StaffAuth

A Second-Layer Security Plugin for Your Staff

Keep your server safe by protecting your most powerful accounts.

This plugin is designed exclusively for staff. Regular players are completely unaffected. When a player with the staffauth.use permission joins, they are frozen and prompted to log in with a separate password. This ensures that even if their main Minecraft account is compromised, your server remains secure.

Features

• Staff-Only Authentication: Only players with the correct permission are affected.
• Complete Immobility: Unauthenticated staff cannot move, chat, use commands, or interact with the world.
• Secure Password Resets: Passwords can only be reset from a previously used IP address.
• Secure Hashing: All passwords and IP identifiers are hashed using modern standards. They are never stored as plain text.
• Affects regular players: This plugin is 100% focused on staff security.

Installation & Setup

1. Place the StaffAuth.jar file into your server's plugins directory.
2. Restart your server.
3. This is the most important step: Using a permissions plugin like LuckPerms, grant the staffauth.use permission to your staff ranks.

The One and Only Permission

staffauth.use

Commands

/register <password> <confirmPassword>
/login <password>
/resetpassword <newPassword>

Why is this important?

An operator or admin account is the most valuable target on a server. If one is compromised, the hacker can cause irreversible damage, from griefing the world to banning all players and deleting essential files. StaffAuth acts as a vital second password, providing an extra layer of defense right where you need it most.