour stuff that allows players to log off for 60 minutes.
-
View User Profile
-
Send Message
Posted Dec 29, 2012@ritonda66
that they're using aimbot, forecefield or something similar.
-
View User Profile
-
Send Message
Posted Dec 29, 2012What does that mean?
-
View User Profile
-
Send Message
Posted Dec 29, 2012@asofold
No I didn't, you say it'd put my server at risk?
Also, I've spoken to some other people, they say they're having a similar if not exact problem to what I've got. They've checked, and it is NCP. Once of them is checking the code himself I think.
-
View User Profile
-
Send Message
Posted Dec 29, 2012@Warhawker
You can disable improbable and yawrate in the "combined" section in the configuration. On jenkins there is a build available which makes them less aggressive.
Edit: I will soon try some adjustments to improbable and yawrate, which should improve the situation by a lot. Hopefully it will not make the anti-bot qualities less efficient. Steps are:
Can't do everything at once of course, and there other things to do/consider as well (rl, metrics, bugs, testing), but i hope i can do something
@chrishillz
"ncp delay" is a command that will execute what follows in a scheduled task, so it will be run safely without interfering with set-back-handling, for instance.
@ColbyBran
You are using Spigot? Looks like lag-spikes/lag problems at first.
@libraryaddict
Put simple:
@FourDowning
Not too specific, though. Did you try the data removal option set to 60 minutes or so?
-
View User Profile
-
Send Message
Posted Dec 29, 2012How do I remove this DAMN improbable check!?!? Its so glitched!
-
View User Profile
-
Send Message
Posted Dec 28, 2012Why does this have a 'delay', and what does it mean?
-
View User Profile
-
Send Message
Posted Dec 28, 2012Im getting this wierd thing, Once and a while no one and do anything (eg. hit and chicken, break blocks) When they try to break blocks it gives me the failed frequency, and when they hit entitities I get failed speed.
-
View User Profile
-
Send Message
Posted Dec 28, 2012We've just been forced to pull NCP from the servers -.-
This is about 500 or so players. Let the chaos begin
-
View User Profile
-
Send Message
Posted Dec 28, 2012As well as a 'fix' we are doing is making your plugin cry :\
We just prevent them being kicked with that message. In return it spams us up.
Mind giving us a NCP with this removed or some kind of information on getting NCP into eclipse with the ability to modify the code..
Merely cloning it and importing it as a maven project fails.
An error such as 'A resource exists with a different case: '/NoCheatPlus'.' for example..
-
View User Profile
-
Send Message
Posted Dec 28, 2012@MyPictures
The servers we use this on are called 'Archergames' and what it does is allow spectators and players who are dead to fly.
Seems that if you are teleported twice you are going to trigger this, This is probably connected due to our server is a minigames and every map every playerdata is wiped.
Go to 'MovingListener' located in package fr.neatmonster.nocheatplus.checks.moving
handleIllegalMove seems to be the culprit.
We are using the default config.
We also tried to recompile our own version of NCP but weirdly we pull up maven errors and end up unable to modify the main plugins code.
What did you do O.o
Also the 'Illegal move' is in CheckUtils.
-
View User Profile
-
Send Message
Posted Dec 28, 2012@libraryaddict
And what should happen if we checked for "allow-flight"? Throw out a warning (original Evenprimes idea ;P)?: http://forums.bukkit.org/threads/solved-access-server-properties-content.15648/
@FourDowning
How did you monitor your plugins? Did NC+ show up heavy in those logs? You could also send us those monitoring logs so we can take a look at them. We just need more information's to confirm that its NC+, so please send us everything you have.
@libraryaddict "[SEVERE] [NCP] could not restore location for Isaacskater deny login for 24 hours"
Hmm I cant find this line on the NC+ source code, I don't know if @asofold changed something in it but by default it shouldn't deny someone to login for 24 hours. Do you have a modified version of NC+? Whats your NC+ and CraftBukkit version? Do you have more logs for this issue?
Also there are no configs for "illegal move" what exactly did you remove/edit from the configuration?
Please don't mess with illegal move, it was made to prevent a crash exploit in other plugins (including NC+).
-
View User Profile
-
Send Message
Posted Dec 28, 2012Also. Any particular reason every single one of my players is being disconnected on join.
16:25:14 [SEVERE] [NCP] could not restore location for Isaacskater deny login for 24 hours
16:25:14 [WARNING] [NCP] Disconnect Isaacskater due to illegal move!
Edit: Just cancelled all kicks for 'Illegal move.' and the problem has completely disappeared. We don't kick from NCP anyways so this doesn't change it.
-
View User Profile
-
Send Message
Posted Dec 28, 2012@asofold
I've been monitoring my plugins and my memory usage and I'm fairly sure it's NCP now. But again, I do not have the stuff to be able to confirm it. I can tell you that it slowly builds up, then gets to a point where it's causing extreame lag and we have to reboot, after the reboot it's gone and it starts over again.
We do more than one per day now, prior to 1.4.6 we'd barely use any RAM or have to restart very often. We're running 6GB of RAM btw.
I've spoken to a bukkit guy, and he also thinks it's a plugin with what I described to him.
-
View User Profile
-
Send Message
Posted Dec 28, 2012Regarding survivalfly:
Can you have this so it checks if they have 'allow flight'
-
View User Profile
-
Send Message
Posted Dec 28, 2012@AeroNetwork
Apparently? How so? I don't see any evidence for crashes and also not for not working with fastbreak. So far some servers seem to have problems, but those having problems tend to run 30+ plugins, amongst which are very heavy/special ones and also tend to run Spigot, which complicates things a lot.
If it was not working in general or crashing servers, it would be apparent by the number of bug reports. We are taking all reports seriously, but we don't have enough information to track it down to a cause inside or outside of NCP (or in relation to), yet.
-
View User Profile
-
Send Message
Posted Dec 28, 2012@asofold
Apparently fastbreak doesn't work with the build meant for 1.4.2, 1.4.5, 1.4.6 and it causes it to crash, any fixes?
-
View User Profile
-
Send Message
Posted Dec 28, 2012@herpingdo
We are using Maven. But as you might notice we do have a version working with 1.4.6 available for download at BukkitDev.
@Serilum
That is likely to be the improbable check. What does "/ncp info PLAYER" show?
-
View User Profile
-
Send Message
Posted Dec 28, 2012@Serilum
same
pvp.muttsworldmine.com
-
View User Profile
-
Send Message
Posted Dec 28, 2012@MyPictures
I'm not really sure how to work your weird github setup, I'm used to things where I can just download the source, drag it into Eclipse, and I'll be able to modify it. I pretty much spent 30 minutes on that messing around with classes in order to get it to even compile, let alone run. Anyways, all that was modified in the jar I liked was updating package and class names to correspond with Bukkit and Mojang changing them. So, basically, I can't actually make a pull request, because I can't get the repo onto my computer.