This is a password-protection system for players and operators acting as an extra layer of security for an online server. Please note: This will not work in offline-mode.
You may ask, if my server is in online mode, can't I rely on the Minecraft.net authentication servers to keep hackers out? Well the honest answer is, you can if you want to, but they don't have a very reliable track record. In recent history there have been two different major security loopholes found and exploited by hackers that allowed them to sign in as famous player accounts such as Notch, or sign in as operators for servers in order to cause harm or take over the server.
A password system provides an extra layer of security, so even if they do sign in as you, they cannot do anything unless they know the password you set up for it. As an added bonus, it can also help to keep player's nosy siblings out of their game ;-)
Security uses the Bukkit Conversation API to prompt players to enter information. These prompts override the standard chat, preventing you from sending chat messages or commands. You must read the prompt and enter the information requested into the chat box before you can use commands or send chat messages.
Features
Player Commands
| Command | Permission | Description |
|---|---|---|
| /ChangePassword [new password] | security.changepassword (default all) | Allows a player to change their password, if one was previous set they will be prompted for it to confirm the change |
| /SecureMode [enable/disable] | security.changemode (default all) | Allows a player to change their account to or from secure mode, note this is overridden by the "security.requiresecuremode" permission. Players will be prompted for the current password in order to change this |
| /SetRecoveryEmail [email address] | security.changeemail (default all) | Set up a recovery email address which will help to identify the real account owner if they should forget their password. Players will be prompted for their current password in order to change this |
Admin Commands
| Command | Permission | Description |
|---|---|---|
| /ResetPassword [player] | security.admin (default op) | Manually reset the password on a player account in case they forget it |
| /StrikeAutoBan [max strikes] [duration] | security.admin (default op) | Set the maximum number of strikes before an IP is banned for entering incorrect passwords, and how long in minutes they are banned for (0 for permanent ban) |
| /GetRecoveryEmail [player] | security.admin (default op) | Get the recovery email address for a player so that you can determine if they are the real account holder |
| /SetAdminEmail [email address] | security.admin (default op) | Set the admin email address that players should send emails to for password resets |
Other Permissions
| Permission | Default | Description |
|---|---|---|
| security.requirepassword | none | Requires that players with this permission have a password set up |
| security.requiresecuremode | none | Requires that players with this permission have secure mode accounts |
| security.requirerecoveryemail | none | Requires that players with this permission have a recovery email set |
Planned Features
Compatibility and Troubleshooting
Full compatibility informationg and troubleshooting is available on the Compatibility and Troubleshooting page.
Translations
If you are fluent in English and another language, you can help translate Security! See the Translations page for details.
Donations
If you'd like to contribute towards the continued development, support and maintenance of this project, please consider joining me on Patreon, and making a one-time or recurring pledge.
Help
If you need help you can leave a comment below and I will get back to you as soon as I can. You can also join my IRC chatroom using the following link. Please note, I am not always at my keyboard! http://webchat.esper.net/?channels=XHawk87&prompt=1
