Difference between revisions of "Security"
imported>Maze |
(remove parts that are not true any more) |
||
| (7 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | |||
| − | + | This page describes the current status of security in AAGRINDER. | |
| − | + | ||
| − | In AAGRINDER, | + | == Authentication == |
| + | In AAGRINDER, users authenticate with their passwords. | ||
The password is chosen when the account is created and needs to be at least 1 character long. | The password is chosen when the account is created and needs to be at least 1 character long. | ||
The password may contain any characters. | The password may contain any characters. | ||
| Line 10: | Line 10: | ||
this transmission will be encrypted. | this transmission will be encrypted. | ||
| − | On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a | + | On the server, the password is hashed and salted using [https://www.npmjs.com/package/bcryptjs bcryptjs] and then saved in a json file. The plaintext password does not persist in memory on neither the client nor the server. |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | Users can change their passwords by using the '''/passwd''' [[client command list|client command]] in-game. It is also possible to change the password with a direct [[AAGRINDER REST api|api call]]. In both cases, the current password is required in order to set a new one. If you lost your current password, you should contact the server administrator. | |
| − | |||
| − | == | + | == Authorization == |
| + | Additional privileges may be granted to specific users at login. | ||
| + | Among the in-game commands that get executed on the server, some are in the group of ''admin commands'', which prevents users from accessing these commands unless they have the ''admin'' role. The names of users with the admin role are specified in the file ''admins.txt'' in the server directory. This file needs to be edited manually. | ||
| − | + | Older versions of AAGRINDER have a ''/sudo'' command, which allows a user to run a command as any other user, and requires additional privileges (an entry in ''sudo.txt''). The ''/sudo'' command [https://gitlab.com/MRAAGH/aagrinder/-/commit/e89398ba2f59e5f84a601d87d5fe7dd8296612b1 was removed] on September 4, 2022. | |
Latest revision as of 15:04, 8 September 2022
This page describes the current status of security in AAGRINDER.
Authentication[edit]
In AAGRINDER, users authenticate with their passwords. The password is chosen when the account is created and needs to be at least 1 character long. The password may contain any characters.
The password is transmitted to the server in plaintext. However, if you are using a https connection, this transmission will be encrypted.
On the server, the password is hashed and salted using bcryptjs and then saved in a json file. The plaintext password does not persist in memory on neither the client nor the server.
Users can change their passwords by using the /passwd client command in-game. It is also possible to change the password with a direct api call. In both cases, the current password is required in order to set a new one. If you lost your current password, you should contact the server administrator.
Authorization[edit]
Additional privileges may be granted to specific users at login.
Among the in-game commands that get executed on the server, some are in the group of admin commands, which prevents users from accessing these commands unless they have the admin role. The names of users with the admin role are specified in the file admins.txt in the server directory. This file needs to be edited manually.
Older versions of AAGRINDER have a /sudo command, which allows a user to run a command as any other user, and requires additional privileges (an entry in sudo.txt). The /sudo command was removed on September 4, 2022.
