SteamAuth Ticket Refresh vs. RCON Password Rotation: Which Best Supports Least‑Privilege on Source Servers?

Answer

SteamAuth ticket refresh provides the tighter least‑privilege mechanism for player access on a Source engine server, while RCON password rotation remains necessary for administrator access but offers only a shared secret.

Confirmed facts

• SteamAuth tickets are bound to an individual SteamID, have a short lifetime (≈24 h by default), and are validated against Steam’s backend each time they are presented.
• RCON relies on a single shared password; rotation limits the window of exposure but any compromise grants full administrative control until the next change.
• Both mechanisms require a recent Source Dedicated Server (SRCDS) build that supports SteamAuth (post‑2013) and has RCON enabled.

Recommended steps

1. Enable SteamAuth validation
   • Start the server with the -secure flag (or set sv_secure 1 in server.cfg).
   • Ensure the server can reach the Steam Web API (outbound HTTPS to api.steampowered.com).
   • Optionally adjust the ticket lifetime with sv_steamgroup or sv_steamauth_ticket_life if your build exposes such a cvar; otherwise accept the default ~24 h.
2. Automate ticket refresh for players
   • No server‑side action is required; the Steam client automatically obtains a new ticket when the current one nears expiry and the server prompts for re‑authentication on the next map change.
   • Monitor logs for entries like SteamAuth ticket validated for SteamID X to confirm validation is occurring.
3. Implement RCON password rotation with network restriction
   • Change the RCON password regularly (e.g., weekly) using rcon_password \"newStrongPass\" in server.cfg or via an RCON call.
   • Restrict RCON traffic to trusted admin IPs with a firewall rule, for example:

   # iptables example (adjust interface and port as needed)
   iptables -A INPUT -p tcp --dport 27015 -s 203.0.113.45 -j ACCEPT
   iptables -A INPUT -p tcp --dport 27015 -j DROP
   

   • After rotation, verify that the old password no longer works and the new password grants access:
   1. Attempt rcon -P oldPass status – should fail.
   2. Attempt rcon -P newPass status – should succeed and return server info.
4. Monitoring and verification
   • Check the server console or log file for SteamAuth validation messages after each player connects.
   • Log RCON login attempts (many servers log successful and failed RCON auth).
   • Set up a simple alert if a failed RCON attempt occurs from an unexpected IP.

Missing diagnostic detail

If you cannot confirm that the server’s outbound HTTPS to api.steampowered.com is allowed, please verify firewall egress rules; a blocked Steam Web API will cause ticket validation to fall back to less secure methods and would change the recommendation.