Arma 3 Server Admin Guide: server.cfg, #Commands, Bans & BattlEye RCon
How to run and administer an Arma 3 dedicated server: the SteamCMD login trap, ports, the server.cfg options that actually matter, logging in as admin (#login, admins[], voted admins), the full in-game # command set, the two separate ban systems (ban.txt vs BattlEye bans.txt), BattlEye RCon setup, mod signatures with .bikey keys, and headless clients.
Arma 3 administration has two distinct surfaces: the in-game # commands (typed into chat by a logged-in admin) and BattlEye RCon (remote administration without being in-game, and the only way to manage BattlEye bans since the in-game #beserver command was disabled). Most guides blur the two - and the two separate ban systems behind them - so this reference keeps them explicit. Everything below is verified against Bohemia's official documentation.
Installing the server
The dedicated server is Steam app 233780, installed with SteamCMD - but unlike most dedicated servers, login anonymous does not work for it. You must log in with a real Steam account; per Bohemia's wiki the account does not need to own Arma 3, so best practice is a fresh no-purchase account dedicated to the server (SteamCMD caches credentials on the box, and one Steam account cannot be logged in from two places at once):
steamcmd
> force_install_dir ./arma3/
> login yourserveraccount
> app_update 233780 validate
> quit
The modern binary is arma3server_x64.exe (Windows) or arma3server_x86_64 (Linux); the 32-bit arma3server still exists but the x64 build is the one to run. A minimal launch line:
./arma3server_x86_64 -config=server.cfg -cfg=basic.cfg -profiles=./profiles -port=2302 -name=main
-config=points at yourserver.cfg(everything in the next section)-cfg=points at the network tuning file (basic.cfg)-profiles=sets where logs, the server profile (difficulty settings) and the BattlEye folder live-port=sets the game port (default 2302)-mod="@CBA_A3;@ace"loads mods, semicolon-separated;-serverMod=loads server-side-only mods clients do not need-autoInit(withpersistent = 1in server.cfg) loads the first mission of the rotation on boot without waiting for a player
Since 2.22 you can run several servers from one installation by combining -port, -profiles, -mpmissions and -keysFolder per instance.
Ports
All UDP, derived from the game port as fixed offsets - with the default 2302, open 2302-2306:
| Port | Purpose |
|---|---|
| 2302 | Game traffic + voice (VON) |
| 2303 | Steam query (game port +1) |
| 2304 | Steam master (+2) |
| 2305 | VON (reserved, currently unused) |
| 2306 | BattlEye (+4) |
A second instance on -port=2402 uses 2402-2406, and so on. Keep this range in mind later: the BattlEye RCon port must not be inside it.
The server.cfg options that matter
hostname = "My Arma 3 Server";
//password = "JoinPassword"; // uncomment to make the server private
passwordAdmin = "AdminPassword"; // what #login asks for
admins[] = { "76561198012345678" }; // these UIDs can #login with no password
maxPlayers = 40; // headless clients count as players!
persistent = 1; // mission keeps running with 0 players; needed for -autoInit
// security - note verifySignatures DEFAULTS TO 0 (off)
BattlEye = 1; // BattlEye anti-cheat (default 1)
verifySignatures = 2; // 2 = kick clients whose mods are not signed by a key in your keys folder
kickDuplicate = 1; // kick players with a duplicate ID
allowedFilePatching = 0; // 0 block, 1 allow headless clients only, 2 allow all
// voting
voteMissionPlayers = 1;
voteThreshold = 0.33; // fraction of players to pass a vote; 9999 effectively disables voting
allowedVoteCmds[] = {
{ "admin", false, false }, // { command, preinit, postinit, threshold }
{ "kick", false, true, 0.51 } // per-command threshold override
};
// mission rotation
class Missions
{
class Mission1
{
template = "MyMission.Altis"; // pbo filename in MPMissions, without .pbo
difficulty = "Regular"; // "Recruit", "Regular", "Veteran", "Custom"
};
};
motd[] = { "Welcome!", "Discord: discord.gg/yourserver" };
motdInterval = 5;
logFile = "server_console.log";
Worth knowing: forcedDifficulty = "regular"; enforces a difficulty server-wide, but a difficulty set in the Missions cycle overrides it; missionWhitelist[] = { "intro.altis" }; limits what #missions offers; onUnsignedData = "kick (_this select 0)"; auto-kicks on unsigned files. After editing server.cfg, a logged-in admin can reload it live with #init.
Becoming admin
Press the chat key (/ by default), then:
#login AdminPassword
If your Steam UID is listed in admins[], plain #login with no password works. Rules the engine enforces: only one logged-in admin at a time (a second #login is refused until the first #logout), and a logged-in admin displaces a voted-in admin.
Players can also vote an admin in (#vote admin name), but a voted-in admin gets a reduced command set - they can kick, but only a logged-in admin can ban.
In-game admin commands
Always prefix with #. Session and mission control:
| Command | What it does |
|---|---|
#missions | Open mission selection (careful: this ends the current mission) |
#mission myMission.Altis Veteran | Load a specific mission, difficulty optional |
#restart | Restart the current mission |
#reassign | Restart and send everyone back to role selection |
#lock / #unlock | Close / reopen the server to new joins |
#shutdown | Stop the server immediately |
#restartserver | Full server process restart |
#shutdownaftermission / |
Player moderation - in Arma 3 the #exec forms require quotes around the name, UID or player number:
#kick troublemaker // by name, ID or player number
#kick "troublemaker" "spamming VON" // with a reason (2.18+)
#exec ban "troublemaker" // ban by name - writes their UID to ban.txt
#exec ban "3" // ban by player number (from #userlist)
#exec unban "76561198012345678" // unban a UID
#exec clearbans // wipe ban.txt
Connection-quality guards and monitoring: #maxping 250, #maxdesync 95, #maxpacketloss 50, #dctimeout 60 set kick thresholds; #monitor 1 prints server FPS/bandwidth to you every second (#monitor 0 stops, #monitords does the same into the dedicated-server console); #userlist lists connected players with their numbers; #beclient guid shows your own BattlEye GUID.
The two ban systems
This is the part most admins get wrong - Arma 3 has two independent ban layers:
- Engine bans (
ban.txt) - written by#exec ban, one Steam UID per line, in the server's root directory. Cheap to manage in-game, but keyed to the Steam UID. - BattlEye bans (
bans.txt) - GUID and IP bans, unified in one file in the BattlEye working directory. Managed only via RCon (the in-game#beservercommand was disabled after an admin-hijacking exploit). A BE GUID cannot be changed client-side, which makes BE bans the stronger layer - evading one means buying a new copy of the game. Timed bans are stored with a unix end-timestamp andwriteBansprunes expired ones.
BattlEye RCon setup
RCon is the recommended way to administrate an Arma 3 server: it works without being in-game and cannot be affected by in-game script exploits. Setup:
- Find the BattlEye working directory: the
battleyefolder under your-profiles=path (or wherever-bepath=points). - Create
BEServer_x64.cfgthere (the x64 server reads the x64 name;beserver.cfgis for the 32-bit binary):
RConPassword yourRconPassword
RConPort 2310
RConPasswordmust not contain spaces.RConPortmust be outside the reserved game range (game port +0 through +4, so 2302-2306 on defaults) - 2301 or 2310 are common picks. OptionalRConIPbinds it to one interface (unset = all).- Restart the server and connect with any BE RCon client using the server IP, RCon port and password.
The core RCon commands: players (list with BE GUIDs and pings), kick <#>, ban <#> <minutes> <reason> (0 or no time = permanent), addBan <GUID> <minutes> <reason> (ban someone not online), removeBan <ban#>, bans, loadBans (reload bans.txt), say -1 message (broadcast to everyone), missions, loadScripts (reload BE filters without a restart), #mission missionName to change mission remotely.
Mods and signature keys
Load mods with -mod="@CBA_A3;@ace". For a public modded server the contract is: each mod ships a .bikey public key - copy those into the server's keys folder, set verifySignatures = 2, and the server kicks any client running addons not signed by an accepted key. -serverMod= is for server-side-only mods (admin tools, logging) that clients do not need and are not signature-checked against joiners.
Linux gotcha: filenames are case-sensitive and several big mods (CUP Terrains, ALiVE) break if any file in the mod tree has uppercase letters. Lowercase the tree after each update:
find . -depth -exec rename 's/(.*)\/([^\/]*)/$1\/\L$2/' {} \;
(or mount the mods directory through ciopfs for a case-insensitive view if a sync tool keeps re-downloading renamed files).
Headless clients
A headless client offloads AI processing from the server process - it is a full Arma 3 client run with -client -connect=localhost -nosound -name=HC -mod=<same mods>, ideally on the same machine or LAN. Whitelist it in server.cfg:
headlessClients[] = { "127.0.0.1" }; // IPs allowed to connect as HC
localClient[] = { "127.0.0.1" }; // IPs granted unlimited bandwidth
Two traps: a headless client needs a valid logged-in Steam account, and it counts toward maxPlayers - size your slot count accordingly. On BattlEye-enabled servers the HC profile needs battleyeLicense=1; in its .Arma3Profile (accepting the BE license once with a normal client does the same).
Running these in MantaScope
MantaScope's web RCON speaks BattlEye RCon, so you can run the moderation side from the browser - live player lists that surface BE GUIDs, kicks and persistent bans, scheduled restarts and messages, and chat-keyword alerts - without juggling a desktop RCon tool. MantaScope also tracks the live Arma 3 server list with mod lists decoded from the wire: browse populated servers, see population history and uptime, and claim your server to get monitoring, downtime alerts and Discord notifications alongside the in-game tools above.