OpVerify

This project is abandoned and its default file will likely not work with the most recent version of Minecraft. Whether this project is out of date or its author has marked it as abandoned, this project is no longer maintained.

OpVerify

Verification System for Operators

Stop Session Stealing

The other day I had a player join my server and explained to me that he had had a player advertising my server on his server. I had a clue about what was going on so I joined to investigate. The server had several players but it said that it was whitelisted. When I rejoined I had the console in the background and noticed that players were being given operator, and when I checked the ops.txt quite a few of these joining players were being given op. After researching this I already had an idea of what was going on. Session Hijacking. With this in mind I could not rest until some sort of system was in place. Which I bring you OpVerify.

Curious How it works Github
Server Session Info Here
Video Showing The Session Hack Here

OpVerify's Features Include

  • All joining players will be removed from operator status
  • When a player joins and is already set to op all currently authenticated user will be notified and Op is removed.
  • Authentication Levels Adds Ip Address Logging, Password Protection with SHA512Hash.
  • Incorrect Password Attempts Kicks Players
  • Master Operator Ability Account.
  • Does Not Conflict with Permission Systems
  • Easy to use interface

Commands

If any of these commands are used on a semi authenticated level notifications will be sent to all Verified Operators and the Master Account.


From the master account or verified operator
/op {username}
This will enable the user as operator however a password must be set
If the user is online this will store the operators Ip

From temporary operator or as a Password change for verified operators
/oppw {password}
This will store a password as a SHA512 hash

From Ip Verified Operators
/oplogin {password}
Unnecessary if the Operators Ip Address has been verified when logging in
This will enable full operator access

From verified operators or master account
/deop {username}
This will remove the verification items of the player and remove operator

Overridden Vannila Commands

/stop
/gamemode

ChangeLog


v0.1
Initial Release

v0.2
Adjusted Digest for SHA512 instead of MD5

v0.3
Resolved a small issue with ip verification.

TODO

Removed additional vanila commands however considering implementing them again

Comments

  • To post a comment, please or register a new account.
Posts Quoted:
Reply
Clear All Quotes

About This Project

Categories

Members

Recent Files

Bukkit