16-07-2002 10:25									#1
	Any way to put passwords on the FreeCiv server? Inflate your Upload Space

I want to set up a FreeCiv server that will stay running for several days/weeks to play a long-term game (like a 24-hour turn timeout). The idea is that players would not be required to remain connected. They would log in, perform their turns, and log back out.

I have version 1.12.6 (beta). Version 1.13 seems to be the same: Whenever a client connects to the server they may use whatever name they wish, and so they could therefore use another player's name and sneak a peek at their empire. I expect the players to be trustworthy, but to ensure honesty I would like the server to require a password at login. Is there any way to do this with FreeCiv? Or do I just have to rely on the honor system?

	16-07-2002 21:35									#2
	Remove this text

There has been talk on the freeciv-dev list about adding in authentication code to the civserver, but nothing has come of it at last check. It would be possible to do a quick and dirty password protection system, but the developers would prefer to have a password system that is well designed and secure.

	16-07-2002 22:24									#3
	Suffering from ads?

That's good to know!
If I get desperate in the meantime I guess I could ... hmmm ... attempt to kludge my own code. (heaven help us)

	17-07-2002 03:17									#4
	Get a bigger avatar today!

Yes, some kind of player authentication is planned for the next release. What it will look like is still being discussed. Ideas welcome.

	17-07-2002 05:19									#5
	Support Apolyton buy from Amazon

It could be as simple as adding a password to the Connect box. If the user is new, the server could record the password (possibly requiring the user to reenter the password to verify). If the user is returning, the server could compare to the stored password.

I would prefer to keep it as simple as possible, and not require the user to establish public/private keys. Remember that 90% of the users will not be security savvy.

As a compromise, the plaintext password could be passed just once when the player is first created, and then something like the CHAP protocol could work for subsequent connections.

I would prefer to see weak security sooner than wait a long time for a highly secure system. This ain't a matter of national security.

	17-07-2002 15:53									#6
	Support Apolyton, buy Civilization 2

We also wish to use authentication for the ranking list (used on civserver.freeciv.org), as currently security there is based on the honour system, which works well only up to a point. That makes it a bit more complicated.

	22-08-2002 15:24									#7
	Basic Auth System. Support Apolyton buy from Amazon

I once saw someone who implented a basic authentication system for free civ, although not 100% secure , its prefect for what you want to do.

Make the users login as "Username:Password" then make sure the :Password part doesnt show up anywhere in the others users screens.

The users still have to reconnect using there full usernameassword name, but noone knows what the full name is since you filtered that out.

This should be a really simple change to the server source code.
You only have to change how the user name shows in the server/client programs.

Quazion.

	23-08-2002 03:27									#8
	Support Apolyton buy from Amazon

Simple, yet effective short term solution

Something like this would probably hold off 90% of the cheaters.