13.04.2018, 23:54
On first glance this basically works, but still the main issue is that IF you manage to get the RCON password you can still do everything with it, just not from ingame (Remote Console).
Also you can send RCON Commands while the "second RCON" Dialog is open, just press F6. Unless you actually disable RCON Commands from that player until he entered the second password, this will still not be secure. At this point the player already knows the RCON Password AND is logged in!
You should switch the order:
First, log in with the second (custom) RCON Password, which will allow the player to log into the actual RCON.
If a player attempts to log into RCON without having entered the "custom" password, ban the IP for X seconds.
Only this way ensures that a player cannot log into RCON without having typed the other password. Doing it your way will have the player logged in to actual RCON while seeing the Dialog for the second password.
Also you can send RCON Commands while the "second RCON" Dialog is open, just press F6. Unless you actually disable RCON Commands from that player until he entered the second password, this will still not be secure. At this point the player already knows the RCON Password AND is logged in!
You should switch the order:
First, log in with the second (custom) RCON Password, which will allow the player to log into the actual RCON.
If a player attempts to log into RCON without having entered the "custom" password, ban the IP for X seconds.
Only this way ensures that a player cannot log into RCON without having typed the other password. Doing it your way will have the player logged in to actual RCON while seeing the Dialog for the second password.