OperatorLogin

OperatorLogin

OperatorLogin is a server-side authentication mod & plugin. It protects configured players with /register <password> <password> and /login <password> before they can chat, run other commands, interact with blocks, or attack entities.

Current target

• Loader: NeoForge
• Minecraft: 1.21.1

Security notes

• Passwords are stored in config/operatorlogin-passwords.properties as salted PBKDF2-HMAC-SHA256 hashes.
• Legacy plain-text and old SHA-256 hashes are migrated to PBKDF2 after a successful login.
• Unauthenticated players can only use /login and /register.
• Login attempts are rate-limited with a temporary lockout.
• New passwords must satisfy the configured minimum length and cannot be blank or equal to the player name.

Configuration

The mod creates config/operatorlogin.properties on first run.

| Option | Default | Description |
| — | — | — |
| authOnlyOperators | true | If true, only operators must authenticate. Set to false to protect every player. |
| kickTimeoutSeconds | 60 | How long an unauthenticated player may stay connected. |
| minPasswordLength | 8 | Minimum accepted password length. |
| maxLoginAttempts | 5 | Failed attempts before lockout. |
| lockoutSeconds | 60 | Lockout duration after too many failed attempts. |