LoginSecurity
LoginSecurity
LoginSecurity is a lightweight password authorization plugin. You can optionally set a password each time you enter the server, adding a double layer of security to your account. The password is stored inside the configuration file, nobody else except the server owner can access or modify it.
How does it work?
Install the pluign to your /plugins/ directory, then start your server.
Type /register <password>, your account is now locked with a password.
For each time you login, make sure to use /login <password>.
Features
- Register your account optional or required (change in config)
- 5 Useful commands to mangage your password
- Advanced administrative control
- Advanced documentation via wiki
- Secure password storage using BCrypt
- Secure sessions storing to improve user experience
- Customizable time-out
- Map captcha upon registration (user friendly)
- Conversion from AuthMe and xAuth (check wiki for more info)
- Premium support through AutoIn
- Automatic update with changelog overview
- Username filtering (length and characters)
- Highly detailed configuration
- Automatically updated translation manager (user-submitted)
- Prevents being kicked by orther players loging in with your name
Session login allows the user to log in right after they logged out and not have to type in their password again. (1 minute time limit of being logged out, stores IP during that time to keep everything safe)
Commands
/lac - Admin command, rmpass and reload
/register <password> - Set your password
/login <password> - Login with your password
/changepass <old> <new> - change your password
/logout - Logout
Permissions
- loginsecurity.admin - allows admin command
- loginsecurity.update - shows update notifications
Video
Thanks to ServerMiner for making this informative tutorial
Orther tutorials: German (by MineCraftler4Live)
Planned
- Add translation interface for easier language selection
- Suggestions?
Known Bugs
- Players can mount/dismount and ride on vehicles while not logged in
Disclaimer
By default, LoginSecurity will check for updates from bukkitdev every 3 hours.
This feature can be disabled by setting "update-checker" to "false"
Anyone with the permission node ls.admin will be notified of updates, and it also able to download them via /lac update.
Which again can be disabled by disabling the update-checker
This plugin utilises Hidendra's plugin metrics system, which means that the following information is collected and sent to mcstats.org:
- A unique identifier
- The server's version of Java
- Whether the server is in offline or online mode
- The plugin's version
- The server's version
- The OS version/name and architecture
- The core count for the CPU
- The number of players online
The Metrics version Opting out of this service can be done by editing plugins/Plugin Metrics/config.yml and changing opt-out to true.
Additionally, when the language setting is changed, information is retrieved from lang.lenis0012.com to aquire up to date translations.
Links
- v3.0.2 - Download (18 - 1.15)
- Source code (GitHub)
- https://github.com/lenis0012/LoginSecurity-2/wiki (Wiki)
- https://github.com/lenis0012/Translations/wiki/Contribute (Translation Contribution)
Donate
If you want to support me working on this project, please donate.
It helps me alot to keep my projects up.
Donate at the top right corner
Comments
-
lenis0012 Owner
-
View User Profile
-
Send Message
Posted May 11, 2016how to translate ?
-
View User Profile
-
Send Message
Posted May 11, 2016lenis0012 In 1.9.2 when someone join to my server (mc.deviantsmc.com) and he try to /register or /login he cant because if someone is near to him and he push him the chat is closing automatically so the player try again to press t to open the chat but if someone push him again he cant this happend only to /register and /login command. Do you have any solution?
-
View User Profile
-
Send Message
Posted Apr 24, 2016Thank you for making this, but at 3:34 you said that that was the encrypted form of the password, but it was the hashed form. Encryption: Kind A is private key. Example: The ceaser cipher. Shifting the letters by three so a=c,b=d,c=e. Kind b is public key. Example: R.S.A. Relies on the difficulty of factoring a number. Encryption can be decrypted by knowing the key, and can be hacked. Hashing can not be decrypted, but can be hacked.
-
View User Profile
-
Send Message
Posted Apr 18, 2016Is it possible to make it so that ONLY staff has to login/register? I don't want to make everyone who is default have to login every time if possible. If this plugin doesn't support this, is there one that does?
-
View User Profile
-
Send Message
Posted Apr 18, 2016@Liping
will be in 2.1 as well
-
View User Profile
-
Send Message
Posted Apr 11, 2016The new version of plugin is compatible with the minecraft 1.7.10 ?? Thank you
-
View User Profile
-
Send Message
Posted Apr 10, 2016Please also make a option for a database just for Username that are capital insensitive rather than using an UUID. Some permission plugin conflict with this UUID system on offline mode server, where other play can steal a player's account by creating a name that is slightly different. For instance if player 'EXAMPLE' has admin permission, another play can simply create 'Example' ID to register another account. Many permission account does not recognize this difference in letter. If you can, please add an option like this so that it also benefit offline servers. Thank You.
-
View User Profile
-
Send Message
Posted Apr 3, 2016@Kush2020
@VEGETAHON
I'll add both features in 2.1 with the message delay fully configurable
-
View User Profile
-
Send Message
Posted Apr 3, 2016I want to translate your plugin on Russian!
How can I do this?
-
View User Profile
-
Send Message
Posted Dec 1, 2016https://github.com/lenis0012/Translations/wiki/Contribute
-
View User Profile
-
Send Message
Posted Apr 1, 2016@lenis0012 I agree with Kush2020, a repeating message to let people know they need to /register <password> or /login <password>.
I've looked into the essentials and they don't have a first time join message option.
It would be Great if you could incorporate this into the plugin!
10/10 for me!!! :)
-
View User Profile
-
Send Message
Posted Mar 30, 2016@lenis0012 Hey can u add a msg for new members that are unregistered to spam to them "Register With /Register PassWord" Like every 5sec and when u rejoin make it say do /login every like 5sec other then that 10/10!
-
View User Profile
-
Send Message
Posted Mar 17, 2016Muchas Gracias!
Thank u very much! works in 1.9 :)
-
View User Profile
-
Send Message
Posted Mar 15, 2016How can I export the file users.db (encode in BCRYPT) on a flat file ? Can you fix the bug on a command ? /converter for exemple ? Or you can create a command /viewpass player ? And can you fix the bug : initox does not Initox, but LoginSecurity don't make differencies :'(
-
View User Profile
-
Send Message
Posted Mar 15, 2016@lenis0012
Nice to hear that :)
Another thing i runned into as i upgraded from mysql to mariadb. Mariadb have connection timeouts more strictly set by default. It seems LoginSecurity do not handle when connection timeouts. It does not try to reconnect - I just get errors in server log and plugin tells me to register - i have my nick registered already.
I noticed other plugins set in connection creation autoReconnect and maxReconnects, so jdbc driver reconnects automatically.
To workaround this i removed timeout settings from my.cnf to go back to mysql original behavior.
-
View User Profile
-
Send Message
Posted Mar 14, 2016@mirolm
good suggestion. I'll add a feature for in in 2.1
-
View User Profile
-
Send Message
Posted Mar 14, 2016In my server I noticed several times players try to bruteforce other players password in the login time (one of the times the succeeded, because password was like 1234...). To stop this there can be a failed tries count after which player is kicked with some reason without waiting for the auth timeout.
-
View User Profile
-
Send Message
Posted Mar 13, 2016@Initox
i dont think i can help you sorry :(
Could you tell me why you want to switch? maybe i can fix it and change your mind :)
@KayrokMagick
Ill check on fake location in 2.1
Its gonna be a pretty big patch with some major security improvements
-
View User Profile
-
Send Message
Posted Mar 13, 2016Bonjour,
Un hackr est venu sur mon serveur avec le pseudo initox (not Initox) et à réussi à trouver mon mot de passe. J'aimerais exporter les mots de passes de loginsecurity vers Authme, comment puis-je faire ?
I want to export passwords data from loginsecurity to AuthMe. The file is in BCRYPT, can you help me ?
-
View User Profile
-
Send Message
Posted Mar 13, 2016@lenis0012
Hi man! great plugin, thank you! I noticed of a problem with the fake location feature, if someone disconects from the nether or the end, when conects again, the fake location sends the user outside of the map, then he login an die haha. I have to deactivate this feature, but I recomended to all choose this auth option, I like it so much :)