MUD Security Hardening Checklist

Disable password-based SSH access and rotate keys when staff changes.

Do not reuse in-game passwords for shell, database, or panel access.

Confirm only active staff retain shell, deploy, or backup permissions.

Limit full host administration to the smallest possible number of maintainers.

Keep a tested process for revoking access if an account is compromised.

Expose only the game port, SSH, and any intentionally public web services.

Patch the host on a predictable schedule so known package issues do not linger.

Throttle repeated connection attempts and obvious abuse at the firewall or gateway layer.

Avoid running the MUD process as root or under a shared system account.

Confirm crashes and host reboots do not leave stale sockets or unsafe temp files behind.

Store password hashes instead of plaintext or reversible secrets.

Protect characters, boards, account data, and configs with automated backups.

Avoid writing passwords, tokens, or private admin notes into general logs.

Ensure only the game service user and trusted admins can read persistent world data.

Perform a restore drill so backups are proven usable before an emergency.

Review command parsing, buffer handling, and copy routines in older C code paths.

Verify OLC, reload, and debug commands cannot be reached by normal players.

Test rent, corpses, shops, containers, and copyover flows for item duplication.

Throttle spammy commands such as who, score, or auction if they stress the server.

Review any bots, web endpoints, or webhook consumers that can issue privileged actions.

Notice brute-force attempts or bot traffic before they turn into downtime.

Capture restarts, bans, object restores, and sensitive commands in a searchable format.

Have short copy ready for login banners, Discord, or forums during a security event.

List how to isolate the host, preserve evidence, and restore safe service quickly.

Recheck access, logs, backups, and exploit tests on a regular calendar.