OpVerify

OpVerify

Verification System for Operators

Stop Session Stealing

The other day I had a player join my server and explained to me that he had had a player advertising my server on his server. I had a clue about what was going on so I joined to investigate. The server had several players but it said that it was whitelisted. When I rejoined I had the console in the background and noticed that players were being given operator, and when I checked the ops.txt quite a few of these joining players were being given op. After researching this I already had an idea of what was going on. Session Hijacking. With this in mind I could not rest until some sort of system was in place. Which I bring you OpVerify.

Curious How it works Github
Server Session Info Here
Video Showing The Session Hack Here

OpVerify's Features Include

• All joining players will be removed from operator status
• When a player joins and is already set to op all currently authenticated user will be notified and Op is removed.
• Authentication Levels Adds Ip Address Logging, Password Protection with SHA512Hash.
• Incorrect Password Attempts Kicks Players
• Master Operator Ability Account.
• Does Not Conflict with Permission Systems
• Easy to use interface
  

Commands

If any of these commands are used on a semi authenticated level notifications will be sent to all Verified Operators and the Master Account.

From the master account or verified operator

/op {username}

This will enable the user as operator however a password must be set

If the user is online this will store the operators Ip

From temporary operator or as a Password change for verified operators

/oppw {password}

This will store a password as a SHA512 hash

From Ip Verified Operators

/oplogin {password}

Unnecessary if the Operators Ip Address has been verified when logging in

This will enable full operator access

From verified operators or master account

/deop {username}

This will remove the verification items of the player and remove operator

Overridden Vannila Commands

/stop
/gamemode

ChangeLog

v0.1
Initial Release

v0.2
Adjusted Digest for SHA512 instead of MD5

v0.3
Resolved a small issue with ip verification.

TODO

Removed additional vanila commands however considering implementing them again