How to enable RCON on a Minecraft server safely

RCON lets external tools send console commands to your Minecraft server over the network. To enable it, set enable-rcon=true, a strong rcon.password, and an rcon.port that matches an extra port allocation on your server. Only do this if you actually need it.

Do you need RCON?#

Probably not. The Schokr console already gives you a full live server console in your browser, and teammates can be given console access through team roles. RCON is only useful for things like:

• a Discord bot that runs whitelist or say commands,
• a website or script that manages the server,
• an external admin tool.

Security risks#

• RCON is not encrypted. The password and commands travel in plain text.
• RCON gives full console access. Anyone with the password can op themselves, stop the server or wipe data with commands.
• Exposed RCON ports are scanned and brute-forced. A short or common password will be found.

If you do enable it, use a long random password and never reuse it anywhere.

1. Add a port for RCON#

RCON needs its own port, separate from the game port. Your server starts with one port allocation, used by Minecraft itself. Add a second allocation in your server's Network section. Extra allocations cost 25 credits each (unlimited with Schokr One). Note the new port number.

2. Configure server.properties#

1. Stop the server.
2. Edit server.properties:

enable-rcon=true
rcon.port=25612
rcon.password=use-a-long-random-password-here-3f9b2c7d1e
broadcast-rcon-to-ops=false

Replace 25612 with the port of your new allocation. RCON's default port is 25575, which will not work unless it happens to be the port you were allocated.

3. Save and start the server. The console should show that the RCON listener has started on your port.

Generate the password with a password manager, at least 24 random characters.

3. Connect#

Use an RCON client such as mcrcon:

mcrcon -H <server-address> -P 25612 -p 'your-password' "list"

Replace <server-address> with your server's IP or hostname from the console (without the game port).

Keep it safer#

• Change the password if anyone who knew it leaves your team or the tool is retired.
• Give your bot or tool only the commands it needs, and validate any user input before passing it to RCON, so nobody can inject extra commands.
• Turn RCON off (enable-rcon=false) when you stop using it, and remove the extra allocation.
• broadcast-rcon-to-ops=true shows RCON commands to online ops, which is useful for auditing.

RCON not connecting?#

• rcon.port must exactly match an allocated port on your server.
• Check the console for an RCON startup message or an error such as the port already being in use.
• Make sure you are not using the game port for RCON.