Securing a Bukkit server for public usage

After hosting a server for a group of friends for a while, I decided I want to open up a public server. I'm pretty much just looking for some security and preparation advice from people who actually run public servers, so I don't accidentally overlook some aspect of it.

I already know that I should have a permissions plugin and probably a prop protection plugin. What are some other things that will come in handy? Are there any DoS protection plugins?

Thanks ahead of time

 

• Prefer hosing your server on a linux computer managed by professionals or use a dedicated hosting company. It costs money, but your home internet connections is not cut out to host a public minecraft server.
• Install a firewall on your server and configure it to only allow Minecraft and remote administration (sh).
• Make your server an online-mode server. It's safer for you and your players, and offline-mode servers are lame and will receive no support here.
• Add a remote console plugin like SSHD so you can log into the server console remotely.
• Add a remote administration plugin like Adminium so you can help players while you aren't logged in (from your phone).
• Add a block forensics plugin like LogBlock so you can retroactively investigate and fix griefing.
• Add some basic anti-grief plugins to limit hack clients.
• Add a resource obfuscation plugin like Orefuscator to cut down on x-ray hacking.
• Decide if a universal ban plugin is right for you. They are controversial, but keep out some of the noise.
• Don't worry about DoS until you are big enough to be a meaningful target.
• Do something to make your server unique. Have a theme, or maybe a backstory. Please don't create yet another prison/hungergames/minigames/factions server.

 

Are there any DoS protection plugins?
No, DoS or DDoS is not something that can really be prevented by any plugin. That is something you will have to rely on your host for.
If you choose to host it yourself, which I do not recommend unless you have a good machine and a great internet connection, then that is a whole other story.

What are some other things that will come in handy?
Adding to deltahat you should get CoreProtect. It logs block changes and can roll them back, even chests. It is the most advanced plugin out there for that kind of thing.
I do not recommend any universal ban system. They are unreliable. Adding to this, a solid moderation team is in order. Get some of your most trusted friends to be moderators to start with, and then hire. Only accept the best and most well thought out applications, as all the others are 10-year-old wanting to be big bad moderators, and they will only abuse their power.
Get a site. If you have money to drop, go for XenForo, it is AMAZING. This very site is a XenForo site if I'm not mistaken.

 

I've been renting a Linode VPS for the past year or so, so hosting is already covered. That is where I was hosting the server for me and my friends from. Also, I've got the actual system secured (for the most part), so that isn't an area of concern. I will look into some basic DoS prevention methods though.

But thanks for the tips, well appreciated! I'll probably talk with my friends and come up with a theme for the server. And of course, have them on as my first moderators. I'm already well aware that hosting won't be profitable, or at least until I get popular (if I do), and I don't really care about that haha. I just think it would be fun to host a public server, since I'm already paying for a VPS anyway. Of course, I certainly wouldn't complain about a bit of side income though.

As to a website: hosting a website should be pretty trivial, since I already have a full Linux server running. Just a quick Apache install, PHP, and a bit of locking down, and it should be good to go! I'll stick to a hand-glued website at first, but definitely look into some of the paid solutions if I do manage to get popular.

Anyway, thank you for the suggestions, I'll look into the plugins you guys mentioned!

 

You might consider adding protection against cheating, e.g. Orebfuscator against xray and a plugin similar to NocheatPlus for other typical cheats (fighting, block breaking, flying,...).