To secure a Soldier of Fortune II server, use a long, unique rcon password and never share it, give admins your mod’s admin system instead, keep flood protection on, open only the game’s UDP port, and never run the server as root or an administrator. The original 2002 server has known exploits, so consider the open-source SoF2Plus engine, which fixes them.
1. Protect rcon
Rcon (remote console) gives full control of your server to anyone who knows the password. Treat it like the password to your hosting account.
- Make it long and random, at least 20 characters. It’s only typed by you, so it doesn’t need to be memorable.
- Keep it in
server.cfgonly, asseta rconpassword "…". Never post your config publicly without removing it. - Don’t share it with admins. Anyone with rcon can change the password and lock you out. Give trusted players admin through your mod instead.
- Change it whenever someone who knew it leaves your team, and after any sign of misuse.
How to log in and use it is in SoF2 admin commands.
2. Use your mod’s admin levels
RoCmod, OSP and 1fx. Mod each have their own admin system, where you give each admin a level that allows only certain commands, such as kick, mute or swap teams. That way admins can run the server day to day without the power to change its settings or passwords. See RoCmod and 1fx. Mod.
3. Keep flood and abuse protection on
| CVAR | What it does | Default | Recommended |
|---|---|---|---|
sv_floodProtect | Enables flood protection to prevent chat and command spamming. | 1 | 1 |
g_voiceFloodCount | Number of voice messages allowed in a period before flood protection activates. | 6 | — |
g_voiceFloodPenalty | Seconds a player is muted after triggering voice flood protection. | 60 | — |
g_allowVote | Allows players to call votes for map changes, kicks, and other actions. | 1 | 1 |
g_failedVoteDelay | Seconds players must wait before calling another vote after one fails. | 1 | — |
g_voteKickBanTime | Minutes a player kicked by vote is banned from reconnecting. 0 = kick only, no ban. | 0 | — |
sv_floodProtect 1limits how fast one player can send chat and commands. Leave it on.- Votes are useful on public servers, but a troll can spam them. A longer
g_failedVoteDelayslows that down. g_voteKickBanTimekeeps a player kicked by vote out for a few minutes, so they can’t rejoin straight away.
4. Bans
SoF2’s own ban list is a file set by sv_banFile (sof2mp.ban), used while sv_banFilter is on. Entries are IP addresses, added and removed with the addip and removeip commands. Mods have their own, easier ban commands, often with time limits. Remember that many players have IP addresses that change, so an IP ban isn’t permanent protection.
5. Lock down the machine
- Run the server as its own user, never as root on Linux or an administrator on Windows. If the server is ever compromised, the damage stays inside that account. The Linux hosting guide shows how.
- Open only what’s needed: the server’s UDP game port (20100 by default) and your own SSH or remote desktop access. Close everything else in the firewall.
- Use keys for SSH, not passwords, and turn off password login once keys work.
- Keep the operating system updated. Old game servers are usually the softest target on a machine.
- Back up your configs and mod files, so you can rebuild quickly if anything goes wrong.
6. Known exploits and SoF2Plus
The original SoF2 server from 2002 has known weaknesses that attackers can use to crash servers or read files through the download system, including the q3dirtrav and q3infoboom exploits. The open-source SoF2Plus engine, a replacement for the dedicated server, fixes these and adds multi-protocol cross play. It’s what the newer cross-play servers run. See versions and cross play for details and links.
7. Denial-of-service attacks
Game servers are sometimes flooded with traffic to take them offline. Settings in SoF2 can’t stop a large attack. What helps is choosing a host that includes network-level DDoS protection, which most game and VPS providers now do, and not publishing the real address of any other services you run on the same machine.
8. Keep logs
Game logs show who joined, who said what and who did what, which is what you need to deal with abuse fairly. See SoF2 server logs.
Frequently asked questions
How do I change my SoF2 rcon password?
Edit seta rconpassword "…" in your server.cfg, then restart the server, or set it from the server console.
Should I give admins the rcon password?
No. Use your mod’s admin system to give them only the commands they need. Rcon allows anything, including changing the password.
Which port does a SoF2 server need open?
Its UDP game port: 20100 by default, or whatever net_port is set to. Each server on the machine needs its own port.
Is the original SoF2 server safe to run?
It works, but it has known exploits from 2002. The open-source SoF2Plus engine fixes them, so it’s the safer choice for a public server.