Add a Rust server: setting up RCON and SSH access

From a bare Rust dedicated server to one the panel can see and manage.

What the panel needs

• RCON: the server's address, its RCON port and its RCON password. This is all you need to connect.
• SSH (optional): a user and private key on the machine the server runs on, for anything that touches files.

What each one unlocks

RCON alone gives you the live side: the console, the player list, chat, kicks and bans, the activity feed and the server's stats. The panel connects over RCON and stays connected, so this is everything that happens while the server is running.

RCON and SSH adds everything that has to change a file on the host:

• wipes (deleting the map and save files, keeping or clearing blueprints, setting the next seed),
• installing and updating Oxide plugins, including plugin packages with data files,
• installing Oxide itself,
• changing the server's name, description and other startup settings,
• map renders, which are made from the server's map file.

Step 1: find your RCON settings

RCON is configured by startup arguments to RustDedicated, usually in a start script, a systemd unit or a container's environment. Look for these:

+rcon.web 1
+rcon.port 28016
+rcon.password "a-long-random-password"

• rcon.web picks the protocol. 1 is websocket RCON, which is what the panel speaks. 0 is the older Source-engine RCON, which Facepunch has deprecated and the panel cannot use. It defaults to 1, so if it isn't in your arguments at all, you're fine.
• rcon.port is a TCP port, separate from the game port players join on (server.port, UDP). 28016 is the usual choice beside a game port of 28015, but any free port works.
• rcon.password is the password. Make it long and random: the port has to be reachable from the internet, so this password is the only thing protecting full control of your server.
• If you see rcon.ip, it must be an address the panel can reach. A server set to +rcon.ip 127.0.0.1 only accepts RCON from its own machine.

Change any of these and restart the server: they are read at startup.

Step 2: make the RCON port reachable

The panel connects to your server from outside, so the RCON port has to be open to the internet, over TCP:

• Host firewall, for example sudo ufw allow 28016/tcp.
• Cloud firewall or security group, if your provider has one. It sits in front of the host and has to allow the port separately.
• Home router: forward the port to the machine running the server.
• Docker: publish the port as TCP, for example -p 28016:28016/tcp. Publishing only the UDP game ports is a common reason RCON can't be reached.

Step 3: add the server

1. Sign in and open Servers, then + Add server.
2. Enter the Host (your server's public address or domain name), the RCON port and the RCON password.
3. Press Test connection. Add server stays disabled until a test succeeds, so you can't save a server the panel can't reach.
4. Press Add server. Players, chat and the console fill in once it connects.

Step 4 (optional): set up SSH

Use a dedicated account for the panel, not the account the game runs as, and not root. Add it to the game's group so it can write the game's files:

sudo adduser --disabled-password --gecos "" rustd
sudo usermod -aG <game-group> rustd

Make a key pair for it. Use an RSA key: the panel does not accept ed25519 keys yet.

ssh-keygen -t rsa -b 4096 -f rustd-panel -N ""
sudo mkdir -p ~rustd/.ssh
sudo cp rustd-panel.pub ~rustd/.ssh/authorized_keys
sudo chown -R rustd: ~rustd/.ssh
sudo chmod 700 ~rustd/.ssh && sudo chmod 600 ~rustd/.ssh/authorized_keys

Then, in the panel:

1. Open Credentials, press + Add credential, and enter the host, the SSH port (22 unless you changed it), the username, and the contents of the rustd-panel private key file. Press Test connection, then Save.
2. Open your server's Settings. Under Access, pick the credential, then set the game install path: the directory that contains RustDedicated, or for a container, the host directory its install is mounted from. Browse lets you pick it.

The add-server page lists exactly which directories the SSH user must be able to write, and with what permissions. Anything it can't write is refused up front, with the path and the user named, before anything changes.

One more thing before you schedule wipes: the panel restarts the server for them, and a Rust server told to restart exits. Something on the host has to start it again, such as a systemd unit with Restart=always or a container with restart: unless-stopped.

When it won't connect

RCON: "Could not reach the server"

• The port isn't open. Test it from another machine: nc -vz your.server.address 28016. If that hangs or is refused, go back through Step 2. Check each layer: host firewall, cloud firewall, router, Docker.
• The server isn't listening where you think. On the host, ss -ltn | grep 28016 should show 0.0.0.0:28016. Nothing means a different rcon.port, or the server hasn't finished starting. 127.0.0.1 means rcon.ip is limiting it to local connections.
• rcon.web 0. The port is open and the server is up, but it's speaking the old protocol. Set +rcon.web 1 and restart.
• Wrong password. Copy it exactly as it is in the startup arguments, without the quotes around it.
• Too many wrong passwords. After 5 failed attempts the server bans the connecting address from RCON for 5 minutes, and a correct password doesn't help until the ban ends. Wait it out, or run rcon.clear_rcon_failed_logins in the server console.

SSH: the credential test fails

• "Could not reach …" means the SSH port isn't reachable. The same firewall layers apply, this time to TCP 22 or your SSH port.
• "Connected, but authentication was rejected" means the address is right and the login is wrong. The usual causes: the wrong username (the user you made for the panel, not your own), the public key not in that user's authorized_keys, permissions on ~/.ssh too open (sshd ignores keys it doesn't trust), or Tailscale SSH answering on port 22, which doesn't accept keys. Use the regular sshd port instead. An ed25519 key also lands here, even if it is in authorized_keys: make an RSA one as in Step 4.
• "Connected but SFTP is unavailable" means the login works but the SFTP subsystem is off. Wipes and map renders transfer files over it, so enable it in sshd_config (Subsystem sftp).