LoginSecurity

LoginSecurity
LoginSecurity is a lightweight password authorization plugin. You can optionally set a password each time you enter the server, adding a double layer of security to your account. The password is stored inside the configuration file, nobody else except the server owner can access or modify it.
How does it work?
Install the pluign to your /plugins/ directory, then start your server.
Type /register <password>, your account is now locked with a password.
For each time you login, make sure to use /login <password>.
Features
- Register your account optional or required (change in config)
- 5 Useful commands to mangage your password
- Advanced administrative control
- Advanced documentation via wiki
- Secure password storage using BCrypt
- Secure sessions storing to improve user experience
- Customizable time-out
- Map captcha upon registration (user friendly)
- Conversion from AuthMe and xAuth (check wiki for more info)
- Premium support through AutoIn
- Automatic update with changelog overview
- Username filtering (length and characters)
- Highly detailed configuration
- Automatically updated translation manager (user-submitted)
- Prevents being kicked by orther players loging in with your name
Session login allows the user to log in right after they logged out and not have to type in their password again. (1 minute time limit of being logged out, stores IP during that time to keep everything safe)
Commands
/lac - Admin command, rmpass and reload
/register <password> - Set your password
/login <password> - Login with your password
/changepass <old> <new> - change your password
/logout - Logout
Permissions
- loginsecurity.admin - allows admin command
- loginsecurity.update - shows update notifications
Video
Thanks to ServerMiner for making this informative tutorial
Orther tutorials: German (by MineCraftler4Live)
Planned
- Add translation interface for easier language selection
- Suggestions?
Known Bugs
- Players can mount/dismount and ride on vehicles while not logged in
Disclaimer
By default, LoginSecurity will check for updates from bukkitdev every 3 hours.
This feature can be disabled by setting "update-checker" to "false"
Anyone with the permission node ls.admin will be notified of updates, and it also able to download them via /lac update.
Which again can be disabled by disabling the update-checker
This plugin utilises Hidendra's plugin metrics system, which means that the following information is collected and sent to mcstats.org:
- A unique identifier
- The server's version of Java
- Whether the server is in offline or online mode
- The plugin's version
- The server's version
- The OS version/name and architecture
- The core count for the CPU
- The number of players online
The Metrics version Opting out of this service can be done by editing plugins/Plugin Metrics/config.yml and changing opt-out to true.
Additionally, when the language setting is changed, information is retrieved from lang.lenis0012.com to aquire up to date translations.
Links
- v3.0.2 - Download (18 - 1.15)
- Source code (GitHub)
- https://github.com/lenis0012/LoginSecurity-2/wiki (Wiki)
- https://github.com/lenis0012/Translations/wiki/Contribute (Translation Contribution)
Donate
If you want to support me working on this project, please donate.
It helps me alot to keep my projects up.
Donate at the top right corner
-
View User Profile
-
Send Message
Posted Nov 12, 2012So that you can't be killed while trying to login. During that time you cannot defend yourself.
-
View User Profile
-
Send Message
Posted Nov 12, 2012@lenis0012
Thanks! At least I know it is not me XD If you want any help debugging or what not let me know be happy to help.
-
View User Profile
-
Send Message
Posted Nov 12, 2012@wizzard
invincible? Why, or do you mean invisible?
-
View User Profile
-
Send Message
Posted Nov 12, 2012Would it be possible to make players invincible that have not logged in yet?
-
View User Profile
-
Send Message
Posted Nov 12, 2012@lenis0012
Same here, :-( New Player can do what ever they want without setting a pw. running 1.6.2
Working in 1.6
-
View User Profile
-
Send Message
Posted Nov 11, 2012@boondoklife
it seems to be broken in v1.6.2
all i know is that it worked in 1.5.9 :P
you could temporarly downgrade
-
View User Profile
-
Send Message
Posted Nov 11, 2012Perhaps I a missing something, but how does the "Setting a password is optional, or required (change in config)" option work? I have checked the config file and the only one that looks related is "password-required: true". Once logged in there is not a prompt to set a password or any other message and the user is free to do what they will.
Once I set a password for a user then the effects mentioned are triggered. Am I miss understanding how this plugin is to work? I would think a user that does not have authentication information would also be blind and locked into place just like a user that has yet to provide a password.
Help is much appreciated.
-
View User Profile
-
Send Message
Posted Nov 11, 2012@Troublecrafter
wheird, ill have a look.
-
View User Profile
-
Send Message
Posted Nov 11, 2012Hi lenis0012, at testing the "disabled getting kicked when you are already online" feature with v1.6.1 I've figured that you still get kicked, however additionally the second login trial is also disconnected when trying to type /login . Regards, Troublecrafter
Update: I've figured out the reason for "however additionally the second login trial is also disconnected when trying to type /login ." -> the spawn point for new players was somehow in the air oO and the server thought they were trying to fly ... - on the other hand that means that the current login is kicked by a second login + plus + the second login is not placed on the actual player position (that one that was just kicked) but to the original spawn point. I'll do more testing.
-
View User Profile
-
Send Message
Posted Nov 11, 2012@trpaslikcz
it is not secure
but you could put the session login delay on 9999.
-
View User Profile
-
Send Message
Posted Nov 11, 2012Can I set the player to logged only once. If the user authenticates with the same IP does not have to log in? If logged with a different IP than the first time, it must log. Is this possible?
-
View User Profile
-
Send Message
Posted Nov 10, 2012@wumpyc
No AuthMe is using a dfferent encryptor, you cant inport it unless you got it with MD5
-
View User Profile
-
Send Message
Posted Nov 10, 2012Super :)
-
View User Profile
-
Send Message
Posted Nov 10, 2012possible import from AuthMe Reloaded?
-
View User Profile
-
Send Message
Posted Nov 9, 2012@RasCas
releasing 1.6.2 soon. with MySQL support and lots of bug fixes
-
View User Profile
-
Send Message
Posted Nov 9, 2012Can you make it so if people login with a symbol they get disconnected with a message saying Username invalid you can't have a symbol in your name!
-
View User Profile
-
Send Message
Posted Nov 9, 2012Bug in latest 1.6.1
2012-11-09 12:15:50 [INFO] This error is logged only once: it could have occurred multiple times by now. 2012-11-09 12:15:50 [INFO] Potential failures may occur in other plugins handling this Event. 2012-11-09 12:15:50 [INFO] Please contact one of the authors of plugin 'LoginSecurity':
http://pastie.org/5350602
-
View User Profile
-
Send Message
Posted Nov 8, 2012@Troublecrafter
yea sorry, multiply it by 60 and they are seconds :P
-
View User Profile
-
Send Message
Posted Nov 8, 20122 Suggestions
1. Permission for all players with it to be forced to register.
2. Command to set an IP as safe.
-
View User Profile
-
Send Message
Posted Nov 8, 2012@LoulouteFlore
in v1.6.1 blindness is ok at my place (frankly spoken I don't know what it was at v1.6 as I personally don't focus on that feature)