OperatorLogin

OperatorLogin is a server-side authentication mod & plugin. It protects configured players with /register <password> <password> and /login <password> before they can chat, run other commands, interact with blocks, or attack entities.

Current target

• Loader: NeoForge
• Minecraft: 1.21.1

Security notes

• Passwords are stored in config/operatorlogin-passwords.properties as salted PBKDF2-HMAC-SHA256 hashes.
• Legacy plain-text and old SHA-256 hashes are migrated to PBKDF2 after a successful login.
• Unauthenticated players can only use /login and /register.
• Login attempts are rate-limited with a temporary lockout.
• New passwords must satisfy the configured minimum length and cannot be blank or equal to the player name.

Configuration

The mod creates config/operatorlogin.properties on first run.

Option	Default	Description
authOnlyOperators	true	If true, only operators must authenticate. Set to false to protect every player.
kickTimeoutSeconds	60	How long an unauthenticated player may stay connected.
minPasswordLength	8	Minimum accepted password length.
maxLoginAttempts	5	Failed attempts before lockout.
lockoutSeconds	60	Lockout duration after too many failed attempts.