Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot use empty password in action mode #37

Open
cheeseandcereal opened this issue Jan 24, 2024 · 2 comments
Open

Cannot use empty password in action mode #37

cheeseandcereal opened this issue Jan 24, 2024 · 2 comments
Labels
wontfix This will not be worked on

Comments

@cheeseandcereal
Copy link

cheeseandcereal commented Jan 24, 2024

When connecting to an rcon server, you may legitimately want to provide an empty string for a password. This is possible in interactive mode, however in 'action' mode, an error will always be thrown if password is not specified, or even if it is with an empty string:

if ses.Password == "" {
return ErrEmptyPassword
}

This makes it impossible to connect to servers with an empty password in action mode. I would propose either adding a flag that allows an empty password, or simply not throwing this error at all since an empty password is a legitimate use-case.

If you're interested in accepting either proposal, I'm also willing to make a PR if you would like.

@outdead
Copy link
Member

outdead commented Feb 3, 2024

Empty password is unsecure. From Valve RCON protocol documentation:

If the rcon_password cvar is not set, or if it is set to empty string, all SERVERDATA_AUTH requests will be refused.

@outdead outdead added the wontfix This will not be worked on label Feb 3, 2024
@cheeseandcereal
Copy link
Author

I agree with you that it's not secure, but regardless there are still servers which don't have a password set, so I still see a legitimate use-case for this since this is just a cli interacting with other servers. If the other servers have a password set, let the server auth reject rather than requiring it to be set in this tool (especially because you can provide an empty password in interactive mode already with this tool).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

2 participants