How safe the link is
The dashboard is optional. Without a link the plugin talks to nobody. This page says what the dashboard may do, what it never does, and what happens at worst.
The rules
- 1
Only if you want it
The plugin makes no connection to the dashboard until someone types bsb link in the server console. No code, no connection.
- 2
Your server calls out, never the other way round
The plugin opens no port. It connects by itself over HTTPS and always checks the dashboard's certificate. This check cannot be switched off.
- 3
Linking with a one-time code
The code from the dashboard is valid for ten minutes and works once. Only an operator of the server or somebody at its console can enter it. The server is linked only after you say yes in the dashboard. bsb unlink ends the link at once.
- 4
The dashboard may do what you may do in game
Whoever links binds the account to themselves: to their player or to the console. If that player loses OP and the permission bsb.dashboard, the server turns down every request; once they get them back, it works again. Actions run with their permissions.
- 5
Three levels, your server switches them off
Setup (texts and settings), live view (players, performance, worlds, chat) and actions (a fixed list of BSB commands such as kick or maintenance). The server's config can switch off any level; the dashboard cannot switch one on. No level touches files, code, OP, permissions or money.
- 6
Your server checks everything itself
For every request the plugin asks: is the bound admin still an admin? Is the level on? May they use this command? Can this setting be changed from outside? Do type and length fit? What does not fit is turned down, whoever sends it.
- 7
Everything can be undone
Before the plugin changes anything, it writes the old values to dashboard-history.json on your server. bsb undo takes back the last change, the dashboard older ones too (the last 50). Next to every config file lies the previous version as .bak, and every change is in dashboard.log with time and account.
- 8
Nothing sensitive leaves the server
No passwords, no tokens, no IP addresses of your players, no balances to change.
- 9
Accounts are protected
Passwords are only kept as a slow hash, sign-in attempts are slowed down. With two-factor sign-in a stolen password is not enough. When an unknown browser signs in, you get a mail with a link that signs out every device. Under "Security" in your account you see where you are signed in.
- 10
Safe while streaming
Nothing visible in game, in chat, in the console or in the dashboard is enough on its own to link or control anything. A code read on stream does nothing without your yes. Links never carry a secret, and your server's key is never shown.
Free console
Level 4 is off until somebody enters bsb dashboard on console read (reading only) or bsb dashboard on console full (commands too) in the server console and confirms. It cannot be switched on in the dashboard or in game. With full your dashboard account has nearly the power of the server console. So:
- Before every session the dashboard asks for your password again, with two-factor sign-in for the code too.
- Every command is signed by your browser; the server takes commands only from browsers you confirmed. Log lines and answers are encrypted for your browsers; the service cannot read them.
- IP addresses in the log are blacked out before a line leaves the server.
- Commands run as their own sender "Dashboard (account)", never as the server console. op, deop, bsb dashboard on and bsb link are always blocked, stop and restart while server management is off – also through aliases, minecraft:op, upper and lower case, execute … run and the line that sudo, powertool, schedule or a custom command runs. sudo and powertool of other plugins and permission plugins (LuckPerms and others) are blocked as a whole. Your own blocks go in dashboard.console.blocked.
- At most 10 commands a second and 600 a minute.
- Every command is written to dashboard.log, and OPs in game see it at once. bsb dashboard off console ends every session.
- The plugin cannot take back what a command did, and a command of another plugin can do more than the blocklist knows. Switch on full only if you trust the account like somebody at your server console.
- RCON counts as the server console: whoever has the RCON password can link and switch on level 4. The dashboard never shows rcon.password in the clear. Keep it secret or switch RCON off in server.properties (enable-rcon=false).
How to tell a real message
What the plugin itself says about the link starts with "BSB »" in chat. Texts from the dashboard may not look like that; the plugin turns them down. Still, only what you see yourself under bsb is real: which account the server is linked to and whom it is bound to. Neither the plugin nor the dashboard ever asks you in chat to type a command.
What happens at worst
- Case
- Somebody steals your dashboard account
- At worst
- They change texts and settings, watch, and run the actions whose command you have in game – on every server you linked.
- What limits it
- Never more than you may do in game; every level can be switched off in the config; no action touches files, code, permissions or money; bsb undo and bsb unlink; two-factor sign-in.
- Case
- The dashboard service is hacked
- At worst
- The attacker can send each linked server what its switched-on levels allow, nothing more.
- What limits it
- The plugin checks every message itself against level, list and schema. The service keeps no server keys in plain text and no player data.
- Case
- Somebody reads your code on stream and enters it on their own server
- At worst
- If they are faster than you, their request shows up in your dashboard.
- What limits it
- Nothing is linked without your yes. The request shows a number; confirm only if your server shows exactly this number.
- Case
- Somebody listens on the network
- At worst
- Nothing.
- What limits it
- HTTPS only, the certificate is always checked. If it is not valid, the plugin does not connect.
- Case
- Somebody steals your server's key (a file in the plugin folder)
- At worst
- They can pose as your server, show false live data and catch changes. They cannot command your real server.
- What limits it
- If two places use the same key, the service blocks it and asks for a new link. The key is never in the log.
- Case
- A fellow admin with OP wants to cause trouble
- At worst
- They can link their own account and then have in the dashboard what they have as an operator anyway. If they link again, your account is no longer bound.
- What limits it
- bsb shows whom the account is bound to.
- Case
- An admin loses OP while watching
- At worst
- They see the live data until the next check.
- What limits it
- The plugin checks before every request; every further one is turned down.
- Case
- An admin loses permissions while offline, and there is no Vault
- At worst
- Until they come back to the server, the state from their last visit counts.
- What limits it
- OP is checked offline too, with Vault the permission as well. To be sure, take OP away or unlink with bsb unlink.
- Case
- An old message is sent again
- At worst
- Nothing.
- What limits it
- Every request has a running number and an expiry; the plugin never runs a number twice and nothing expired.
- Case
- Somebody tries other people's mail addresses when registering
- At worst
- They learn whether an address already has an account.
- What limits it
- At most five registrations per hour and caller. Sign-in and "Forgot password" answer the same for known and unknown addresses.
- Case
- The service cannot be reached
- At worst
- The dashboard shows the server as offline.
- What limits it
- The server runs on unchanged; the plugin tries again at growing intervals.
- Case
- Somebody steals your account while the console is on full
- At worst
- They run commands as at the server console, except the blocked ones.
- What limits it
- They need your password, the two-factor code and a browser you confirmed. Blocklist and brake in the plugin; OPs see every command; dashboard.log; bsb dashboard off console or bsb unlink in the server console ends it at once.