SimpleAuth - Shoghicp

Automatic hack protection by Awzaw using IP/SKIN and user PIN codes

Plugin for PocketMine-MP that prevents people from impersonating an account, requiring registration and login when connecting.

 SimpleAuth plugin for PocketMine-MP
 Copyright (C) 2014 PocketMine Team <https://github.com/PocketMine/SimpleAuth>
This program is free software: you can redistribute it and/or modify

it under the terms of the GNU Lesser General Public License as published by

the Free Software Foundation, either version 3 of the License, or

(at your option) any later version.
This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

GNU General Public License for more details.

What's New?

This version of SimpleAuth adds automatic hack detection/protection to SimpleAuth.

When users register (or log in the first time after install or upgrade) they will be given a 4 digit PIN code.

If any player tries to login to an account with 2 or more changes to the previously recorded IP, CID or SKIN, then they will
need to login with /login <password> <PIN>, for example, /login dadada 1234. They will then receive a new PIN.

If a user only changes IP, SKIN or CID (*) the PIN is not required, and the players security info is updated for the new IP/CID/SKIN (not the PIN).

• CID DATA: Please note that getClientId() is deprecated; this will remain in the code for now, ready to be updated when possible, but until we have a replacement this data is not useful. Please adjust the 'threat level' accordingly to either:

0: Never check IP and SKIN data
1: Players must have EITHER the same IP or SKIN as last visit, or type the PIN code on login
2: Players must have BOTH the same IP and SKIN, or type the PIN code on login

If a player forgets their PIN, and cannot login because they joined with a new SKIN + IP, SKIN + CID, IP + CID or SKIN + CID
their security info can be reset on CONSOLE with login <player>. They will then get a new PIN code next time they login.

Players logging in normally will see a reminder on their PIN code.

Players can change their pin code by typing /login when already logged in.

Warnings are displayed on Console when players try to join with >= 2 changes to the security info (IP, CID, SKIN).

SimpleAuth2 is compatible with SimpleAuthHelper, and works with any provider: MySQL (tested), YAML (tested) and SQLITE (untested)

Commands

• /login <password>
• /login <password> <PIN> (If 2 changes detected for a players IP, SKIN or CID since last login)
• /register <password>
• /unregister <password> (TODO)
• For OPs: /simpleauth <command: help|unregister> [parameters...] (TODO)
• For Console: /login <player> to reset hack detection data for a player
• For Players: /login when logged in to get a new PIN code

Configuration

You can modify the SimpleAuth/config.yml file on the plugins directory once the plugin has been run at least once.

AntiHack Configuration

You can modify the SimpleAuth/antihack.yml file on the plugins directory once the plugin has been run at least once.

Permissions

For developers

Events

• SimpleAuth\event\PlayerAuthenticateEvent
• SimpleAuth\event\PlayerDeauthenticateEvent
• SimpleAuth\event\PlayerRegisterEvent
• SimpleAuth\event\PlayerUnregisterEvent

Plugin API methods

All methods are available through the main plugin object

• bool isPlayerAuthenticated(pocketmine\Player $player)
• bool isPlayerRegistered(pocketmine\IPlayer $player
• bool authenticatePlayer(pocketmine\Player $player)
• bool deauthenticatePlayer(pocketmine\Player $player)
• bool registerPlayer(pocketmine\IPlayer $player, $password)
• bool unregisterPlayer(pocketmine\IPlayer $player)
• void setDataProvider(SimpleAuth\provider\DataProvider $provider)
• SimpleAuth\provider\DataProvider getDataProvider(void)

Implementing your own DataProvider

You can register an instantiated object that implements SimpleAuth\provider\DataProvider to the plugin using the setDataProvider() method

IMPORTANT

To enable antihack please change antihack to 'true' in antihack.yml AND UPDATE YOUR DATABASE, if you use MySQL or SQLite:

TO UPDATE AN EXISTING MySQL DATABASE PLEASE RUN THE FOLLOWING QUERIES. FOR THE CAUTIOUS, STOP YOUR SERVER AND BACKUP THE DATABASE FIRST:

• ALTER TABLE simpleauth.simpleauth_players ADD ip VARCHAR(50);
• ALTER TABLE simpleauth.simpleauth_players ADD cid BIGINT;
• ALTER TABLE simpleauth.simpleauth_players ADD skinhash VARCHAR(60);
• ALTER TABLE simpleauth.simpleauth_players ADD pin INT;

TO UPDATE AN EXISTING SQLITE DATABASE:

• ALTER TABLE simpleauth.simpleauth_players ADD ip TEXT;
• ALTER TABLE simpleauth.simpleauth_players ADD cid INTEGER;
• ALTER TABLE simpleauth.simpleauth_players ADD skinhash TEXT;
• ALTER TABLE simpleauth.simpleauth_players ADD pin INTEGER;