CS2 RCON and Admin Commands: Run and Manage Your Server

Server console vs RCON: what is the difference?

Every command in this guide is an ordinary console command. The only question is how it reaches the server process.

RCON is the Source engine's remote console protocol. Valve documents it as a TCP protocol: the client authenticates first, and commands are only accepted after authentication succeeds. If rcon_password is empty, every authentication attempt is refused, so an unset password means RCON is effectively off rather than open.

Setting the RCON password

The game's setting is the rcon_password cvar. On ChicagoServers you set it in the panel rather than in a config file. If you are new to config files, the server.cfg and game modes guide explains the load order.

1. Open the Startup tab

   Sign in at panel.chicagoservers.co, open your server, then the Startup tab.

2. Enter the password

   Type a long random value into RCON password. Click Show to check it.

3. Save and restart

   Click Save startup, then Restart at the top of the page. The new password applies at the next start.

Settings the panel controls, including passwords, are written from the Startup tab at every start. A rcon_password line in server.cfg on the Configs tab therefore does not stick. Do not put the password on a command line either: process lists show command lines to every user on a machine, and on ChicagoServers the command line is staff-only anyway.

• Use a long random value (20 or more characters) and store it in a password manager.
• Avoid double quotes and semicolons inside the password. In a config file a semicolon starts a new command, so a password containing one can be cut short.
• Changing the RCON password closes every authenticated RCON connection, even if the new value matches the old one. Clients must reconnect. That makes a password change a handy way to kick out an old session.
• Remember that the field now holds a secret. A sub-user with the Startup permission can open that tab, so only give it to people you trust.

Several hosting guides say you must also add the -usercon launch option before RCON will listen at all. Valve's dedicated server page does not list it, so we cannot confirm it from Valve. There is no Startup field for it and the command line is staff-only, so if an external RCON client refuses connections with a correct password and an open port, contact support and mention -usercon.

Connecting with RCON

RCON uses TCP, not UDP. By Valve's documentation it listens on the same number as the server port, 27015 by default, and follows the -port option if you change it. That has two practical consequences: TCP must be reachable on the game port (game traffic itself is UDP), and RCON clients need the server's IP and that port. On ChicagoServers the panel assigns the ports (see Startup, Network) and you do not open a firewall yourself; if an external client cannot connect, contact support.

1. Pick an RCON client

   Use a third-party RCON client, command-line tool or web console that speaks the Source RCON protocol. Several open-source ones exist; choose one you trust and keep it updated.

2. Enter address, port and password

   Use the server IP and the game port (for example 27015) from the address at the top of your server page, and the RCON password you set on the Startup tab.

3. Run a harmless test

   Send status. If you see the hostname, map and player list, RCON works.

4. Or try the in-game route

   From your own game console you can set rcon_address and rcon_password and prefix commands with rcon. Treat this as optional.

   Copy

   rcon_address 203.0.113.10:27015
   rcon_password your-password
   rcon status

Long outputs such as the player list can arrive as several packets, which is normal for the protocol and handled by decent clients.

Admin command reference

These commands exist in CS2 according to community references and current server guides. On ChicagoServers, type them on the Console tab and press Send. A few notes: map names are the file names such as de_mirage, and arguments in angle brackets are values you supply.

Bans made with banid have limits. They are stored in simple files, carry no reason or expiry text, and are not shared between servers. Several host guides also note that the banid family can behave inconsistently across CS2 builds, so verify with listid after banning and consider a plugin with a database if bans matter to you.

Match, bot and cheat commands

These cvars shape how a round or match plays. Many are covered in depth in the server.cfg and game modes guide; here are the ones admins reach for mid-session.

One common gotcha: the game-mode config for the current mode can run when a map loads and reset mp_ cvars you set earlier in server.cfg. If a value reverts after changelevel, set it in the mode-specific config (a mode-only config on the Configs tab for Competitive, Casual and Deathmatch) or run it with exec after the map loads. Bots also change how a server looks in the server browser, which matters if you keep bots on a public server.

// Example: quick scrim reset, sent one command at a time
mp_warmup_end
mp_restartgame 1
say Match is live - good luck!

To send commands on a timer, such as a say warning before a restart, use the Schedules tab: under Add a scheduled task, choose When, then Add a step with Send console commands, a Wait 5 minutes step and Restart the server, and click Add task.

Admins and bans: what the game offers vs what needs a plugin

CS2 does not ship a built-in admin list with permission levels. In practice, anyone who knows the RCON password can do anything an RCON client can, and the in-game server browser treats everyone else as an ordinary player. Everything finer than that is the job of a plugin.

The usual route is Metamod:Source plus CounterStrikeSharp and an admin plugin, with admins identified by SteamID64. CounterStrikeSharp's admin framework is configured with JSON files in its configs folder (on ChicagoServers, CounterStrikeSharp admins on the Configs tab), but installing the framework does not add chat commands by itself. The plugin installation guide explains the install and verification steps. These are third-party projects; they are not provided or supported by Valve, and ChicagoServers does not support individual plugins.

If you have staff who only need file or console access, sub-users are usually safer than handing out the RCON password. Click Sub-users in the left menu, enter their email under Add someone, tick the server and their permissions (for example Console, or Files for SFTP) and click Give access. Each person gets their own login that you can revoke.

Securing RCON

RCON is powerful and, by design, simple. Valve's protocol documentation shows the password as readable text in the authentication packet, and the protocol has no encryption of its own. Anyone who can watch the traffic between you and the server could read the password. Plan accordingly.

• Use a unique, long password and never reuse a password from another account.
• Limit who can connect. Prefer the Console tab and sub-users over handing out the RCON password. If you need an external client and want to restrict it by source address, ask support what is possible.
• Do not connect over untrusted networks such as public Wi-Fi without a VPN or SSH tunnel.
• Keep it out of screenshots, chat logs and public repositories. Config files committed to version control are a classic leak.
• Rotate it when staff leave or if you suspect it leaked. Change RCON password on Startup and restart, which drops existing sessions.
• Watch the logs. Repeated failed attempts mean someone is guessing. Some community references mention sv_rcon_maxfailures and sv_rcon_banpenalty to throttle guessing, but they report these as hidden or unreliable in retail CS2, so do not rely on them: a strong password and a restricted source address do the real work.

DDoS protection and RCON security are different problems. Network filtering, such as the 40Gbps DDoS protection included with ChicagoServers CS2 servers, absorbs floods but does not protect a weak password.

Common mistakes

• Typing rcon on the Console tab. The prefix is only for sending commands from a client. On the Console tab just type the command.
• Editing rcon_password in server.cfg and expecting it to stick. The panel writes the password from the RCON password field at every start, so change the Startup field instead.
• Forgetting writeid. A ban that exists only in memory disappears on restart.
• Kicking by name. Similar names, spaces and Unicode make it error-prone. Use status and kickid.
• Leaving sv_cheats 1 on. Always set it back and keep it out of your standard configs.
• Setting mp_ cvars in the wrong file and finding them reset after a map change.
• Handing the RCON password to everyone. Port scanners find open game ports quickly, so keep the password to people who need it and give the rest sub-user access.
• Using client-only commands. Commands such as map_workshop are for your game client. On a server, use host_workshop_map or changelevel.
• Trusting a stale tutorial. CS:GO-era commands and cvars, including old rate and tick settings, may not exist in CS2. If a command is unknown, check it against current documentation instead of assuming a typo.

Frequently asked questions