Running a Squad dedicated server on bare metal

What the server is and where it runs

The server ships as its own Steam app, 403240, separate from the game client. It downloads with login anonymous, which keeps your personal Steam credentials off the box. The Official Squad Wiki's installation guide covers Windows and Linux hosts; on Linux it assumes a 64-bit distribution with GLIBC 2.17 or higher, and the binary is started with SquadGameServer.sh from the install directory.

Configuration is a folder of text files, SquadGame/ServerConfig/. The three that decide whether a server is usable are Server.cfg (name, slots, rotation, rules), Admins.cfg (who can kick, ban and change maps) and Rcon.cfg (remote console). Next to them sit Bans.cfg, LayerRotation.cfg, VoteConfig.cfg, ServerMessages.cfg, the optional Motd.cfg and License.cfg, which holds the key Offworld issues to licensed servers.

Ports to open and ports to keep closed

The wiki's port list, with the defaults the start line sets through Port=, QueryPort= and beaconport=:

The wiki adds that Squad talks to each client over ephemeral UDP ports after the first connection, and that depending on the provider you may need to allow UDP above 30000. Our view, not the wiki's: a stateful firewall such as ufw already admits the replies to traffic the server sent first, so treat that rule as a troubleshooting step for players who connect and then drop, not a default.

A second instance on the same box needs its own game, query, beacon and RCON ports. The wiki's configuration page says the beacon port must be unique per server, and the installation page's multi-instance example moves RCON from 21114 to 21124.

Install on Linux as a service user

Valve's SteamCMD page warns against running SteamCMD as root, and the Squad wiki recommends a lower-privilege user for the server. The steps below create one, install SteamCMD by hand per Valve's manual method, pull the server, and set up ufw before anything listens. Run them as your own sudo user on Ubuntu or Debian.

sudo apt update && sudo apt install -y lib32gcc-s1 curl ufw
sudo useradd -m -s /bin/bash squad
sudo -u squad bash -c 'mkdir -p /home/squad/steamcmd && cd /home/squad/steamcmd && curl -sqL "https://client-update.steamstatic.com/installer/steamcmd_linux.tar.gz" | tar zxvf -'
sudo -u squad bash -c '/home/squad/steamcmd/steamcmd.sh +force_install_dir /home/squad/server +login anonymous +app_update 403240 validate +quit'

# firewall: switch on IPv6 BEFORE adding any rule, then SSH plus the public Squad ports only
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
grep IPV6 /etc/default/ufw          # check: IPV6=yes
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 7787:7788/udp
sudo ufw allow 27165:27166/udp
sudo ufw allow 27165:27166/tcp
sudo ufw allow 15000
sudo ufw --force enable
sudo ufw status verbose             # each rule should also show a (v6) line

force_install_dir comes before login, as Valve's documentation orders it. The sed line comes first on purpose: rules added while IPV6=no never get IPv6 copies, and a later reload does not add them. With IPV6=yes set beforehand, every rule and the default deny cover both families; nothing else on the machine, RCON included, is reachable from outside.

Run it under systemd

The wiki's Linux guide stops at screen and leaves boot-time start to the reader. A unit file does that job: it runs the server as squad, updates through SteamCMD before each start, and restarts it after a crash. Save it as /etc/systemd/system/squad.service.

[Unit]
Description=Squad dedicated server
After=network-online.target
Wants=network-online.target

[Service]
User=squad
Group=squad
WorkingDirectory=/home/squad/server
ExecStartPre=-/home/squad/steamcmd/steamcmd.sh +force_install_dir /home/squad/server +login anonymous +app_update 403240 +quit
ExecStart=/home/squad/server/SquadGameServer.sh Port=7787 QueryPort=27165 beaconport=15000 FIXEDMAXPLAYERS=100
Restart=on-failure
TimeoutStartSec=1800

[Install]
WantedBy=multi-user.target

# then:
# sudo systemctl daemon-reload
# sudo systemctl enable --now squad
# journalctl -u squad -f

FIXEDMAXPLAYERS caps the player count on the command line, as documented on the configuration page; MaxPlayers in Server.cfg sets the server's maximum player count. The leading '-' on ExecStartPre lets the server start on the installed build if the update fails; check journalctl for SteamCMD errors. To pin several instances to separate cores, the wiki suggests taskset -c 0-3 in front of the binary.

Server.cfg, Admins.cfg and Rcon.cfg

Server.cfg holds one setting per line: ServerName, MaxPlayers, NumReservedSlots, PublicQueueLimit, MapRotationMode (LevelList, LayerList, LayerList_Vote or the randomised variants), Tags and Rules for the browser filters. The wiki notes that updates do not overwrite config files, so a setting added in a new release has to be added by hand if you want a value other than its default.

Admins.cfg defines groups first, then assigns players to them by SteamID64. A group line reads Group=Admin:changemap,balance,chat,kick,ban,cameraman,pause and an admin line Admin=76561198000000000:Admin. Permissions worth knowing: reserve for a whitelist slot, immune against kicks and bans, manageserver for shutdown, canseeadminchat for teamkill and admin-join notices. Several servers can share one list through RemoteAdminListHosts.cfg.

Rcon.cfg sets IP, Port, Password, MaxConnections and SecondsBeforeTimeoutCheck. Two lines in it matter for security. An empty Password= keeps RCON turned off. And IP=0.0.0.0, the default, binds it to the public address.

Our recommendation, not the wiki's (the wiki only says that IP can be set to another address):

• No tool needs RCON: leave Password= empty. Nothing listens on 21114.
• You need it occasionally: set IP=127.0.0.1, put the password in the file, and reach it with ssh -L 21114:127.0.0.1:21114 you@your-server from your own login.
• A bot on another host needs it: keep the public bind, and in ufw allow 21114/tcp only from that host's address.
• Keep the password in Rcon.cfg, not as RCONPASSWORD= on the start line, where it would show in ps output and shell history. Then chmod 600 /home/squad/server/SquadGame/ServerConfig/Rcon.cfg, owned by squad.

Licensed and unlicensed servers

Any server can run without a licence. The wiki's installation page puts it plainly: "Servers will show up in the "Custom Browser" unless they are licensed." A licence is a key from Offworld, applied for at the Server License Portal (license.offworldindustries.com), which moves the server into the primary list. Offworld's licensing FAQ, published on the wiki, sets these rules, quoted as written:

• "Servers of less than 60 slots will not be licensed and should remain in the Custom Server Browser."
• "The Minimum requirement for a license is 10 admins per instance."
• "Please do not use "Official" in the name or in anything related to your server."
• "Licensed servers have Developer / QA admin & debug access enabled."
• Among the reasons a licence can be revoked: "Failing to use “vanilla” Squad files."

Server.cfg marks five lines as "required for Licensed servers, but can be changed for non-licensed servers": TKAutoKickEnabled=true, AutoTKBanNumberTKs=7, AutoTKBanTime=300, VehicleKitRequirementDisabled=false and AllowCommunityAdminAccess=true. For a rented dedicated server or your own hardware, the FAQ says you may still apply, but "ensure you do not pick a partner hoster when applying".

Hardware: what Offworld says, and what it does not

Offworld publishes no minimum CPU, memory or disk figure for the server. The wiki's system requirements page (8 GB minimum, 16 GB recommended) describes the game client, not the server. What the licensing FAQ does say is qualitative: licensing exists to help players find servers which "Host from reliable and powerful server hardware", each server's health is shown in the browser as green, yellow or red, and staying green is the owner's job. Its list of revocation reasons includes, for rented hardware, "moving your game server to poor hardware or hosting alongside too many other game servers".

Our reading of that, not Offworld's: a whole machine removes the neighbour question entirely. On a game server machine the cores, memory and disks belong to your server alone, and you size by watching the server, not by guessing. Run a full 100-slot match, watch top and journalctl -u squad, and check the install size with du -sh /home/squad/server before choosing a disk.

Which of our machines fit

The game server page is the starting point: enterprise hardware, mostly HPE, with Dell and Supermicro on some lines, configured to the game, with the operating system you choose, in New York, Miami, San Francisco, Amsterdam or Bucharest. Pick the city nearest your players from the data center list, where each site has a test IP to ping. Each machine includes an unmetered port (1 Gbps on most lines, 500 Mbps on the rest), one IPv4 address, and IPv6 added at checkout at no charge. Rack servers and blades include an out-of-band console, which is how you recover a box that ufw or a bad config locked you out of.

The full range, with live prices, is on the dedicated server catalogue. A racked machine is live about 30 minutes after the order is approved; a build to order takes 4 to 24 hours. Support is staffed 24/7 by phone, email and live chat. If your community also runs a milsim title, the Arma Reforger server notes follow the same pattern.

When this is the wrong place: if you only want a casual server for friends and never plan to apply for a licence, a single small machine is more than the job needs, and for a short event an hourly rental may fit better. Server Room does not apply for or manage Offworld licences; that relationship is between you and Offworld.