Rust IP Address & Steam Account Tracking (Alt Accounts)

I have a Prison plugin where players can capture each other (called PlayerPrison)

But the problem is, when someone gets captured,
in order to avoid their punishment of not being able to play,
they jump onto a 2nd Steam Account and just keep playing LOL

So how could I track them?
there could be N steam accounts linked to N ip addresses, a many to many relationship

and Id have to block ways that people get new IP addresses: VPNs and Proxies

Right now I need help with the N to N part, what the data structure should look like, and how to traverse it to see if a Steam Account is linked to any imprisoned Steam Account using IP Addresses

Potential Reference:
umods/IPLogger

 

family share maybe

 

I use Steam Checks plugin: uMod - Steam Checks
and kick players who are using family shared accounts

Ive thoughten about requiring X games to play, but it would require public profiles

 

I got surprised that one of the plugin features is VAC bans.

Isn't it automatically managed by Steam? Can anybody (banned by VAC) connect to my server without this plugin check?

 

Vacban would only stop them playing the game they was banned on.
Say they was vac banned on CSGO then they could still play Rust.
If you set a max number of vac bans in the config,then if they cross the threshold then they can be auto kicked.

if they got a few vacbans then u know for certain its a player you dont want on your server.

 

so you need a plugin for now just to log and match ips and steam and if ip/steam dont match last login kick player?

 

Just thinking out loud:

I need a way to track a players who use alt accounts,

Right now I track players by SteamIDs
But someone can easily use a 2nd Steam account and log back into the server.

So I should start tracking IP addresses,
But someone could start using multiple IP addresses

I guess I was looking for a way to find links if they slip up

Going through it again, I dont think I can stop someone from alting...

I could have a registration process, I could charge entrance, I could require picture holding government ID

But I guess you cant truly ban someone from a videogame server? (Cannot truly imprison them)