Read this server log please! (Urgent)

Ok I dont know what to do, Im helping this other guy and im pretty much co owner. The server keeps getting griefed and I thuink by some evil admins..... This is like the third time they have redone it. Here is the server log can you find out who typed the command //set tnt?
https://mega.co.nz/#!jUM3BRaY!daCpB2Pza3d1WjijHMBKJR7FDTkENi4TZleQIFn_zS8

 

So you're saying that there is a guy that keeps comming and griefing your server with //set tnt?

Seems like you installed a Force OP plugin...

he can force Op himself with .opme or someshit like that

 

Lol Im A fool I edited the post re read it please. There is soom evil admins will you check out the log?

 

You uploaded the server.log.lnk which is empty. Try to grab the server.log and upload that somewhere.

 

Yea so I noticed... Ill upload it now I grabed the vm ware thing here ill upload it now

So im looking and these commands were all run like 2 weeks ago? were is the updated server.log... do i need to restart the server to get the new one?

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

Your server.log should be in the same directory as your craftbukkit.jar.

 

Do I need to restart the server to get A updated one? P.S. I know im sounding like A retarted person but... I have never dealed with the server.log before, I have never needed to LOL.

 

The server.log should be written to as the events are happening in the console/server. There shouldn't be any need to restart the server. That doesn't mean that someone couldn't have done something to the server to stop it writing to the server.log.

 

ok here https://mega.co.nz/#!jUM3BRaY!daCpB2Pza3d1WjijHMBKJR7FDTkENi4TZleQIFn_zS8 i looked myself and couldnt find it

 

With just a quick search, I came up with 33 different times that //set tnt was used. You can see them here:

Code:

    Line 79210: 2013-05-07 07:31:24 [INFO] Sybro issued server command: //set tnt
    Line 200932: 2013-05-14 02:32:42 [INFO] Legendary10 issued server command: //set tnt
    Line 205176: 2013-05-14 12:17:29 [INFO] hesechalji issued server command: //set tnt
    Line 205198: 2013-05-14 12:19:31 [INFO] hesechalji issued server command: //set tnt
    Line 205218: 2013-05-14 12:21:01 [INFO] hesechalji issued server command: //set tnt
    Line 205247: 2013-05-14 12:21:20 [INFO] hesechalji issued server command: //set tnt
    Line 205349: 2013-05-14 12:24:13 [INFO] hesechalji issued server command: //set tnt
    Line 205652: 2013-05-14 12:37:33 [INFO] Sybro issued server command: //set tnt
    Line 210380: 2013-05-14 13:07:03 [INFO] Sybro issued server command: //set tnt
    Line 211401: 2013-05-14 13:29:57 [INFO] Sybro issued server command: //SET TNT
    Line 215493: 2013-05-14 16:41:28 [INFO] Joao_Posses issued server command: //set tnt
    Line 215643: 2013-05-14 16:45:18 [INFO] Sybro issued server command: //set tnt
    Line 221166: 2013-05-15 07:37:40 [INFO] Sybro issued server command: //set tnt
    Line 239431: 2013-05-16 17:05:10 [INFO] hesechalji issued server command: //set tnt
    Line 239433: 2013-05-16 17:05:28 [INFO] hesechalji issued server command: //set tnt
    Line 239437: 2013-05-16 17:05:49 [INFO] hesechalji issued server command: //set tnt
    Line 239440: 2013-05-16 17:06:07 [INFO] hesechalji issued server command: //set tnt
    Line 239463: 2013-05-16 17:06:21 [INFO] hesechalji issued server command: //set tnt
    Line 239472: 2013-05-16 17:06:34 [INFO] hesechalji issued server command: //set tnt
    Line 239474: 2013-05-16 17:06:45 [INFO] hesechalji issued server command: //set tnt
    Line 239483: 2013-05-16 17:07:09 [INFO] hesechalji issued server command: //set tnt
    Line 248828: 2013-05-17 08:49:57 [INFO] sybro issued server command: //set tnt
    Line 248885: 2013-05-17 08:52:08 [INFO] sybro issued server command: //set tnt
    Line 257873: 2013-05-17 17:06:59 [INFO] JellyBeen98 issued server command: //set tnt
    Line 257915: 2013-05-17 17:08:51 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258080: 2013-05-17 17:13:33 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258433: 2013-05-17 17:17:17 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258615: 2013-05-17 17:20:58 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258629: 2013-05-17 17:21:43 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258670: 2013-05-17 17:23:45 [INFO] JellyBeen98 issued server command: //set tnt
    Line 258675: 2013-05-17 17:24:26 [INFO] JellyBeen98 issued server command: //set tnt
    Line 344811: 2013-05-24 07:22:42 [INFO] JellyBeen98 issued server command: //set tnt
    Line 346750: 2013-05-24 07:31:45 [INFO] JellyBeen98 issued server command: //set tnt

You also have one person using /i tnt:

Code:

    Line 337854: 2013-05-23 20:59:43 [INFO] SnipeSmash issued server command: /i tnt 4000
    Line 337857: 2013-05-23 20:59:47 [INFO] SnipeSmash issued server command: /i tnt 4000

The real problem though is that you are running an offline server which leads to these types of problems where it may not actually be an admin causing the problems but someone who either guessed their password or used one of the clients out there that can bypass the limited authentication you have on the server.

 

Thanks.. I have authme thou.

 

Bukkit doesn't support Offline mode servers, and there's a couple exploits in AuthMe at the moment.

 

Oh? like what

 

I'm not going to post the exploits for AuthMe here - are you crazy?

 

LOL true.... Can u pm me them so I can look into this? or were can I find out cause i use authme and if thats true im SCREWED!

What program do you use for this? I tried notepads search featurde and it couldnt find //set tnt

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

It's not fixable until the author of AuthMe decides to fix it... and he might not for a while.

I suggest you make your server online-mode and not offline, since that's the only way to protect against this incident.

 

Hmm... Ok thanks for your advice!

 

That was just with Notepad++. I used the "find all" feature to get the nice list.

 

Locked. Offline mode is inherently insecure and not supportable.