Staff, step-up and lockdown

Ordinary players enrolling is a nice-to-have. Staff enrolling is the point.

Requiring it

Give the rank the node and the choice is gone: they must set up a second factor, and they are challenged when they join.

lp group mod permission set emberlock.force true
lp group admin permission set emberlock.force.totp true

• emberlock.force - must have something.
• emberlock.force.totp - must have an authenticator app. A PIN will not satisfy it, because a four-digit PIN typed in front of a stream is not protection for someone who can ban.

There is also emberlock.bypass, which exempts an account entirely. Grant it to nobody. It exists for the one case where you have locked yourself out and need a way back.

Step-up confirmation

Gating the moment somebody connects protects the connection. It does nothing about the laptop left open in a kitchen while the owner answers the door.

So the dangerous commands ask again. When a guarded command is typed, the prompt appears and the command runs only after the right answer. One answer covers the next five minutes of work, so a run of admin commands is not five prompts.

Guarded by default: op, deop, ban, stop, lp, gamemode, give and more, all editable. Add whatever your server considers dangerous, including commands from other plugins.

step-up:
  enabled: true
  minutes: 5
  require-enrolment: false
  commands:
    - op
    - deop
    - stop
    - ban
    - lp

require-enrolment: false means a staff member who has not enrolled is not blocked from working. Set it to true once everyone has enrolled, and an un-enrolled account cannot run a guarded command at all.

emberlock.stepup.exempt opts an account out of the re-challenge.

While a player is being challenged

Everything below is cancelled until they answer:

movement, chat, commands other than /lock, breaking, placing, interacting, dropping items, damage taken, damage dealt, mobs targeting them, and hunger.

Two of those matter more than they look. Damage taken and mob targeting are both held, or a player can be killed while sitting at a prompt they cannot dismiss. And the prompt is not the boundary: a client that ignores an open window still gets nowhere, because the events are cancelled server-side.

Closing the window reopens it. There is no way out except answering.

The incident button

/lock all

Challenges every account online, right now. This is for the moment you think something is already wrong: a strange command in the log, a staff member acting oddly, a report of a leaked password.

/lock all <player>

does one person. And:

/lock now

locks you, which is what to press before walking away from the desk.

Attempts and lockouts

Five wrong answers locks that account out for fifteen minutes. It is a lockout, not a kick, because a kick simply invites a reconnect and another five tries, which is not a limit at all.

Ninety seconds to answer a prompt, or the player is removed from the server.

Staff with emberlock.notify are told about lockouts, recovery-code use and factor removal. Individual wrong codes are noisy and off by default.

/lock unlock <player> lifts a lockout early.

The audit trail

Every enrolment, pass, failure, lockout, recovery-code use and removal is recorded. Console and a file always; a Discord webhook if you want it in a channel.

audit:
  console: true
  file: true
  discord-webhook: "https://discord.com/api/webhooks/..."
  alert-on-failure: false

A webhook is used rather than a bot token on purpose: a token is a credential for your whole Discord, while a webhook can only ever post to the one channel you made it for. Addresses in alerts are masked to the /24, so the channel does not become a list of your staff's home IP addresses.