AuthMe Reloaded

Table of Contents

AuthMe

The most famous and used /login|/register plugin!

WARNING: the current release version is very old, if you want to try the newest features please use the latest dev build! (https://ci.codemc.org/job/AuthMe/job/AuthMeReloaded/)

Prevent username stealing:
AuthMe Reloaded prevents players who aren't logged in from actions like placing blocks, moving, typing commands or seeing the inventory of the current player.

Anti-Spoof:
The possibility to set up name spoof protection kicks players with uncommon long or short player names before they could actually join.

Sessions:
Login Sessions make it possible that you don't have to login within a given time period.

Configurable:
Each command and every setting can be enabled or disabled by a easy structured config file.

Translatable:
If you don't like English or don't like our default translations you can easily edit almost every message sent by the plugin!

> > > ALL AUTHME VIDEOS TUTORIALS < < <

Features:

E-Mail Recovery System !!!
Playername spoof protection
Countries Selection! (countries codes)
AntiBot Features!
Protection against "Logged in from another location" messages
Login sessions
Editable settings & messages
MySQL and SQLITE support
Supported hash algorithms: Available Hash Algorithms
Supports tons of CMS! (Website integration)
Custom MySQL tables/columns (useable for forums, other scripts)
Database queries can be cached
Compatible with NPC and CombatTag plugins
Account restriction through IP and name
Permissions group switching on un-logged-in
Different permission group for Registered and unRegistered users
Support for permissions onJoin with transient vault system
Cache on file for all inventories and enchants for un-logged-in players
Save Quit location to prevent loss of position
Possible to use without a Permissions plugin
Automatic backup system of all your user password data
Default Language Style: en, de, br, cz, pl, fr, ru, hu, sk, es, zhtw, fi, zhcn, nl, and others! (feel free to send me new translations)
Convert SQLite to an usefull authme.sql that you can import on a MySQL database!
Import your database from Rakamak, xAuth, CrazyLogin, RoyalAuth, vAuth !

Configuration

How to Configure Authme

Commands

Command list and usage

Permissions

Warning: if you're updating from AuthMe 3.4 to 5.2+ you need to change the permissions nodes.

List of all single permissions

How To

How to use the converter
How to import database from xAuth
WebSite Integration
How to convert from Rakamak
Convert from SQLite to MySQL: set MYSQL as backend and run the "/authme converter sqlitetosql" command.

Source: Source Code on Github

JavaDoc: AuthMe Javadoc

Dev Builds

Development builds of this project can be acquired at the provided continuous integration server. These builds have not been approved by the BukkitDev staff. Use them at your own risk.
DevBuilds: ci.codemc.org

Maven Repository:

Maven Repo

<repository>
	<id>codemc-repo</id>
	<url>http://repo.codemc.org/repository/maven-public/</url>
</repository>

<dependency>
	<groupId>fr.xephi</groupId>
	<artifactId>authme</artifactId>
	<version>5.5.0-SNAPSHOT</version>
</dependency>

Metrics

Usage statistics: AuthMeReloaded on BStats.org

Donate

Do you like our work ? Or just want to buy us a coffee for quickly update?
Use this link in EUR : Or this link in USD :

Licenses

This product includes and download automatically GeoLite data created by MaxMind, available from http://www.maxmind.com

Sponsor

FastVM.io is leader in VPS hosting solutions. With its own DataCenter offers Anti-DDoS solutions at affordable prices.

Credits

Current AuthMe development team members: Our Team

Credits for old versions of authme go to d4rkwarriors, fabe1337 , Whoami and pomo4ka.

Comments

doritozb

Join Date: 11/14/2017
Posts: 2
Member Details

#6886 Posted Nov 23, 2018

Ah how to put a custom message instead of the minecraft error after the forceKickAfterRegister: true, kick out a person? I would like to add something saying that the record has been completed and that it should

CiaAsLukas
- Join Date: 8/14/2018
- Posts: 1
- Member Details
#6884 CiaAsLukas

View User Profile

Send Message

Posted Aug 14, 2018
Hey, is there any shortcut to /login or /register?

I know that there has to be /l and /reg, but it doesn't seem to work

I looked through the permissions and didn't find any...

Help anyone?

Rollback Post to Revision RollBack
Raubkatzen_des_Universums
- Join Date: 7/16/2018
- Posts: 1
- Member Details
#6883 Raubkatzen_des_Universums

View User Profile

Send Message

Posted Jul 16, 2018
What do you mean with that

TpPositionPitch

TpPositionYaw
Rollback Post to Revision RollBack
Borner112
- Join Date: 7/7/2018
- Posts: 1
- Member Details
#6882 Borner112

View User Profile

Send Message

Posted Jul 7, 2018
Hallo kann mir wer helfen?

nachdem wir uns eingeloggt haben joinen wir immer am spawn aber wir wollen uns dort einloggen wo wir uns ausgeloggt haben kann uns wer helfen?

bitte datei + pfad + zeile mit angeben wo wir was ändern müssen. Danke

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6869 SF_INFINITE

View User Profile

Send Message

Posted Apr 17, 2018
Dear devs.
Can one of you create just a simple MD5 hash with out salting or make a option to make static salt like "newyork456" cause this "special" salting with the randomness can't really work with my PHP and MySQL based WebPage.

PS. There is a bug too when you are using SALTED2MD5 and setting the

doubleMD5SaltLength to 0 if you register then recconect the plugin doesn't accept the password.

Last edited by SF_INFINITE: Apr 17, 2018

Rollback Post to Revision RollBack
games647
- Join Date: 6/24/2012
- Posts: 1,360
- Member Details
#6870 games647

View User Profile

Send Message

Posted Apr 23, 2018
In reply to SF_INFINITE:

You can use the BCrypt2y. It's the default hashing algorithm in PHP since 5.5. You can use password_hash to generate a hash and password_verify to verify it. It's much safer. MD5 way too insure nowadays.

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6872 SF_INFINITE

View User Profile

Send Message

Posted May 11, 2018
In reply to games647:

Thanks but

Can you send me a tutorial or something how to do it? and that Authme Website integration well it's not even working for me

MD5 is secure cause I think you can't get any password from a MySQL wich is only accessible from the localhost :D

So yeah the best solution would be if they bring back MD5 cause I don't really want to change my website.

Rollback Post to Revision RollBack
games647
- Join Date: 6/24/2012
- Posts: 1,360
- Member Details
#6873 games647

View User Profile

Send Message

Posted May 12, 2018
In reply to SF_INFINITE:

https://github.com/AuthMe/AuthMeReloaded/tree/master/samples/website_integration

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6874 SF_INFINITE

View User Profile

Send Message

Posted May 12, 2018
In reply to games647:

I said I can't understand that...

But I get it now just downgraded back to 1.9 and using a older version of AuthMe

Rollback Post to Revision RollBack
games647
- Join Date: 6/24/2012
- Posts: 1,360
- Member Details
#6875 games647

View User Profile

Send Message

Posted May 13, 2018
Quote from SF_INFINITE >>

In reply to games647:

Thanks but

Can you send me a tutorial or something how to do it? and that Authme Website integration well it's not even working for me

MD5 is secure cause I think you can't get any password from a MySQL wich is only accessible from the localhost :D

So yeah the best solution would be if they bring back MD5 cause I don't really want to change my website.

In reply to SF_INFINITE:

Then explain where you stuck at. Saying that you can't understand it doesn't really help. So please explain what did you tried and what doesn't worked. I'm happy to help you.

BTW: Your storage can still be leaked using bad configurations, bad mods, server hoster, ...Making the database only accessible by localhost improves the security, but the data have to still be stored somewhere.

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6876 SF_INFINITE

View User Profile

Send Message

Posted May 15, 2018
In reply to games647:

Yeah you are right.

I tried something like this:

md5(md5($_POST["password"])); And OK this Hashes (Crypts)

the pasword to MD5 2times

I added the salt with storing the salt in MySQL and getting it in the website for the user with username match and it was getting it so I added it like this:

md5(md5($_POST["password"]) + $salt); (Or something similar) and it was "working" but it's made a completely other hash wich don't matched to any of the Passwords stored in MySQL so yeah.

That's why I want to use only MD5 or MD5 with Static custom salt if that was avable but since it's not I need to use this "Salted2MD5" or older MC Version and older AuthME for MD5 and I take the Older 4 MD5

BTW The host is completely trustable I didn't had or no one had any problem with them like leaking or things like that no one has accsess to the server computer/web admin so yeah... I trust them but I want to use Newer MC version too so yeah If you understand my problem and help me I'm gonna be so happy. :D

Last edited by SF_INFINITE: May 15, 2018

Rollback Post to Revision RollBack
games647
- Join Date: 6/24/2012
- Posts: 1,360
- Member Details
#6877 games647

View User Profile

Send Message

Posted May 15, 2018
In reply to SF_INFINITE:

The salt have to be unique for every new hash, to make it harder to brute force the original passwords. If you want to verify the password against an existing hash, you have to extract the salt and reuse it in order to generate the same hash.

If you use BCrypt (BCrypt2y in AuthMe) this makes the things a lot easier, because you can password_hash(PLAIN_PASSWORD) to generate new hashes (i.e. registering a new account) and password_verify(PLAIN_PASSWORD, HASH) to verify it against an existing one. This method automatically extracts the hashing configuration (salt and rounds), hashes the plain text password and compares the two hashes behind the scenes.

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6878 SF_INFINITE

View User Profile

Send Message

Posted May 16, 2018
In reply to games647:

Well this is a bit too much information for me...

I don't know why the plugin doesn't has like a option to make static custom salts it would make a lot easier.

BTW If I be home I'll check that BCrypt well If I made a avatar uploading feature in the website I can change the login form too :D

(wich wouldn't be bad idea cause It's bugging like crazy I messed up the CSS somewhere and the login screen is as wide as the screen :D)

Last edited by SF_INFINITE: May 16, 2018

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6879 SF_INFINITE

View User Profile

Send Message

Posted May 17, 2018
In reply to games647:

Ohh I readed it It's a bit simpler cause No need to hash the password to do the matching I question I need to feed in (Plain_PW , Hashed_PW) to the Verify?

Rollback Post to Revision RollBack
games647
- Join Date: 6/24/2012
- Posts: 1,360
- Member Details
#6880 games647

View User Profile

Send Message

Posted May 19, 2018
In reply to SF_INFINITE:

"I don't know why the plugin doesn't has like a option to make static custom salts it would make a lot easier."

Because it's too insecure. You shouldn't downgrade security standards.

"Ohh I readed it It's a bit simpler cause No need to hash the password to do the matching I question I need to feed in (Plain_PW , Hashed_PW) to the Verify?"

Please read the man page or the documentation. There you see the order of arguments.

https://secure.php.net/manual/en/function.password-verify.php

https://secure.php.net/manual/en/function.password-hash.php

Rollback Post to Revision RollBack
SF_INFINITE
- Join Date: 4/17/2018
- Posts: 10
- Member Details
#6881 SF_INFINITE

View User Profile

Send Message

Posted May 21, 2018
In reply to games647:

Woaah Thanks dude!

It's really really much easier, thank you sooo much!

You are the best!

Rollback Post to Revision RollBack
rautamiekka
- Location: Ulvila
- Join Date: 4/1/2011
- Posts: 191
- Member Details
#6887 rautamiekka

View User Profile

Send Message

Posted Nov 30, 2018
In reply to SF_INFINITE:

You're absolutely insane, and maybe absolutely lazy, using MD5 for -anything-, especially to hash passwords on a website.

Rollback Post to Revision RollBack
uber_awesome_
- Join Date: 4/11/2018
- Posts: 3
- Member Details
#6865 uber_awesome_

View User Profile

Send Message

Posted Apr 10, 2018
In the Factions plugin when someone enters with a nick of a Master you give / f clain

Ai laga server and crash solves the error

Last edited by uber_awesome_: Apr 10, 2018

Rollback Post to Revision RollBack
sgdc3
- Join Date: 6/30/2014
- Posts: 243
- Member Details
#6866 sgdc3

View User Profile

Send Message

Posted Apr 13, 2018
In reply to uber_awesome_:

Sorry, i can't understand your problem :/

Rollback Post to Revision RollBack
uber_awesome_
- Join Date: 4/11/2018
- Posts: 3
- Member Details
#6867 uber_awesome_

View User Profile

Send Message

Posted Apr 13, 2018
In reply to sgdc3:

quando auguem entra no server ele consegue usar comandos antes de dar /logn tipo em servidor de factions eles consegue bugar dando /f clain

Rollback Post to Revision RollBack
To post a comment, please login or register a new account.