Arma 3 Server Admin Guide: server.cfg, #Commands, Bans & BattlEye RCon

Arma 3 administration has two distinct surfaces: the in-game # commands (typed into chat by a logged-in admin) and BattlEye RCon (remote administration without being in-game, and the only way to manage BattlEye bans since the in-game #beserver command was disabled). Most guides blur the two - and the two separate ban systems behind them - so this reference keeps them explicit. Everything below is verified against Bohemia's official documentation.

Installing the server

The dedicated server is Steam app 233780, installed with SteamCMD - but unlike most dedicated servers, login anonymous does not work for it. You must log in with a real Steam account; per Bohemia's wiki the account does not need to own Arma 3, so best practice is a fresh no-purchase account dedicated to the server (SteamCMD caches credentials on the box, and one Steam account cannot be logged in from two places at once):

steamcmd
> force_install_dir ./arma3/
> login yourserveraccount
> app_update 233780 validate
> quit

The modern binary is arma3server_x64.exe (Windows) or arma3server_x86_64 (Linux); the 32-bit arma3server still exists but the x64 build is the one to run. A minimal launch line:

./arma3server_x86_64 -config=server.cfg -cfg=basic.cfg -profiles=./profiles -port=2302 -name=main

• -config= points at your server.cfg (everything in the next section)
• -cfg= points at the network tuning file (basic.cfg)
• -profiles= sets where logs, the server profile (difficulty settings) and the BattlEye folder live
• -port= sets the game port (default 2302)
• -mod="@CBA_A3;@ace" loads mods, semicolon-separated; -serverMod= loads server-side-only mods clients do not need
• -autoInit (with persistent = 1 in server.cfg) loads the first mission of the rotation on boot without waiting for a player

Since 2.22 you can run several servers from one installation by combining -port, -profiles, -mpmissions and -keysFolder per instance.

Ports

All UDP, derived from the game port as fixed offsets - with the default 2302, open 2302-2306:

A second instance on -port=2402 uses 2402-2406, and so on. Keep this range in mind later: the BattlEye RCon port must not be inside it.

The server.cfg options that matter

hostname        = "My Arma 3 Server";
//password      = "JoinPassword";   // uncomment to make the server private
passwordAdmin   = "AdminPassword";  // what #login asks for
admins[]        = { "76561198012345678" };  // these UIDs can #login with no password
maxPlayers      = 40;               // headless clients count as players!
persistent      = 1;                // mission keeps running with 0 players; needed for -autoInit

// security - note verifySignatures DEFAULTS TO 0 (off)
BattlEye            = 1;   // BattlEye anti-cheat (default 1)
verifySignatures    = 2;   // 2 = kick clients whose mods are not signed by a key in your keys folder
kickDuplicate       = 1;   // kick players with a duplicate ID
allowedFilePatching = 0;   // 0 block, 1 allow headless clients only, 2 allow all

// voting
voteMissionPlayers  = 1;
voteThreshold       = 0.33;   // fraction of players to pass a vote; 9999 effectively disables voting
allowedVoteCmds[]   = {
    { "admin", false, false },        // { command, preinit, postinit, threshold }
    { "kick",  false, true, 0.51 }    // per-command threshold override
};

// mission rotation
class Missions
{
    class Mission1
    {
        template   = "MyMission.Altis";   // pbo filename in MPMissions, without .pbo
        difficulty = "Regular";           // "Recruit", "Regular", "Veteran", "Custom"
    };
};

motd[]       = { "Welcome!", "Discord: discord.gg/yourserver" };
motdInterval = 5;
logFile      = "server_console.log";

Worth knowing: forcedDifficulty = "regular"; enforces a difficulty server-wide, but a difficulty set in the Missions cycle overrides it; missionWhitelist[] = { "intro.altis" }; limits what #missions offers; onUnsignedData = "kick (_this select 0)"; auto-kicks on unsigned files. After editing server.cfg, a logged-in admin can reload it live with #init.

Becoming admin

Press the chat key (/ by default), then:

#login AdminPassword

If your Steam UID is listed in admins[], plain #login with no password works. Rules the engine enforces: only one logged-in admin at a time (a second #login is refused until the first #logout), and a logged-in admin displaces a voted-in admin.

Players can also vote an admin in (#vote admin name), but a voted-in admin gets a reduced command set - they can kick, but only a logged-in admin can ban.

In-game admin commands

Always prefix with #. Session and mission control:

Player moderation - in Arma 3 the #exec forms require quotes around the name, UID or player number:

#kick troublemaker                    // by name, ID or player number
#kick "troublemaker" "spamming VON"   // with a reason (2.18+)
#exec ban "troublemaker"              // ban by name - writes their UID to ban.txt
#exec ban "3"                         // ban by player number (from #userlist)
#exec unban "76561198012345678"       // unban a UID
#exec clearbans                       // wipe ban.txt

Connection-quality guards and monitoring: #maxping 250, #maxdesync 95, #maxpacketloss 50, #dctimeout 60 set kick thresholds; #monitor 1 prints server FPS/bandwidth to you every second (#monitor 0 stops, #monitords does the same into the dedicated-server console); #userlist lists connected players with their numbers; #beclient guid shows your own BattlEye GUID.

The two ban systems

This is the part most admins get wrong - Arma 3 has two independent ban layers:

• Engine bans (ban.txt) - written by #exec ban, one Steam UID per line, in the server's root directory. Cheap to manage in-game, but keyed to the Steam UID.
• BattlEye bans (bans.txt) - GUID and IP bans, unified in one file in the BattlEye working directory. Managed only via RCon (the in-game #beserver command was disabled after an admin-hijacking exploit). A BE GUID cannot be changed client-side, which makes BE bans the stronger layer - evading one means buying a new copy of the game. Timed bans are stored with a unix end-timestamp and writeBans prunes expired ones.

BattlEye RCon setup

RCon is the recommended way to administrate an Arma 3 server: it works without being in-game and cannot be affected by in-game script exploits. Setup:

1. Find the BattlEye working directory: the battleye folder under your -profiles= path (or wherever -bepath= points).
2. Create BEServer_x64.cfg there (the x64 server reads the x64 name; beserver.cfg is for the 32-bit binary):

RConPassword yourRconPassword
RConPort 2310

1. RConPassword must not contain spaces. RConPort must be outside the reserved game range (game port +0 through +4, so 2302-2306 on defaults) - 2301 or 2310 are common picks. Optional RConIP binds it to one interface (unset = all).
2. Restart the server and connect with any BE RCon client using the server IP, RCon port and password.

The core RCon commands: players (list with BE GUIDs and pings), kick <#>, ban <#> <minutes> <reason> (0 or no time = permanent), addBan <GUID> <minutes> <reason> (ban someone not online), removeBan <ban#>, bans, loadBans (reload bans.txt), say -1 message (broadcast to everyone), missions, loadScripts (reload BE filters without a restart), #mission missionName to change mission remotely.

Mods and signature keys

Load mods with -mod="@CBA_A3;@ace". For a public modded server the contract is: each mod ships a .bikey public key - copy those into the server's keys folder, set verifySignatures = 2, and the server kicks any client running addons not signed by an accepted key. -serverMod= is for server-side-only mods (admin tools, logging) that clients do not need and are not signature-checked against joiners.

Linux gotcha: filenames are case-sensitive and several big mods (CUP Terrains, ALiVE) break if any file in the mod tree has uppercase letters. Lowercase the tree after each update:

find . -depth -exec rename 's/(.*)\/([^\/]*)/$1\/\L$2/' {} \;

(or mount the mods directory through ciopfs for a case-insensitive view if a sync tool keeps re-downloading renamed files).

Headless clients

A headless client offloads AI processing from the server process - it is a full Arma 3 client run with -client -connect=localhost -nosound -name=HC -mod=<same mods>, ideally on the same machine or LAN. Whitelist it in server.cfg:

headlessClients[] = { "127.0.0.1" };  // IPs allowed to connect as HC
localClient[]     = { "127.0.0.1" };  // IPs granted unlimited bandwidth

Two traps: a headless client needs a valid logged-in Steam account, and it counts toward maxPlayers - size your slot count accordingly. On BattlEye-enabled servers the HC profile needs battleyeLicense=1; in its .Arma3Profile (accepting the BE license once with a normal client does the same).

Running these in MantaScope

MantaScope's web RCON speaks BattlEye RCon, so you can run the moderation side from the browser - live player lists that surface BE GUIDs, kicks and persistent bans, scheduled restarts and messages, and chat-keyword alerts - without juggling a desktop RCon tool. MantaScope also tracks the live Arma 3 server list with mod lists decoded from the wire: browse populated servers, see population history and uptime, and claim your server to get monitoring, downtime alerts and Discord notifications alongside the in-game tools above.