hardening/server-cfg-hardening.cfg

1# hoaxeye — FXServer hardening baseline (server.cfg excerpt)2#3# Safe defaults that reduce the blast radius of the advisories on this site. None of4# this is secret — it is operator hygiene every FiveM server should already run.5 6# --- Admin surface ---------------------------------------------------------7# Never expose txAdmin (default TCP 40120) to the public internet. Bind it behind a8# VPN or a reverse proxy with authentication. See HXA-2026-002.9# (configure at the OS / firewall level, not in server.cfg)10 11# --- Resource trust --------------------------------------------------------12# Only load resources you have reviewed. Native (.node) modules in a third-party13# resource are a red flag — see HXA-2026-001.14# Audit before ensure:  find resources/ -name '*.node' -o -name '*.dll'15 16# --- Event hardening -------------------------------------------------------17# Keep server builds current; the net-event handlers receive security fixes there.18sv_enforceGameBuild 309519 20# Rate-limit connection floods at the edge (values are a starting point).21set sv_authMaxVariance 122set sv_authMinTrust 423 24# --- Endpoints -------------------------------------------------------------25# Do not advertise more than you must; keep the query endpoint scoped.26sv_endpointPrivacy true27 28# --- Logging ---------------------------------------------------------------29# Ship server logs off-host so an attacker who lands cannot trivially wipe them.30set sv_logFile "/var/log/fxserver/server.log"