Bukkit

AccountSecure is a combination of password and IP protection to secure admin/owner accounts from hackers. I have a few personal experiences with account hackers from my server, and since then I have tried to create password plugins as well as IP protection plugins. I realized that they both have their downsides. Passwords get annoying, and IP protection is too much because dynamic IPs can change all the time! So, AccountSecure primarily uses IP protection, but also uses passwords so players can easily update their IP addresses in-game. Here's how it works: In the config, you can add players to a list so they will be checked for IP or password. When they first log in, they will have to specify the password. (The password can be added in the config also) After they have specified the password, their IP address is written to the data. When they log in, if their IP address matches the data, they will not have to go through anymore security. If it does not match, they will have to enter the password into chat, and until they do, they will be unable to use commands, build, chat, or anything else a hacker might do to harm your server. If the password is incorrect, they will be kicked and a message is sent to console. If it is correct, they are granted access and their IP automatically updates.

An Additional Admin Tool

There are many things that this plugin's primary feature does not protect against. So, with this plugin, I have also created a powerful admin tool. This tool grants admins access to console commands, regardless of permissions. There is a list in the config of people who can use console, and even if they have no permissions, they will always have access. Here's how it works. To use console, type "@console:<YOUR COMMAND HERE>" into chat. This is not a command, so it can be harder for hackers to know about. It is a good last stand against hackers if they manage to remove your power from the server.

Config

# Configuratin for AccountSecure
# 
# Here you can confiure basic settings for AccountSecure. Since most hacking defies permissions,
# many features require the player to have their name in a list to be granted permissions.
# This includes account checks, in-game console access, etc.
# 
# The way the account hack protection system works is the player's IP address is stored in the config,
# and the IP must match for the player to join. However, many people have dynamic IPs, so they
# change. No worries, when your IP changes, you will be asked to enter a password. Your IP will
# update, and you will be granted permission to join if you correctly enter the password.
# 
# CONSOLE ACCESS
# The console access feature allows players in the list to use console commands in-game, despite permissions.
# Useful if you have lost your power/permissions due to an attack. You can use commands by
# entering into chat: "@console:<yourCommandHere>".

UpdateIPPassword: defaultpass
CheckedPlayers:
- ThisIsAList
- OfPlayersWhoMustVerifyIPOrPassword
- ToJoinTheServer.
- PleaseRemoveTheseWordsAndAddTheNamesOfYourStaff
ConsoleAccess:
- ThisIsAList
- OfPlayersWhoCanAccessConsoleCommands
- IngameDespitePermissions.
- PleaseRemoveTheseWordsAndAddTheNamesOfYourHighRankedStaff
IPData: {}

The UpdateIPPassword is the password that staff must enter into chat to update their IP, if there is no data for them or if it doesn't match. CheckedPlayers is a list of players who must verify IP or password. The lists currently contain instruction words instead of player names. Remove these words, then add player names. (- <playerName>) Same for ConsoleAccess. For console access, it is suggested that you do not add all your staff, only your very high-ranked staff. Anyone with console access has even more than operator access, so be careful. IPData stores formatted, easy-to-use data about player IP addresses. Do not mess with data, unless there is a specific reason why you need to manually update your IP and you know what you are doing.