Punishments and bans

Actions#

When a detection fires, AstroShield chooses an action. Built-in detections ban. The other actions are used by custom rules (kick) and by your own code through punishPlayer.

A few detections never punish at all. They protect or clean up, like the vehicle weapons cleaner. They are marked No punishment in the detection reference.

Three things stop a punishment even for a normal detection:

• the player is an admin excluded by the txAdmin whitelist,
• Dev Mode is on, so detections are only logged,
• the player is already being banned.

The ban flow#

1. A case is opened. Every detection gets a case ID like AS-261009143012-12-K3F9. It collects the reason, the detection data, the player's identifiers and tokens, a snapshot of their state (position, health, armor, weapon, vehicle) and their last server events.
2. The player is isolated. They are moved to a separate routing bucket (bucket 666 by default) so they can no longer affect anybody while the ban is prepared.
3. Evidence is requested. AstroShield asks the player's client for a short video clip of the game view, and waits a few seconds for it. Without a clip the ban still goes ahead.
4. The record is stored. The ban is sent to the backend, which gives it its ban ID. If the backend does not answer within a few seconds, the case ID is used instead and the record is linked later.
5. The player is dropped with your ban message, their ban ID, the detection and the reason.
6. The rest follows. The astroshield:player:punished event is fired and your ban webhook is posted.

Bans made by custom rules for a player who is still connecting skip steps 2 and 3, because the player is not in the game yet. The connection is refused straight away.

What the player sees#

A banned player gets a message with, in order:

• your Ban Message,
• the Ban ID,
• the Detection and the Reason,
• your Ban Subtitle, for example how to appeal,
• an appeal link when the Discord button is on.

Set the texts under Configuration, General. See Configuration.

When a banned player tries to join again, they are stopped at the connection screen with a ban card that shows the same information, a Discord button if you enabled it and a button to the AstroShield website. The check is made against the dashboard's current list while the card is on screen, so a ban you just removed does not keep the player out.

Who is matched#

A ban holds back a person, not just an account. It matches on any of these:

• the player's license, license2, Steam, Discord, FiveM, Xbox and Live identifiers,
• their IP address,
• their hardware tokens.

When the backend is unreachable#

AstroShield does not depend on the connection to ban or to refuse a banned player:

• A ban is remembered on your server straight away and keeps the player out for a day, so a banned player cannot reconnect in the meantime. A ban that was interrupted by a restart is finished on the next start.
• If the ban record cannot be sent, it is queued, up to 200 records, and retried every 30 seconds.

The astroshield case console command lists the recent cases that the server remembers. See Console commands.

Webhooks#

Set your Discord webhook URLs under Configuration, General. See Webhooks.

AstroShield also posts a Backdoor Alert to the bans webhook when Anti Backdoor sees a resource contact a suspicious address.

Mentions are always disabled in the messages, so a player's name can never ping your staff.

Lifting a ban#

• In the dashboard, on the Bans page.
• In the in-game panel, on its Bans page.
• In the server console: astroshield unban <id>. See Console commands.
• From a script. See Ban records.