Inactive [SEC] xAuth v2.0.10 - Extra Authentication [1.2.5-R1.3+]

xAuth v2.0.10 - (CraftBukkit build: [1.2.5-R1.3+])
Download v2.0.10

lycano is taking over the development of xAuth as I no longer have the time nor the will to continue working on it. Please see the BukkitDev page: http://dev.bukkit.org/server-mods/xauth/

Thanks to everyone who has showed support for me and xAuth over the past 17 months. It's been 'fun'. If for any reason you need to contact me, stop by my IRC channel (irc.rizon.net #LoveDespite) or toss me a message at http://love-despite.com/forum. Until we meet again, stay gold. Bang.

------------------------------------------------------------------​

xAuth is a plugin designed with a single task in mind: protect a server and its players while running in offline-mode. The basic idea of this protection is allowing players to register an account based on their player name and a supplied password. When a registered player connects to the server, that player will be prompted to authenticate his or herself by logging in. If and only if a valid password is supplied, they will regain full control of their account until their session expires.

Video Tutorial | Commands & Permissions | Configuration | Messages | Translations | Source | Donate!​

Features

• Before registering/logging in, players cannot:
  • Chat, execute commands, interact with objects (levers, chests, etc.), move, or pickup items.
  • Break or place blocks
  • Receive or give damage, be targeted (followed) by hostile mobs
• Inventory and location protection
• In-depth setting and message configuration
• Persistent login sessions through server restarts
• Player name filter and password complexity configuration
• Kick non-logged in (but registered) players after a configurable amount of time
• Bukkit Permissions support
• Kick or temporarily lockout the IP address of a player who fails to log in after a configurable amount of tries
• Custom, highly secure password hashing
• H2 and MySQL support
• Authentication over URL (AuthURL) allows for connection to forum or website databases

Changelog (click for full changelog)

• Version 2.0.10
  • [Fixed] Exploit to completely bypass login system.
  • [Fixed] xAuth commands not working with Rcon
  • [Fixed] Exploiting login system to avoid fire & drowning damage.
  • [Fixed] NPE caused by player connecting & disconnecting during same server tick.
  • [Fixed] 'Table "SESSIONS" not found' error when a player uses /logout while session length is set to zero.
  • [Fixed] Exploiting location protection after dieing to return to the spot of death.
• Version 2.0.9
  • Added several reverse single session configuration options.
  • Fixed registration.forced: false not working.
  • Updated version check and H2 download links.

xAuth Importer
xAuth Importer is a tool used to import accounts from previous versions of xAuth as well as other authentication plugins. Click here for more information.

 

Ya but I did post this and I did not get a reply so I thought it did not support H2. I will explane what happened. When I updated I got this sql error

Code:

20.03 04:02:01 [Server] INFO [xAuth] Disabling xAuth v2.0
20.03 04:02:01 [Server] SEVERE [xAuth] Failed to establish MySQL server connection!
20.03 04:02:01 [Server] INFO    at net.minecraft.server.ThreadServerApplication.run(SourceFile:490)
20.03 04:02:01 [Server] INFO    at net.minecraft.server.MinecraftServer.run(MinecraftServer.java:425)
20.03 04:02:01 [Server] INFO    at net.minecraft.server.MinecraftServer.init(MinecraftServer.java:187)
20.03 04:02:01 [Server] INFO    at net.minecraft.server.MinecraftServer.a(MinecraftServer.java:361)
20.03 04:02:01 [Server] INFO    at net.minecraft.server.MinecraftServer.t(MinecraftServer.java:374)
20.03 04:02:01 [Server] INFO    at org.bukkit.craftbukkit.CraftServer.enablePlugins(CraftServer.java:232)
20.03 04:02:01 [Server] INFO    at org.bukkit.craftbukkit.CraftServer.loadPlugin(CraftServer.java:250)
20.03 04:02:01 [Server] INFO    at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:363)
20.03 04:02:01 [Server] INFO    at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:336)
20.03 04:02:01 [Server] INFO    at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:215)
20.03 04:02:01 [Server] INFO    at com.cypherx.xauth.xAuth.onEnable(xAuth.java:58)
20.03 04:02:01 [Server] INFO    at com.cypherx.xauth.database.DatabaseController.isConnectable(DatabaseController.java:63)
20.03 04:02:01 [Server] INFO    at com.cypherx.xauth.database.DatabaseController.getConnection(DatabaseController.java:74)
20.03 04:02:01 [Server] INFO    at com.cypherx.xauth.database.ConnectionPool.leaseConn(ConnectionPool.java:43)
20.03 04:02:01 [Server] INFO    at java.sql.DriverManager.getConnection(DriverManager.java:200)
20.03 04:02:01 [Server] INFO    at java.sql.DriverManager.getConnection(DriverManager.java:620)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:305)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:378)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.Util.handleNewInstance(Util.java:407)
20.03 04:02:01 [Server] INFO    at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
20.03 04:02:01 [Server] INFO    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
20.03 04:02:01 [Server] INFO    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
20.03 04:02:01 [Server] INFO    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:47)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:794)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2163)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2371)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2338)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1296)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.MysqlIO.secureAuth411(MysqlIO.java:4031)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:931)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3525)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3593)
20.03 04:02:01 [Server] INFO    at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:1073)
20.03 04:02:01 [Server] INFO java.sql.SQLException: Access denied for user 'user'@'localhost' (using password: YES)
20.03 04:02:01 [Server] SEVERE [xAuth] Failed to borrow MySQL connection from pool!
20.03 04:02:01 [Server] INFO [xAuth] Permissions support enabled: PermissionsEx v1.19
20.03 04:02:01 [Server] INFO [xAuth] Enabling xAuth v2.0

When I looked in the config there was no option to put it on H2 so I thought it no longer supported H2 can you tell me how to make it use H2

 

If you took three seconds to read the error message for yourself you would see: "Access denied for user 'user'@'localhost' (using password: YES)". Hmm, I wonder what this means? Maybe that your MySQL login is incorrect? Seriously, it's not hard to get this working. My fucking 8 year old nephew had it up and running in 10 minutes without any help.

And it should be obvious how to enable H2. You see that mysql.enabled node? I wonder what happens when it's set to false.

Why the fuck did I come back to this idiot-ridden cesspool of stupidity.

 

Hmm well there IS NO mysql.enabled on the config

Code:

main:
  auto-disable: true
mysql:
  host: localhost
  port: 3306
  user:
  password:
  database:
  tables:
    account: accounts
    location: locations
    lockout: lockouts
    playerdata: playerdata
    session: sessions
authurl:
  enabled: false
  url: http://google.com
  registration: false
  status: false
  groups: false
registration:
  enabled: true
  forced: true
  require-email: false
  validate-email: false
  account-limit: 1
  activation: false
password:
  min-length: 6
  allow-change: true
  complexity:
    lowercase: false
    uppercase: false
    number: false
    symbol: false
guest:
  timeout: 300
  notify-cooldown: 5
  protect-location: true
  allowed-commands:
  - register
  - login
  - l
  restrict:
    player:
      chat: true
      interact: true
      move: true
      pickup: true
    block:
      place: true
      break: true
    entity:
      damage: true
      target: true
session:
  length: 3600
  verifyip: true
  godmode-length: 5
strikes:
  amount: 5
  lockout-length: 3600
filter:
  min-length: 2
  allowed: ''
  disallowed: ''
  blank-name: true

 

Maybe you should try updating and reading the changelog next time?

 

... Now I get this error

Code:

21.03 02:11:40 [Server] INFO [AutoAnnouncer] You can view the server map online just type animalcraft.no-ip.org:8126 in your browser
21.03 02:11:13 [Server] INFO    at net.minecraft.server.ThreadServerApplication.run(SourceFile:490)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.MinecraftServer.run(MinecraftServer.java:452)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.MinecraftServer.w(MinecraftServer.java:554)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetworkListenThread.a(NetworkListenThread.java:78)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetServerHandler.a(NetServerHandler.java:116)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetworkManager.b(NetworkManager.java:229)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.Packet3Chat.handle(Packet3Chat.java:33)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetServerHandler.a(NetServerHandler.java:849)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetServerHandler.chat(NetServerHandler.java:866)
21.03 02:11:13 [Server] INFO    at net.minecraft.server.NetServerHandler.handleCommand(NetServerHandler.java:906)
21.03 02:11:13 [Server] INFO    at org.bukkit.craftbukkit.CraftServer.dispatchCommand(CraftServer.java:469)
21.03 02:11:13 [Server] INFO    at org.bukkit.command.SimpleCommandMap.dispatch(SimpleCommandMap.java:166)
21.03 02:11:13 [Server] INFO    at org.bukkit.command.PluginCommand.execute(PluginCommand.java:40)
21.03 02:11:13 [Server] INFO    at com.cypherx.xauth.commands.LoginCommand.onCommand(LoginCommand.java:36)
21.03 02:11:13 [Server] INFO    at com.cypherx.xauth.auth.AuthSQL.login(AuthSQL.java:32)
21.03 02:11:13 [Server] INFO    at com.cypherx.xauth.password.PasswordHandler.checkPassword(PasswordHandler.java:34)
21.03 02:11:13 [Server] INFO    at org.h2.jdbc.JdbcConnection.prepareStatement(JdbcConnection.java:267)
21.03 02:11:13 [Server] INFO    at org.h2.jdbc.JdbcPreparedStatement.<init>(JdbcPreparedStatement.java:71)
21.03 02:11:13 [Server] INFO    at org.h2.jdbc.JdbcConnection.prepareCommand(JdbcConnection.java:1119)
21.03 02:11:13 [Server] INFO    at org.h2.engine.Session.prepareCommand(Session.java:364)
21.03 02:11:13 [Server] INFO    at org.h2.engine.Session.prepareLocal(Session.java:415)
21.03 02:11:13 [Server] INFO    at org.h2.command.Parser.prepareCommand(Parser.java:218)
21.03 02:11:13 [Server] INFO    at org.h2.command.dml.Select.prepare(Select.java:794)
21.03 02:11:13 [Server] INFO    at org.h2.expression.ExpressionColumn.optimize(ExpressionColumn.java:134)
21.03 02:11:13 [Server] INFO    at org.h2.message.DbException.get(DbException.java:146)
21.03 02:11:13 [Server] INFO    at org.h2.message.DbException.get(DbException.java:169)
21.03 02:11:13 [Server] INFO    at org.h2.message.DbException.getJdbcSQLException(DbException.java:329)
21.03 02:11:13 [Server] INFO SELECT `password`, `pwtype` FROM `accounts` WHERE `id` = ? [42122-159]
21.03 02:11:13 [Server] INFO org.h2.jdbc.JdbcSQLException: Column "PWTYPE" not found; SQL statement:
21.03 02:11:13 [Server] SEVERE [xAuth] Failed to retrieve password hash for account: 4837

And mysql is off

 

Let me guess, you're trying to use your old database?

 

Yes because I want the same password's

 

Well that's what the UPDATING guide is for.

 

Thanks a million for your reply.
I just hacked together a quick workaround for AuthMe tables.
I'm thankful I'm not like some of the other users in this thread.
Remember we were all like them once - maybe not as impatient!

Regards

Show Spoiler Hide Spoiler

Code:

     
      private static String getSHA256(String message) throws NoSuchAlgorithmException
      {
        MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
 
        sha256.reset();
        sha256.update(message.getBytes());
        byte[] digest = sha256.digest();
 
        return String.format("%0" + (digest.length << 1) + "x", new Object[] { new BigInteger(1, digest) });
      }
 
 
///BLAH BLAH
///PASSWORD TYPE
///CHECKS HERE
 
 
} else if (type == PasswordType.SHA256){
            String[] line = realPass.split("\\$");
            try {
                checkPassHash = "$" + line[1] + "$" + line[2] + "$" + getSHA256(new StringBuilder().append(getSHA256(checkPass)).append(line[2]).toString());
            } catch (NoSuchAlgorithmException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

 

Not working right

Code:

Loading data from old H2 database..
Importing data into new H2 database..
Something went wrong while importing data into the new H2 database!

 

I can't do shit to help if you don't include the entire error.

 

That is when I use the H2 to H2 importer and when I run the command java -jar xAuthImporter.jar And That error is all i get.

The only error I get is Something went wrong while importing data into the new H2 database!

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

Re-download and run it again.

 

K i got some thing now :|

Code:

Loading data from old H2 database..
Importing data into new H2 database..
Something went wrong while importing data into the new H2 database!
org.h2.jdbc.JdbcSQLException: Table "ACCOUNTS" not found; SQL statement:
INSERT INTO `accounts` (`playername`, `password`, `pwtype`, `email`, `registerda
te`, `registerip`, `lastlogindate`, `lastloginip`, `active`)VALUES (?, ?, ?, ?,
?, ?, ?, ?, ?) [42102-164]
        at org.h2.message.DbException.getJdbcSQLException(DbException.java:329)
        at org.h2.message.DbException.get(DbException.java:169)
        at org.h2.message.DbException.get(DbException.java:146)
        at org.h2.command.Parser.readTableOrView(Parser.java:4753)
        at org.h2.command.Parser.readTableOrView(Parser.java:4731)
        at org.h2.command.Parser.parseInsert(Parser.java:954)
        at org.h2.command.Parser.parsePrepared(Parser.java:375)
        at org.h2.command.Parser.parse(Parser.java:279)
        at org.h2.command.Parser.parse(Parser.java:251)
        at org.h2.command.Parser.prepareCommand(Parser.java:217)
        at org.h2.engine.Session.prepareLocal(Session.java:415)
        at org.h2.engine.Session.prepareCommand(Session.java:364)
        at org.h2.jdbc.JdbcConnection.prepareCommand(JdbcConnection.java:1121)
        at org.h2.jdbc.JdbcPreparedStatement.<init>(JdbcPreparedStatement.java:7
1)
        at org.h2.jdbc.JdbcConnection.prepareStatement(JdbcConnection.java:267)
        at com.cypherx.xauthimporter.H2ToH2Importer.doImport(H2ToH2Importer.java
:133)
        at com.cypherx.xauthimporter.H2ToH2Importer.main(H2ToH2Importer.java:26)

If it is something in the importer.properties please let me know what I did wrong

 

You didn't follow the upgrading guide correctly. Try again.

 

Thanks for the great plugin CypherX You don't get as many thanks here than you do "HALP ME! I DERPED SOMEWHERE!" Can't wait for the next update ^_^ (unless the people on the forums annoy you away lol)

Also, to those who can't get it working, I have over 30k accounts registered and I was able to upgrade it from H2 and import it to MySQL. His instructions are not complicated....just don't skip a step because it has too many letters to read...

 

I did redownload it and I still get the error ...

 

These are the instructions you're following, right?
Upgrading from xAuth v2.0b4.1 or higher (H2 to H2)

1. Delete the old xAuth plugin, config.yml, messages.yml, and DBVERSION files.
2. Rename xAuth.h2.db to xAuth_old.h2.db.
3. Download the latest version of xAuth, configure the included configuration file, and start your server so the H2 database is generated. Stop the server now.
4. Download the H2 to H2 importer here and extract all included files into the same directory.
5. Configure the importer.properties file included in the importer to accurately reflect your old xAuth configuration.
6. Place xAuth_old.h2.db and xAuth.h2.db in the same directory as the importer.
7. Run the importer (see the bottom of this page for instructions).
8. If no errors are shown, your import should have finished successfully.
9. Move xAuth.h2.db into your xAuth plugins folder.

 

I did but I will remove all the files again and retry

Yes I read them line by line. If any of u have skype where i can show you what im doing Im ok with that but i will restart fresh again and see what happens

I still get the error

Code:

Loading data from old H2 database..
Importing data into new H2 database..
Something went wrong while importing data into the new H2 database!
org.h2.jdbc.JdbcSQLException: Table "ACCOUNTS" not found; SQL statement:
INSERT INTO `accounts` (`playername`, `password`, `pwtype`, `email`, `registerda
te`, `registerip`, `lastlogindate`, `lastloginip`, `active`)VALUES (?, ?, ?, ?,
?, ?, ?, ?, ?) [42102-164]
        at org.h2.message.DbException.getJdbcSQLException(DbException.java:329)
        at org.h2.message.DbException.get(DbException.java:169)
        at org.h2.message.DbException.get(DbException.java:146)
        at org.h2.command.Parser.readTableOrView(Parser.java:4753)
        at org.h2.command.Parser.readTableOrView(Parser.java:4731)
        at org.h2.command.Parser.parseInsert(Parser.java:954)
        at org.h2.command.Parser.parsePrepared(Parser.java:375)
        at org.h2.command.Parser.parse(Parser.java:279)
        at org.h2.command.Parser.parse(Parser.java:251)
        at org.h2.command.Parser.prepareCommand(Parser.java:217)
        at org.h2.engine.Session.prepareLocal(Session.java:415)
        at org.h2.engine.Session.prepareCommand(Session.java:364)
        at org.h2.jdbc.JdbcConnection.prepareCommand(JdbcConnection.java:1121)
        at org.h2.jdbc.JdbcPreparedStatement.<init>(JdbcPreparedStatement.java:7
1)
        at org.h2.jdbc.JdbcConnection.prepareStatement(JdbcConnection.java:267)
        at com.cypherx.xauthimporter.H2ToH2Importer.doImport(H2ToH2Importer.java
:133)
        at com.cypherx.xauthimporter.H2ToH2Importer.main(H2ToH2Importer.java:26)

So does that log tell the issue I did what I got told

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

Yep, and like I said, you're following the upgrade guide wrong: http://dl.dropbox.com/u/24661378/Pics/importer.png

 

Ok you know what Iwill send you the databace and you can try it because it isent working for me and i did follow the guide and i re-install it all like 4 re-install so you can try it and tell me what happens

http://dl.dropbox.com/u/14757719/Minecraft/xAuth_old.h2.db

Or if anyone can get this file to work and then send it because it is not working for me

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

Worked fine. The error you were getting said "Table "ACCOUNTS" not found" which means xAuth wasn't generating the new tables. You probably didn't delete the DBVERSION file.

http://dl.dropbox.com/u/24661378/Bukkit/xAuth.h2.db

 

omg thank you

 

Just 1 more Bukkit user why I should be special? CypherX wouldn't make his plugin public if he was not prepared for fix requests. Why developer should ignore users who asking for fixing critical bugs?

And your server online? 50? 100?
"WORKSFORME" does not mean for everyone.

 

Pleas help!

[SEVERE] [xAuth] Failed to load teleport locations!
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Table 'xauth.locations' doesn't exist
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:407)
at com.mysql.jdbc.Util.getInstance(Util.java:382)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:1052)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3593)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3525)
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1986)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2140)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2626)
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:2111)
at com.mysql.jdbc.PreparedStatement.executeQuery(PreparedStatement.java:2273)
at com.cypherx.xauth.LocationManager.loadLocations(LocationManager.java:36)
at com.cypherx.xauth.LocationManager.<init>(LocationManager.java:24)
at com.cypherx.xauth.xAuth.onEnable(xAuth.java:87)
at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:215)
at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:336)
at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:363)
at org.bukkit.craftbukkit.CraftServer.loadPlugin(CraftServer.java:250)
at org.bukkit.craftbukkit.CraftServer.enablePlugins(CraftServer.java:232)
at net.minecraft.server.MinecraftServer.t(MinecraftServer.java:374)
at net.minecraft.server.MinecraftServer.a(MinecraftServer.java:361)
at net.minecraft.server.MinecraftServer.init(MinecraftServer.java:187)
at net.minecraft.server.MinecraftServer.run(MinecraftServer.java:425)
at net.minecraft.server.ThreadServerApplication.run(SourceFile:490)

 

Delete your dbversion file.

 

Hey, Great work your doing here, Was just wondering I remember this plugin having a feature if a user was logged in and another player tryed to log in as him the person attempting to login would get a message along the lines of "This player is already logged in" was that feature removed or am I thinking of another plugin all together.

Thanks Donxpro.

 

It has been removed because of an exploit.

 

Where can I post feature ideas?