search

gorcon / rcon-cli

RCON client for executing queries on game server.
MIT License
468 stars 44 forks source link

Cannot use empty password in action mode #37

Open cheeseandcereal opened 8 months ago

cheeseandcereal commented 8 months ago

When connecting to an rcon server, you may legitimately want to provide an empty string for a password. This is possible in interactive mode, however in 'action' mode, an error will always be thrown if password is not specified, or even if it is with an empty string: https://github.com/gorcon/rcon-cli/blob/15198b3378665786a9b5af18a6b3ebe93afc18ff/internal/executor/executor.go#L330-L332

This makes it impossible to connect to servers with an empty password in action mode. I would propose either adding a flag that allows an empty password, or simply not throwing this error at all since an empty password is a legitimate use-case.

If you're interested in accepting either proposal, I'm also willing to make a PR if you would like.

outdead commented 7 months ago

Empty password is unsecure. From Valve RCON protocol documentation:

If the rcon_password cvar is not set, or if it is set to empty string, all SERVERDATA_AUTH requests will be refused.
cheeseandcereal commented 7 months ago

I agree with you that it's not secure, but regardless there are still servers which don't have a password set, so I still see a legitimate use-case for this since this is just a cli interacting with other servers. If the other servers have a password set, let the server auth reject rather than requiring it to be set in this tool (especially because you can provide an empty password in interactive mode already with this tool).