Security System Script

[Inflikted]

I am attempting to implement a security system script, which I'll probably end up releasing anyways on lomcn. but wanted a little bit of guidance of thinking the entire thing throughly before scripting it or any other ideas you might have. possibly from chimera or idabiga lol my heros :P

some might think im crazy and say.. umm dont you already have a user/pass to enter in mir3..
the reason i wanted to do this, is in lew of new programs available to grab hold of weak/medium password off accounts, through a modified login interface. and to end the whining of... 'my account got hacked' so i wanted to make a more secure system. so GM's no longer have to deal with accounts supposedly getting 'hacked' this will put all of it on the user, to grow a brain and protect themselves plus i think i could implement it into other more expanded items later. but this is the basic thing i have down now.

So my idea is:

Password Entry Portion:
Allow any user to have the choice (he doesn't have to do this) to join the secure system program. Which will randomly generate a 10 character password for the user that includes random numbers/letters (and yes i no how to do randomized letterings ), and a question/answer field, to retrieve the pass if he forgets it. this will all be stored in a new database, along with his username.
I probably can take this a step further, to include a web interface, to retrieve your pass by email, and email it to the address you provide when you first entered the info in.. But ya this is a work in progress
this probably will be the most complex part of the script lol...

Security Levels:
After the user has done this, I probably won't allow them to revert, unless they speak to a GM. as I dont want people going back and fort with the security system, as it undermines it.

They will have the option to choose for various levels of security:

Basic Security: Will protect stored items, and commons items. Without entering the said password. Once the password is entered, it will be saved, until they relog, then it will require a pass again to access these things. This level will be useful if you only want someone to pvp with your character or level. Without stealing goods. I don't really like the password system used for storage.. as oddly it sometimes bugs.. and your password no longer works, anyone no why? lol

Advanced Security: Will protect stored items, and commons items. But when you logout, the next time you login. You will be in a safe room. You cannot teleport, mail, ring away, dropitems, or do anything. Till you enter the correct password. Which will allow you access then to the game. This is sort of the flagship.. of this script. So even if your account does get hacked somehow.. its somewhat useless for it actually being used... or the items getting moved around or causing troubles on the server.so the worst that can happen is your char gets deleted. which can be retrieved.. but items, levels, storage stuff, gold, common stuff, guild, will be left untouched. you may say.. big deal, but the common motivator for a hacker is to get your stuff.. not to delete your char, as char can be restored so this i hope will reduce hacking attempts.
Now I came to a little hitch in my plan.. is there a command that would stop a person from even taking an item off their character and putting it in bag? Sort of lock that out aswell? The only way I could think of was flooding their bag with useless crap. And when they entered the correct pass, they are teleported to bichon, and the crap is removed from the bag. I just want this system secure. So nothing could go wrong.

so comments, suggestions, complaints, probably a bunch will say its a waste of time :P lol

 

[chimera]

There is already an additional password protection available for storage as part of 3.55 files I believe but no-one uses it. I have never heard of someone being hacked on Mir3.55 - what I have heard is account sharing, servers being hacked (the computers not mir3 itself), which means they have access to the database so any and all passwords would be available or people using the same usernames/passwords throughout all different servers and that info from previous servers being released or the other servers PC being hacked.

If each server you go on your username/password is unique and you don't share it then unless the server owners pc gets hacked into, you're safe.....if the server owners pc does get hacked into then no amount of security will make any difference.

 

[idaBigA]

If its for Mir 3, there is already a system that does this built in..

Search for

HLSCRIPTCMD CHECKLOCKUSER
HLSCRIPTCMD LOCKUSER

 

[Inflikted]

tools im talking about, for some reason avoid the '3 passsword guess' caplimit, and allow you to try as many times as you want. in other words.. its a bruteforce password system. kinda sad someone put the time to make one.. these kind of programmers should be helping us make anti-cheat programs

i'm not sure if the PC could have been hacked, as we change passwords, for SQL and our remote desktop on a biweekly basis, and do virus scan checks often.
could you explain the additional password protection system chimera thats for 3.55, maybe its easier to use than my idea ?

 

[chimera]

The one I'm refering to only locks your storage ongame and I think you are looking for one that will be a 2 tier password system to log into the character/game, so I don't think what I mentioned is what you are looking for.
But, the password system for character storage should be on the storage npc.

Suggestion:
You could put in a script attached to the login part of the server which gives you say 10 seconds to type in a code/password or it kicks you I suppose..... though this would be irrelivant if the server PC was hacked also as the code/password would be stored in the sql.

 

[idaBigA]

THe one I mentioned not only locks your Storage, it locks you Char completely.

You can't move items on your char, you can't move items in your bag, you can't chat, you can't even move your character if its locked.

This is a post I was compiling, but I stopped looking at the system as I got busy at work.. it isn't finished, so if anyone wished to look further.. feel free to finish this post off

Found in - - - Envir\QuestDiary\HLSCRIPT\UserLogin.txt

#IF
#ACT
   mov  A0  %PASSWD(9)

#IF
   HLSCRIPTCMD CHECKLOCKUSER
   !equal A0 ""
#ACT
   HLSCRIPTCMD LOCKUSER
   SysMsg "This Char is LOCKED!  Please Enter Password to Unlock"
   BREAK

Found in - - - Envir\QuestDiary\HLSCRIPT\CruelDragonMir3G.txt

[@MIR3G_4]
{
#SAY
   {FCOLOR/10}Your Char is Locked{FCOLOR/12}\
   {FCOLOR/10}Please Enter the Password to Unlock the Char{FCOLOR/12}\\
   <[ Enter Password ]/@@*11_Input_PassWord>\

[@@*11_Input_PassWord]
#ACT
   mov  A0  %PASSWD(9)
   mov  A1  %INPUTSTR

#IF
   equal A0 %A1
#ACT
   HLSCRIPTCMD UNLOCKUSER
#SAY
   {FCOLOR/10}Char Unlocked{FCOLOR/12}\\
   <[ Exit ]/@exit>\\\

#ELSESAY
   {FCOLOR/1}Password Incorrect{FCOLOR/12}\\
   <[ Exit ]/@exit>\\\
}

Found in - - - Envir\Market_Def\00Default.txt

[@_NewCommand1]                                 ;Character Locker
#IF
#ACT
goto @CruelDragonMir3G4

[@CruelDragonMir3G4]
#CALL [HLSCRIPT\CruelDragonMir3G.txt] @Mir3G_4

Found in - - - Mud3\CruelDragonMir3G.ini

This is where you must edit the command you type in game, in the case of this screenshot, simply type @lock in game to unlock your Char

-----------------------------------------

Edit - Can't find the place that sets and unsets your Char Locking system. Sorry - Half a system

-----------------------------------------

Edit - OK, from what I can tell.. the system is activated system wide.. i.e. everyone has to use it, and enter a password at startup.

The Default password is 741213.

Once the system has been activated (Set in the CruelDragonMir3G.ini - see Pic @ bottom (Missing 45, with the Restrictions on the locked user set below that), thanks for the pointer Chimera), everyone then has to enter the password 741213 when they log in. The the have the option of either changing this password.. or clearing it. As below

[@CharLock]
{
#SAY
   <[ Set Password from Default - 741213 ]/@SetPassword>\\
   <[ Clear Password ]/@ClearPassword>\
   If you Enter any value, it will NOT Clear your Password>\\
   <[ Exit ]/@exit>\\\


[@SetPassword]
#ACT
   FormatStr "FLD_CHARACTER='%s'" %USERNAME
   ReadValueSql  "TBL_QUEST"  %A9  "FLD_PASSWD"  [@SetPasswordRead]


[@SetPasswordRead()]
#ACT
   Mov A0 %ARG(1)
   Mov D1 741213
#IF
   HLSCRIPTCMD CHECKLOCKUSER
   Equal A0 %D1
#SAY
   Please now Enter the NEW Password you wish to use\
   <[ Enter Password ]/@@SetPasswordSet>\
#ELSESAY
   This password has been changed already\
   Please use the Change Password Function\\
   <[ Exit ]/@exit>


[@@SetPasswordSet]
#ACT
   Mov A1 %INPUTSTR
#IF
   !EQUAL A1 ""
#ACT
   FormatStr "FLD_CHARACTER='%s'" %USERNAME
   Mov A5 %A9
   FormatStr "FLD_PASSWD='%s'" %A1
   UPDATEVALUESQL "TBL_QUEST" %A5 %A9
   SysMsg "Password Changed to <$OUTPUT(A1)>"
   Close
#ELSEACT
   SYSMSG "Blank Password CANNOT be used!"


[@@ClearPassword]
#ACT
   Mov A2 %INPUTSTR
#IF
   Equal A2 ""
#ACT
   FormatStr "FLD_CHARACTER='%s'" %USERNAME
   Mov A5 %A9
   FormatStr "FLD_PASSWD='%s'" %A2
   UPDATEVALUESQL "TBL_QUEST" %A5 %A9
   SysMsg "Password Cleared. Char Lock Disabled"
   Close
#ELSEACT
   SysMsg "Password has NOT been cleared"
}

Please post if I have a serious problem with my Theory lol I can't be bothered to test as I don't want to implement the system anyway.

If you look @ Missing 45 and the options below, it shows what can be locked.

Hope you have some luck with this, and post your findings, I don't want to have it on Sting, so I didn't look into it any further.

 

[Inflikted]

wow thanks alot ida and chimera you guys are good hehe

ill check this out when i get time