Security - Revision history

Maze2: describe insecure mode with links

2024-07-08T09:27:43Z

describe insecure mode with links

Maze2: add links

2024-07-08T09:17:54Z

add links

Maze2: Add links

2024-07-08T09:16:35Z

Add links

Maze2: new functionality with passwords

2024-07-08T09:13:38Z

new functionality with passwords

Maze: remove parts that are not true any more

2022-09-08T13:04:27Z

remove parts that are not true any more

Maze: sudo was removed

2022-09-08T13:02:13Z

sudo was removed

imported>Maze: /* Authentication */

2019-10-27T17:32:19Z

Authentication

imported>Maze: /* Authentication */

2019-10-12T21:22:44Z

Authentication

imported>Maze: Maze moved page Security and privacy to Security without leaving a redirect

2019-10-12T20:45:27Z

Maze moved page Security and privacy to Security without leaving a redirect

imported>Maze at 20:45, 12 October 2019

2019-10-12T20:45:03Z

← Older revision		Revision as of 09:27, 8 July 2024
Line 17:		Line 17:

	The server administrator is able to remove a password from an account, allowing this account to instantly log in without needing to type a password. This is recommended only for testing.		The server administrator is able to remove a password from an account, allowing this account to instantly log in without needing to type a password. This is recommended only for testing.
		+
		+	Older versions of AAGRINDER have an "insecure_mode" setting, which can be used to disable checking passwords. This setting was on [https://gitlab.com/MRAAGH/aagrinder/-/commit/bd503d736fcd120b4f2130d77839048c6dbb275d 8th July 2022] renamed to "check_passwords" and [https://gitlab.com/MRAAGH/aagrinder/-/commit/53940c37dd5d1f7b322e003450a365bda0f02a5e 6 days later] removed.

	== Authorization ==		== Authorization ==

@@ Line 12: / Line 12: @@
 On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a json file. The plaintext password does not persist in memory on neither the client nor the server.
-Users can change their passwords by using the '''/passwd''' [[client command list|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one.
+Users can change their passwords by using the '''/passwd''' [[command list|command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one.
-The server administrator can change any user's password using the '''passwd''' command in the server console. If you lost your current password, you should contact the server administrator.
+The server administrator can change any user's password using the '''passwd''' command in the [[server console]]. If you lost your current password, you should contact the server administrator.
 The server administrator is able to remove a password from an account, allowing this account to instantly log in without needing to type a password. This is recommended only for testing.

@@ Line 21: / Line 21: @@
 Additional privileges may be granted to specific users at login.
-Among the in-game commands that get executed on the server, some are in the group of ''admin commands'', which prevents users from accessing these commands unless they have the ''admin'' role. The names of users with the admin role are specified in the file ''admins.txt'' in the server directory. This file needs to be edited manually.
+Among the in-game commands that get executed on the server, some are in the group of ''admin commands'', which prevents users from accessing these commands unless they have the ''admin'' role. The names of users with the admin role are specified in the file ''admins.txt'' in the server directory. This file needs to be edited manually and reloaded using the '''admin''' command in the [[server console]], or by [[Administration tips|restarting the server]].
 Older versions of AAGRINDER have a ''/sudo'' command, which allows a user to run a command as any other user, and requires additional privileges (an entry in ''sudo.txt''). The ''/sudo'' command [https://gitlab.com/MRAAGH/aagrinder/-/commit/e89398ba2f59e5f84a601d87d5fe7dd8296612b1 was removed] on September 4, 2022.

@@ Line 12: / Line 12: @@
 On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a json file. The plaintext password does not persist in memory on neither the client nor the server.
-Users can change their passwords by using the '''/passwd''' [[client command list|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one. If you lost your current password, you should contact the server administrator.
+Users can change their passwords by using the '''/passwd''' [[client command list|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one.
 == Authorization ==

@@ Line 10: / Line 10: @@
 this transmission will be encrypted.
-On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a [[wikipedia:MySQL|MySQL]] database. The relevant part of the code can be found [https://gitlab.com/MRAAGH/aagrinder/blob/master/server/User.js#L120 here]. The plaintext password does not persist in memory on neither the client or the server.
+On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a json file. The plaintext password does not persist in memory on neither the client nor the server.
 Users can change their passwords by using the '''/passwd''' [[client command list|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one. If you lost your current password, you should contact the server administrator.
 == Authorization ==

@@ Line 1: / Line 1: @@
 This page describes the current status of security in AAGRINDER.
@@ Line 22: / Line 23: @@
 Among the in-game commands that get executed on the server, some are in the group of ''admin commands'', which prevents users from accessing these commands unless they have the ''admin'' role. The names of users with the admin role are specified in the file ''admins.txt'' in the server directory. This file needs to be edited manually.
-An additional privilege may be granted to users which allows them to run the /sudo command. To do this, the server setting ''allow_sudo'' needs to be set to ''true'' and the name of the user needs to be specified in the file ''sudo.txt'' in the server directory. This file needs to be edited manually.
+Older versions of AAGRINDER have a ''/sudo'' command, which allows a user to run a command as any other user, and requires additional privileges (an entry in ''sudo.txt''). The ''/sudo'' command [https://gitlab.com/MRAAGH/aagrinder/-/commit/e89398ba2f59e5f84a601d87d5fe7dd8296612b1 was removed] on September 4, 2022.

← Older revision		Revision as of 17:32, 27 October 2019
Line 10:		Line 10:

	On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a [[wikipedia:MySQL\|MySQL]] database. The relevant part of the code can be found [https://gitlab.com/MRAAGH/aagrinder/blob/master/server/User.js#L120 here]. The plaintext password does not persist in memory on neither the client or the server.		On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a [[wikipedia:MySQL\|MySQL]] database. The relevant part of the code can be found [https://gitlab.com/MRAAGH/aagrinder/blob/master/server/User.js#L120 here]. The plaintext password does not persist in memory on neither the client or the server.
		+
		+	Users can change their passwords by using the '''/passwd''' [[client command list\|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api\|api call]]. In both cases, the current password is required in order to set a new one. If you lost your current password, you should contact the server administrator.

	There is currently no functionality for changing an account's password. If you want your password changed, you should contact the server administrator to reset your account (progress in the game will not be lost).		There is currently no functionality for changing an account's password. If you want your password changed, you should contact the server administrator to reset your account (progress in the game will not be lost).

@@ Line 13: / Line 13: @@
 There is currently no functionality for changing an account's password. If you want your password changed, you should contact the server administrator to reset your account (progress in the game will not be lost).
-There is an alternative mode called [[insecure mode|Running in insecure mode]] which can be enabled by toggling a server setting. We call it "insecure" to decrease the confusion between the similar words "authentication" and "authorization". If enabled, passwords will be completely ignored at login, and the client will not prompt the user for password.
+There is an alternative mode called [[Running in insecure mode|insecure mode]] which can be enabled by toggling a server setting. We call it "insecure" to decrease the confusion between the similar words "authentication" and "authorization". If enabled, passwords will be completely ignored at login, and the client will not prompt the user for password.
 == Authorization ==

← Older revision	Revision as of 20:45, 12 October 2019
(No difference)

@@ Line 1: / Line 1: @@
-This page describes the current status of security and privacy in AAGRINDER.
+This page describes the current status of security in AAGRINDER.
-== Security ==
+== Authentication ==
 In AAGRINDER, users authenticate with their passwords.
 The password is chosen when the account is created and needs to be at least 1 character long.
@@ Line 16: / Line 15: @@
 There is an alternative mode called [[insecure mode|Running in insecure mode]] which can be enabled by toggling a server setting. We call it "insecure" to decrease the confusion between the similar words "authentication" and "authorization". If enabled, passwords will be completely ignored at login, and the client will not prompt the user for password.
-=== Authorization ===
+== Authorization ==
 Additional privileges may be granted to specific users at login.