rlg

# rLogin > ## ⚠️ Requires PacketEvents > > On a **single server** with `online-mode: false` and no proxy, rLogin verifies premium accounts against Mojang itself, and it **needs [PacketEvents](https://modrinth.com/plugin/packetevents) installed to do that**. Without it rLogin refuses every connection rather than leaving your server with no authentication at all. > > There is nothing to enable: rLogin reads how your server is set up and decides for itself. > > Behind a **Velocity/BungeeCord proxy**, or with `online-mode: true`, PacketEvents is **not** needed — the proxy or the server already did the verifying. **Premium players join without typing anything. Everyone else logs in with a password. On the same server, with no proxy required.** rLogin ships as a **single jar** for Paper, Folia and Velocity — it detects which one it is running on and enables only the relevant half. Drop it in `plugins/`, start the server once, and it works. --- ## Premium auto-login without a proxy Combining "premium joins with no password" and "cracked joins with one" normally needs a Velocity proxy in front, because `online-mode` is a single server-wide switch. rLogin performs Mojang's verification itself instead, so both work on one `online-mode: false` server. **There is nothing to enable** — it detects that your server needs it and turns itself on: 1. It holds the login and asks Mojang whether the connecting name is a real premium account. 2. If it is, it runs the encryption handshake — the client shows its own **"Encrypting…"** screen and authenticates against Mojang on its own. 3. It confirms with Mojang's `hasJoined` that the client genuinely **owns** the account, not merely that the username exists. Someone who only knows your name cannot fake this. 4. The player joins with their **real Mojang UUID and skin**, exactly as on any online-mode server — so permissions, economy and bans all see the same identity they always would. This is the part that requires [PacketEvents](https://modrinth.com/plugin/packetevents). It is not bundled because PacketEvents is GPL-3.0 and rLogin is MIT. ### UUID modes | `premium.uuid-type` | Premium player | Cracked player | |---|---|---| | `real` *(default)* | real Mojang UUID | offline UUID | | `cracked` | offline UUID | offline UUID | | `random` | random, kept per name | random, kept per name | `real` is the only mode where "premium Steve" and "cracked Steve" are two separate accounts. `cracked` (also accepted as `offline`) keeps an existing offline-mode world and database working untouched. `random` lets a player move between premium and cracked without losing their data. --- ## Passwords never reach your logs Minecraft servers write every command a player runs to the console and to `logs/latest.log`, verbatim — which for `/login` and `/register` means **their password in plain text**. The server does this *before* any plugin is consulted, so no plugin can prevent it by cancelling the command. rLogin stops it at the logging layer instead. The command is still recorded for your audit trail, with its arguments replaced: ``` Steve issued server command: /register hunter2 hunter2 ← never written [rLogin] Steve ran /register *** ← written instead ``` This is not configurable, deliberately. Players reuse passwords across servers, so a switch to turn it off would only ever be useful to someone collecting them. --- ## Your config survives upgrades New settings are merged into your existing `config.yml`, in the right section and with the comments that explain them. Every value you had set is left exactly as it was. ## Security - **Brute-force lockout is by address, not by account.** Locking the account would let anyone who knows a name keep its owner out by failing logins on purpose. - **"Remember me" is never applied to an account with 2FA**, and changing a password cancels it. - Passwords are stored with bcrypt: salted, irreversible, cost-configurable. ## Everything else - **2FA (TOTP)** with any authenticator app, opt-in per player with `/2fa enable` - **Brute-force protection** with escalating lockouts - **Premium-name protection** so a cracked player cannot claim a premium name - **"Remember me"** sessions by IP, so a quick reconnect does not ask again - **Bedrock** players via Geyser/Floodgate are recognised automatically - **Folia** support from day one — regional schedulers, never the global one - **17 languages** included: `en` `es` `pt_BR` `de` `fr` `ru` `zh_CN` `pl` `it` `nl` `tr` `uk` `ja` `ko` `ar` `vi` `id`. Drop your own `lang_.yml` in `messages/` to add more. - **Velocity** path with optional authentication-lobby routing - **AuthMe import** via `/rlogin migrate authme` - Passwords stored with **bcrypt** — salted, irreversible, cost-configurable --- ## Commands | Command | What it does | |---|---| | `/login [2fa]` | Log in | | `/register ` | Create your account | | `/changepassword ` | Change it | | `/logout` | Log out | | `/2fa ` | Manage two-factor auth | | `/premium` | Check whether your account is premium | | `/rlogin ...` | Everything above, plus admin subcommands (`rlogin.admin`) | `rlogin.bypass` skips the login requirement entirely — for NPCs and test bots. --- ## Requirements - **Java 21+** - **Paper or Folia 1.21+** for the backend - **Velocity 3.x** only if you run a proxy - **[PacketEvents](https://modrinth.com/plugin/packetevents)** on a standalone server (not needed behind a proxy) ## Getting started 1. Put the jar in `plugins/` and start the server once. 2. For a normal setup, that is all. Everything in `plugins/rLogin/config.yml` is documented inline and has a sensible default. 3. On a standalone server, install [PacketEvents](https://modrinth.com/plugin/packetevents) too. Premium auto-login then works on its own — there is no setting to turn on. --- ## Known limitations Stated up front rather than discovered later: - **The nLogin and JPremium importers are not implemented.** `/rlogin migrate authme` works; the other two tell you they are not ready rather than pretending. - **Metrics report nothing yet** — the bStats integration stays inert until a plugin id is registered. Source, issues and full documentation: **https://github.com/raimondarias/rlogin**